India

What's verified

India has no single national post-quantum mandate. What it has instead is a layered structure: a technical specification from CERT-In, a national roadmap from DST with dated milestones, and binding cryptographic-inventory requirements arriving through individual sectoral regulators. The binding parts are the newest, and the most easily missed.

Two binding requirements already in force

IRDAI issued its Information and Cyber Security Guidelines 2026 on 6 April 2026. Among the controls listed as new in that edition is Control 110, under Asset Management (ID.AM):

"Does the organization maintain an up-to-date inventory of its cryptographic assets to ensure preparedness for transition to postquantum cryptographic environments?"

The covering circular states that all insurers including foreign reinsurance branches, intermediaries covering brokers, corporate agents, web aggregators, TPAs, insurance marketing firms, repositories, ISNPs, corporate surveyors, MISPs, common service centres and the Insurance Information Bureau "shall strictly adhere to the said guidelines and ensure compliance from the current financial year," describing them as "minimum standards." The control applies across all three entity categories with no threshold exemption, and it also appears in the auditors' report annexure — so it is checked by an external auditor, not merely self-attested.

SEBI's CSCRF circular of 20 August 2024, issued under section 11(1) of the SEBI Act 1992, covers roughly twenty categories of regulated entity from stock exchanges and depositories to investment advisers and portfolio managers. Its quantum provision sits in Box Item 7, "Cybersecurity and Quantum Computing," at pages 59 to 60:

"To mitigate these risks, REs shall focus on the following indicative measures: 1. REs shall maintain an inventory of cryptographic assets, prioritizing critical assets for Post Quantum Cryptography (PQC) migration, and assess their IT infrastructure capabilities."

The drafting is internally in tension — "shall focus" on "indicative" measures — and the clause sits in a call-out box rather than in the numbered Standards. A firmer requirement is in the Standards themselves: risk assessment "including post-quantum risks" is to be carried out periodically, and encryption methods are to be mapped and inventoried across IT systems and network resources.

SEBI's June 2025 FAQs elaborate what the inventory means in practice: entities should identify and document all assets using cryptographic mechanisms including data in transit and at rest, and "the inventory shall describe what cryptography is used by which application for what purpose" and "shall include keys, certificates, algorithms, etc."

Compliance timelines were extended by two months to 31 August 2025 for all regulated entities except market infrastructure institutions, KYC registration agencies and qualified RTAs, which stayed on the original schedule. That date has passed; CSCRF is in force.

CERT-In's specification is the most detailed, and the least binding

CERT-In released version 2.0 of its Technical Guidelines on 9 July 2025, covering SBOM, QBOM, CBOM, AIBOM and HBOM.

One structural point is often reported incorrectly: there is no standalone CBOM minimum-element table. The document handles CBOM and QBOM together. Table 8 lists the QBOM elements — model name, version, vendor and origin, licence, cryptographic asset, communication protocol, hardware, software dependencies, environmental impact, vulnerabilities, attestations — and its cryptographic asset row defers to Table 9, which specifies minimum elements pertaining to cryptographic assets, typed by asset class:

• Algorithms — name, asset type, primitive, mode, crypto functions, classical security level, OID, list
• Keys — name, asset type, id, state, size, creation date, activation date
• Protocols — name, asset type, version, cipher suites, OID
• Certificates — name, asset type, subject name, issuer name, validity dates, signature algorithm reference, subject public key reference, format, extensions

That model maps closely onto CycloneDX's CBOM asset types, and the guidelines name CycloneDX and SPDX as the recognised formats.

The recommendation language is imperative. Section 8.4.1 states that all government, public sector and essential services organisations "shall require" a CBOM for cryptographic assets and a QBOM for quantum systems in procurements, developments and integrations; that suppliers "must provide" a complete CBOM or QBOM; that organisations "must maintain" an accurate and up-to-date one; that BOMs "shall be generated" in SPDX or CycloneDX; and that periodic audits "must be conducted."

But those imperatives sit inside a chapter headed "Recommendations and Best Practices," in a document whose stated scope is entities that are "encouraged" to adopt it. The guidelines cite no legal basis at all — no reference to section 70B of the IT Act, and no cross-reference to CERT-In's binding 2022 Directions. The enforceability that CERT-In's incident-reporting directions carry does not transfer to this document by its own text. Nor does the document state any compliance deadline; its only time-bound obligations are relative, such as quarterly reviews.

DST's roadmap: dated, and designed to be made binding by others

DST's National Quantum Mission published "Report on Quantum-Safe Ecosystem in India: Roadmap to Quantum Resiliency" in May 2026, following a Task Force report in February 2026. It sets three milestones on two tracks:

Track	Preparatory (CBOM, QRA)	High-priority migration	Full adoption
CII — government, strategic, defence, power, telecom, transport, BFSI	31 Dec 2027	31 Dec 2028	31 Dec 2029
Regular enterprises	31 Dec 2028	31 Dec 2030	31 Dec 2033

Milestone 1 is labelled as the preparatory stage for CBOM and quantum risk assessment, which makes a cryptographic bill of materials the roadmap's first concrete deliverable. The roadmap also dates the procurement mechanics: from FY 2026-27, organisations should start requesting CBOMs and quantum resiliency roadmaps from vendors, and from FY 2027-28 they should mandate CBOM submission from vendors through the procurement process.

On the report's legal status, a widely repeated quote needs narrowing. The sentence "It does not constitute a legal or regulatory mandate. Adoption, timelines, and enforcement shall be determined by the respective sectoral regulators and competent authorities" appears in the February 2026 Task Force report, and its subject is the testing-and-certification framework described in the surrounding text — not the roadmap as a whole. We found no report-wide disclaimer.

What the roadmap says about itself is different, and stronger. It describes the documents as "serving as a reference for sectoral regulators, to give specific and binding mandates for organisations," and recommends that regulators including RBI, TRAI, IRDAI and SEBI initiate sector-specific guidance. Read alongside IRDAI's April 2026 control and SEBI's framework, the sectoral activity looks like execution of that design rather than coincidence.

RBI's Q-SAFE committee

RBI constituted the eight-member Q-SAFE committee on 25 May 2026. It is convened by Dr. Anil Prabhakar of IIT Madras, with Suvendu Pati, Chief General Manager of RBI's FinTech Department, as Member-Secretary. The other members come from DST, State Bank of India, NPCI, MeitY, the Data Security Council of India, and the quantum industry.

Its second term of reference is the CBOM one: to "evaluate the financial sector's cryptographic inventory through a Cryptography Bill of Materials (CBOM), assess crypto agility and identify the critical systems and processes most vulnerable to such threats." Others cover risk evaluation, cross-country regulatory analysis, industry and vendor readiness, and a roadmap to quantum-secure the Indian financial system. RBI uses the phrasing "Cryptography Bill of Materials" rather than the more common "Cryptographic."

The report is due "within six months from the date of its first meeting." RBI has not published when that first meeting took place, so the due date cannot be derived from the constitution date. No report had been published as of 4 September 2026.

What we checked and did not find

• CERT-In's Technical Guidelines cite no statutory basis — no mention of section 70B, the IT Act, or the binding 2022 Directions — and state no compliance deadline.
• SEBI's CSCRF never uses the term CBOM. Its five bill-of-materials references are all to Software Bill of Materials. It prescribes no inventory format.
• IRDAI's Control 110 does not use the term CBOM and specifies no format; the requirement lives in the control and audit annexures rather than in the main guidelines text.
• No NCIIPC publication on PQC, cryptographic inventory, or CBOM was found.
• No standalone MeitY instrument on PQC or CBOM was found; its involvement runs through CERT-In and its Q-SAFE seat.
• We could not verify the notified text of the Digital Personal Data Protection Rules from a primary source, as MeitY's document portal did not serve it. Secondary reporting describes an encryption safeguard that is algorithm-agnostic; no primary source connects it to PQC or CBOM, and this tracker does not score it as a PQC instrument.
• We found no primary source linking the National Security Directive on the Telecommunication Sector to PQC or cryptographic inventory.