DORA and post-quantum risk

Place quantum risk within ICT risk management

The EU Digital Operational Resilience Act (DORA) establishes requirements for in-scope financial entities, including ICT risk management and oversight of ICT third-party risk. Its applicability and detailed obligations depend on the entity and relevant rules.

DORA is not a standalone mandate to deploy a particular NIST PQC algorithm by 2035. The NCSC timetable is separate guidance. A PQC readiness score does not establish DORA compliance.

A practical evidence connection

As a planning approach, connect cryptographic dependencies to critical or important services, document ownership and retain the basis for risk-treatment decisions. Supplier dependence and continuity requirements can shape the order in which changes are feasible.

Questions for the programme

Which critical services rely on quantum-vulnerable public-key mechanisms? Which suppliers control the transition? What evidence supports their roadmaps? What tests and change approvals would be needed before deployment?

Keep the answers in the existing governance process so the PQC work informs risk and procurement decisions. Treat an unverified supplier assertion as a question to resolve, not as completed assurance.

Use the mapping carefully

PQCEMM can structure a readiness discussion and identify evidence gaps. Your legal and compliance functions should determine applicability and whether particular evidence satisfies an obligation. This guide explains a planning connection, not an attestation of conformity.

Continue exploring

• PQCEMM: enterprise post-quantum maturity
• NIS2 and post-quantum readiness
• Post-quantum readiness assessment

Primary sources

• DORA regulation