Spain's Intelligence Service Wants Hybrid PQC 'As Soon As Possible' -- Without Saying When That Is
CCN-CERT, part of Spain's CNI, names all five NIST-recognized PQC algorithm families and recommends hybrid migration now. The guide itself never commits to a date, a sector, or an inventory requirement.
"As soon as possible" is doing a lot of work in Spain's official post-quantum guidance. It's urgent-sounding language with no date attached to it, from a source that carries real institutional weight but zero enforcement power.
A real document from a real authority, with no teeth
CCN-CERT, operated by Spain's Centro Criptológico Nacional under the country's intelligence service CNI, published CCN-TEC 009, "Recomendaciones para una transición postcuántica segura," first in December 2022 and reissued as Best Practices Guide BP-37 in July 2026. That's a dated, versioned, technically substantive document from a credible national authority -- CNI isn't a minor body, and the guide itself goes into real technical depth, naming all five NIST-recognized PQC algorithm families: code-based, lattice-based, hash-based, multivariate quadratic, and isogeny-based cryptography.
What it doesn't do is bind anyone. The document's own language is "recommends" and "recomendaciones" throughout -- CCN "recommends the use of hybrid solutions as soon as possible." That's advisory language, full stop. No statutory force, no named sector that must comply, no audit or certification scheme tied to it.
The sentence that sounds like urgency and isn't a deadline
The specific framing worth noticing: the guide treats hybridization -- running a classical algorithm alongside a post-quantum one in the same operation, so a break in either scheme alone doesn't compromise the whole system -- as "an intermediate step in the migration from current to post-quantum cryptography," not a final destination. It then recommends adopting that intermediate step "as soon as possible."
That phrase reads as urgent, and the underlying technical reasoning is sound: hybrid schemes are genuinely the recommended practical path while PQC-only implementations are still maturing across the ecosystem. But "as soon as possible" names no calendar date, no phased milestone, no year by which hybrid adoption should be complete. An organization reading this guide for a compliance deadline will not find one, because the guide isn't making a compliance commitment -- it's making a technical recommendation with urgent framing.
What's still missing
No sector scope is named -- the document addresses "organizations" generally, not a specific regulated industry or an economy-wide mandate. No inventory or CBOM requirement appears anywhere in the guidance; it covers algorithm selection and hybridization strategy, not asset discovery or cryptographic-component tracking. And no enforcement mechanism exists: CCN-CERT advises, within CNI's broader national-security remit, but nothing in BP-37 itself creates a penalty for non-adoption.
What to do with this
If you operate in Spain, CCN-TEC 009 / BP-37 is worth treating as the most technically credible starting point available nationally -- it's detailed, recently updated, and from an authority with real standing. Just don't mistake "recommends as soon as possible" for a deadline you can put on a compliance calendar. The practical move is to adopt the hybrid approach the guide describes now, on your own organization's risk-based timeline, since no external deadline is going to arrive from this document to force the decision for you.
The Spain country page tracks CCN-CERT's guidance against its primary source.
Frequently asked questions
- Does Spain have post-quantum cryptography guidance?
- Yes. CCN-CERT, part of Spain's intelligence service CNI, published CCN-TEC 009, "Recomendaciones para una transicion postcuantica segura" (Recommendations for a secure post-quantum transition), first issued December 2022 and reissued as Best Practices Guide BP-37 in July 2026.
- Is Spain's PQC guidance binding?
- No. The document itself uses 'recommends' throughout -- it recommends organizations 'use hybrid solutions as soon as possible,' never that they must. There is no statutory mandate, no defined sector scope, and no enforcement mechanism attached.
- What does Spain's guidance say about hybrid cryptography?
- It frames hybridization -- combining a classical algorithm with a post-quantum one in the same cryptographic operation -- explicitly as 'an intermediate step in the migration from current to post-quantum cryptography,' not a permanent end-state. The recommendation is to adopt hybrid solutions now, while full PQC-only migration is still maturing.
- Does Spain's CCN-CERT name specific PQC algorithms?
- It describes the five NIST-recognized algorithm families -- code-based, lattice-based, hash-based, multivariate quadratic, and isogeny-based cryptography -- as categories, rather than mandating a specific one.
- Is there a deadline for PQC migration in Spain?
- No. The guide urges adoption 'as soon as possible' and describes hybridization as an intermediate step, but names no specific year or phased timeline anywhere in its text.
- Does Spain require a cryptographic inventory or CBOM?
- No. The guide covers algorithm-family recommendations and hybridization guidance, with no mention of a cryptographic inventory, CBOM, or general risk-assessment obligation.