NIS2 and post-quantum readiness

Start with scope and national implementation

The NIS2 Directive addresses cybersecurity risk management for covered entities. Article 21 includes supply-chain security and policies and procedures concerning cryptography and, where appropriate, encryption. Applicable duties depend on national implementation and the entity’s circumstances.

The directive is not a universal requirement to replace every cryptographic system with a named PQC algorithm by one date. Avoid presenting a migration roadmap or maturity score as automatic legal compliance.

Make cryptographic policy operational

A policy becomes useful when the organisation knows which services use cryptography, who maintains it and how supplier changes are governed. Discovery can expose dependencies that general asset registers miss.

Bring procurement and engineering together

Ask suppliers for supported algorithms, product lifecycles, update mechanisms and the evidence behind transition statements. Agree how new purchases will be reviewed for cryptographic changeability.

For existing equipment, record constraints and possible replacement routes. An unsupported industrial device may need a different transition decision from an updatable cloud service.

Retain evidence of decisions

Use the readiness assessment to organise gaps, owners and next actions. Review risk treatment through your normal management process and obtain jurisdiction-specific advice on NIS2 obligations. The purpose is a defensible transition programme, not a new compliance badge.

Continue exploring

• PQCEMM: enterprise post-quantum maturity
• DORA and post-quantum risk
• Crypto-agility: planning for cryptographic change

Primary sources

• NIS2 Directive