DNB's Good Practice Information Security 2023: The Dutch Central Bank's Quantum-Risk Supervisory Expectations

De Nederlandsche Bank's "Good Practice Information Security 2023" tells the banks, insurers and pension funds it supervises to keep "an inventory of the cryptographic landscape (encryption protocols and certificates for network connections, key management and data storage)," to record "how long (e.g. short, medium, long) the applied protocols are no longer safe and how long replacement or mitigation of a protocol is expected to take," and to run "an annual Cryptography Risk Assessment" that explicitly takes "into account the development of Quantum computing and the possible resulting threats to the institution." This is a direct download and text extraction from DNB's own published PDF, not a paraphrase, and it is considerably more specific than a passing mention of quantum risk in a general cybersecurity document.

What kind of document this actually is

"Good Practice" is a defined category in DNB's supervisory toolkit, and the document is explicit about its own legal weight. Its disclaimer states plainly: "For this Good Practice, these are non-mandatory recommendations. With the help of this Good Practice, DNB expresses its views on the observed or expected behavior in policy practice, which in our opinion constitutes a good application for information security and cybersecurity." It goes on: "DNB Good Practices are indicative in nature and therefore do not rule out that institutions may require a different, stricter or otherwise, application of the underlying rules."

That said, "non-mandatory" doesn't mean toothless. The Good Practice exists to help institutions comply with binding statutory obligations that already require them to manage ICT risk: Article 3:17 of the Financial Supervision Act (Wft), Article 20 of the Prudential Rules Decree (Bpr), Article 143 of the Pension Act, and Article 18 of the Decree on the Financial Assessment Framework for Pension Funds (FTK Decree). Those articles require "adequate procedures and measures to manage ICT risks," including "the integrity, continuous availability and security of automated data processing." The Good Practice is DNB's own account of what satisfies that binding requirement in practice. An institution is legally free to meet the underlying law a different way, but the Good Practice is the yardstick DNB uses in supervision, including in its periodic self-assessments of supervised institutions under its Open Book Supervision program.

Who it applies to

The accompanying "Q&A Information Security" frames the core question as "how do pension funds, premium pension institutions and insurers (hereinafter 'institutions') meet the legal requirements under the supervision of DNB." The Prudential Rules Decree's own definition of "financial institution" is broader still, covering payment companies, clearing companies, credit companies, premium pension companies, and insurers or their branches. In practice, the document's structure (references to insurers processing risk through ORSA, pension funds through ERB, and banks through ICAAP) makes clear it spans the full range of DNB-supervised financial institutions, not one narrow sub-sector.

Not the first version, and not a replacement for DORA

This is an update, not a first edition. DNB states directly: "This was reason to update the 'Good Practice Information Security 2019/2020'." The update responds to two EIOPA guidelines issued since 2019/2020 (on ICT security and governance, and on outsourcing to cloud service providers), and to the EU's Digital Operational Resilience Act (DORA), which the document notes "will apply from January 17, 2025." Because DORA's Regulatory Technical Standards hadn't been finalized at the time of the 2023 update, DNB is explicit that "the GP should therefore be seen as a supplement to the development around DORA and not as a (complete) replacement of DORA." For banks and other DORA-scoped entities, DORA itself became the binding EU-level operational resilience framework from January 2025; DNB's Good Practice continues in parallel, in particular for pension funds, which fall outside DORA's scope.

The document itself lists "attention to risks that may arise from 'Quantum Computing' and its possible control" as one of the substantive changes introduced in the 2023 update, distinct from the 2019/2020 baseline. Quantum risk is a new addition in this version, not something carried over from the prior edition.

Where quantum risk actually shows up in the document

The Good Practice is organized around eight control "elements" (Governance, Organisation, People, Processes, Technology, Facilities, Outsourcing, Testing) plus a Risk Management Cycle, totaling 58 control measures assessed against a maturity model. Quantum computing surfaces in three separate places within that structure, not just once:

• Section 3.1, Risks and opportunities of future trends and regulations, lists as a Good Practice: "Developments in the field of Quantum technology are mapped, both for practical applications of Quantum in the field of security and for risks arising from Quantum technology, such as risks in the field of cryptography."
• Section 4.2, Risk assessment, requires that "the institution analyzes the risks associated with the applications of cryptographic technology to support its business processes in the short (1 year), medium (1-5 years) and long (>5 years) term. In doing so, it takes into account the development of Quantum computing and the possible resulting threats to the institution," with an annual update of that analysis discussed at board level as part of the Risk Management Cycle.
• Section 18.3, Cryptography and Cryptographic key management, is the most concrete: alongside the cryptographic-landscape inventory clause quoted above, it also requires that "the institution carries out an annual Cryptography Risk Assessment" and states that "the institution explores the risks and possibilities of Quantum technology, such as Quantum key distribution or Quantum random number generators." The same section separately requires institutions to monitor "the use of unsafe encryption protocols" and to build "a roadmap for its cryptographic landscape that is in line with upcoming threats in the short, medium and long term."

Read together, this is a cryptographic bill of materials in substance, even though DNB never uses the acronym CBOM: an inventory of protocols and certificates, a timeline for when each stops being safe, and a remediation roadmap, refreshed annually and explicitly weighted against quantum computing as a threat category.

What else the document covers, for context

Quantum risk is one line item inside a much larger supervisory document. The same Good Practice also sets expectations for board-level governance and training, separation of ICT risk management and internal audit functions (referencing the Dutch Corporate Governance Code 2022), outsourcing and sub-outsourcing oversight across the entire service-provider chain, Zero Trust network architecture aligned to NIST SP 800-207, endpoint security and network segmentation, and participation in TIBER (Threat Intelligence-Based Ethical Red-teaming), DNB's triennial live-system penetration testing program. It also flags artificial intelligence and blockchain, alongside quantum, as technologies institutions are expected to actively monitor for both opportunity and risk under Section 3.1. Quantum computing is treated as one emerging-technology risk category among several, but it is the only one of the three given its own dedicated cryptography-specific control (Section 18.3), rather than only a general future-trends mention.

DNB's broader engagement with quantum risk

The Good Practice isn't DNB's only visible activity on this topic. In August 2024, DNB set a practical challenge exercise at the International Cyber Security Summer School (ICSSS), exploring, in the words of a participant's account, "the practical implications of quantum threats for the financial sector and the adoption of post-quantum cryptography (PQC)," specifically drawing a parallel between the historical difficulty of Elliptic Curve Cryptography adoption and the obstacles institutions are likely to face migrating to post-quantum algorithms. Separately, Dennis van Heijst, DNB's Supervisor of Operational and IT risk, appeared as a named speaker at a September 2025 Quantum for Good virtual event specifically on "Post-Quantum Cryptography Transition in the Financial Sector," alongside the observation that the Dutch PQC Migration Handbook classifies financial entities as "urgent adopters" that should begin migration as soon as possible. Neither of these is a regulatory action in its own right, but both indicate that DNB staff are engaging with the technical substance of PQC migration beyond what the Good Practice document alone states.

How this fits with the rest of the Netherlands' quantum-risk posture

DNB's Good Practice sits alongside, not instead of, the Netherlands' broader quantum guidance. AIVD and NCSC's January 2024 joint guide, "Kicking off your quantum migration program," is the country's general-purpose advisory, telling all organizations to inventory cryptographic assets (citing CBOM by name) and prepare for a 2030 to 2040 quantum-risk window. DNB's Good Practice is the sector-specific counterpart for financial institutions specifically, arguably more concrete in its own domain: an annual, board-discussed Cryptography Risk Assessment tied to a defined short/medium/long-term horizon is a more operational requirement than a general recommendation to start planning. AFM, the Netherlands' securities-markets regulator, separately flagged quantum risk to financial-data confidentiality in its Trendzicht 2026 outlook, a strategic acknowledgment rather than an inventory mandate. See the Netherlands country page for how this tracker scores the combination of all three.

Primary source: DNB, "Good Practice Information Security 2023", downloaded and verified directly (PDF, DNB.nl). Additional sources: DNB, "Q&A Information Security"; Security Delta (HSD), "Navigating Quantum Risks: From Summer School Student to Presenting at De Nederlandsche Bank (DNB)"; Quantum for Good, "Post-Quantum Cryptography Transition in the Financial Sector" (17 September 2025).