Does Israel have a post-quantum cryptography (PQC) law?

Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Bank of Israel, Banking Supervision Department.

What is Israel's PQC migration deadline?

2026 — a date that has already passed. See the sources below for what it actually covered, and treat the current obligation as whatever followed it rather than the original target. The deadline came from Bank of Israel, Banking Supervision Department.

Does Israel require a Cryptographic Bill of Materials (CBOM)?

Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.

ILRegulated

Israel

The Bank of Israel's Banking Supervision Department mandated, under a binding banking directive, that banks and payment providers map their encrypted data assets (functionally a cryptographic bill of materials) and submit an initial PQC preparedness plan by January 2026.

Israel's post-quantum cryptography posture is classified as regulated, led by Bank of Israel, Banking Supervision Department, with a migration target of 2026. It scores 80/100 on this tracker's rubric, one of the more binding and actively enforced rules on this tracker, and that is not a measure of how secure or advanced the country actually is.

What's verified

The Bank of Israel's Banking Supervision Department, in a letter dated 7 January 2025 (ז' טבת תשפ"ה) and signed by Daniel Hahiashvili, Supervisor of Banks, directed all banking corporations and licensed payment service providers to prepare for quantum-computing cyber risk under Proper Conduct of Banking Business Directive 364. The letter explicitly names NIST's PQC standardization process, Quantum Key Distribution, and the "harvest now, decrypt later" threat model, and mandates that supervised institutions:

Map encrypted information assets at rest and in motion, recording for each: encryption algorithm and key length, data owner, systems/applications using it, the retention period the data must stay protected, and its sensitivity/criticality level
Submit an initial preparedness and migration plan to the Head of the Technology, Innovation and Cyber Division by 7 January 2026, one year from the letter's date
Address staff training, vendor and supply-chain PQC readiness, testing infrastructure, and migration of vulnerable algorithms

This is functionally a mandatory cryptographic bill of materials for Israel's banking and payments sector, issued under a real, numbered, binding directive, not general best-practices guidance.

Separately, Israel's National Cyber Directorate (INCD) has published broader best-practices guidance ("Organizational Cyber Readiness to the Post-Quantum Age") aimed at CISOs, CIOs, and technical leadership generally, covering crypto-agility mitigations like shortened key lifespans and Perfect Forward Secrecy. This guidance is non-binding and without a stated deadline, but it is relevant beyond the banking sector Bank of Israel's directive covers.

One caveat on that document: it is dated January 2022, which places it more than two years before NIST finalised FIPS 203, 204, and 205 in August 2024. It therefore names no post-quantum algorithm, and instead forward-references the standards that did not yet exist, advising that products use algorithms "as recommended by the NIST at the time" and that organisations "periodically review NIST's cryptography standards." Its concrete measures are classical hardening — longer keys such as AES-256 and SHA-512 in GCM mode, shortened key lifespans, forward secrecy. We found no post-FIPS Israeli update to it.

Neither Israeli instrument names an approved post-quantum algorithm or parameter set. Read the INCD document carefully if you consult it: its appendix table listing RSA-2048, AES-256, and SHA-256 against web, database, and VPN servers is headed "An example for mapping of Cyber assets" and exists to help an organisation record what it currently runs. It is an inventory template describing the status quo, not a list of Israeli-approved parameters.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	15/20	Issued under Proper Conduct of Banking Business Directive 364, a binding banking-supervision directive: supervised banks and licensed payment service providers are directly required to act ('הנכם נדרשים לפעול'), not merely advised; scored 15 rather than 20 since it binds the banking/payments subset rather than the whole economy.
Deadline concreteness	20/20	The letter requires an initial preparedness/migration plan submitted to the Head of the Technology, Innovation and Cyber Division within one year of the letter's date, a specific date (7 January 2026), not directional language.
Scope of coverage	10/20	Addressed to banking corporations and licensed payment service providers specifically: a named regulated sector, not economy-wide or all critical infrastructure.
Inventory/CBOM requirement	20/20	Mandates a detailed mapping of encrypted information assets at rest and in motion, capturing for each: encryption algorithm and key length, data owner, systems/applications using the algorithm, required protection retention period (tied explicitly to harvest-now-decrypt-later risk), and sensitivity/criticality level. This is functionally a cryptographic bill of materials, explicitly named as a required artifact even without using the term "CBOM."
Regulatory activity	15/20	Bank of Israel's Banking Supervision Department is a real supervisor issuing this under its own numbered directive, with a named recipient (Head of the Technology, Innovation and Cyber Division) and a specific submission deadline: a real regulatory process, though the letter does not itself state fines or penalties for late submission.
Total	80/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Israel Securities Authority (ISA)
Not yet addressed, a gap to watch
ISA's cyber-related material is limited to general cyber-risk disclosure requirements for reporting companies (most recently updated around January 2025) and a 2022 audit of disclosure practices; neither references post-quantum cryptography, quantum computing risk, or cryptographic inventory.

FAQ: Israel and PQC

Does Israel have a post-quantum cryptography (PQC) law?: Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Bank of Israel, Banking Supervision Department.
What is Israel's PQC migration deadline?: 2026 — a date that has already passed. See the sources below for what it actually covered, and treat the current obligation as whatever followed it rather than the original target. The deadline came from Bank of Israel, Banking Supervision Department.
Does Israel require a Cryptographic Bill of Materials (CBOM)?: Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.