DORA - ICT Risk Management Cryptography (Post-Quantum)

Description

PQC-scoped view of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). DORA’s ICT risk-management framework requires cryptographic controls and a key-management/encryption policy — implying a cryptographic inventory. DORA sets no post-quantum deadline, so quantum-vulnerable cryptography is surfaced as advisory migration debt.

Rationale

DORA (Art. 9 and its technical standards) requires financial entities to protect ICT systems with cryptographic controls and a maintained encryption/key-management policy, but does not state a PQC date. Modelling the inventory obligation as hard and the post-quantum exposure as advisory stays faithful to the regulation.

Benefits

Financial-sector teams get an inventory-backed view of post-quantum exposure aligned with DORA’s ICT risk-management expectations without overstating a deadline DORA does not set.

Checkpoints

DORA — Cryptographic Inventory Maintained

ID

dora_pqc/crypto_inventory_established

Severity

high

Category

cryptography/post_quantum

Optional

false

Tags

crypto, dora, inventory, pqc

Description

Checks that a cryptographic inventory (a CBOM) is maintained for the project, supporting DORA’s ICT risk-management cryptographic controls and encryption/key-management policy.

Rationale

DORA requires a maintained encryption and key-management policy as part of ICT risk management; a cryptographic inventory is the prerequisite for that policy and for any post-quantum planning.

Verification

Xygeni passes the checkpoint when a non-empty cryptographic inventory is available — ingested from a CBOM supplied with --cbom or produced on demand by the crypto-asset detector — and fails when none was produced.

Remediation

Generate and maintain a cryptographic bill of materials for the project as part of the DORA ICT risk-management framework.

DORA — Quantum-Vulnerable Cryptography (Advisory)

ID

dora_pqc/no_quantum_vulnerable_crypto

Severity

info

Category

cryptography/post_quantum

Optional

true

Tags

crypto, dora, pqc, quantum

Description

Surfaces quantum-vulnerable (Shor-broken) public-key cryptography in the project’s inventory as advisory migration debt. DORA sets no post-quantum deadline, so this control never fails — it reports a partial result while such algorithms are present.

Rationale

DORA requires cryptographic controls and operational resilience but states no PQC timeline. Reporting the exposure without a fabricated deadline keeps the assessment honest while flagging the migration as part of ICT risk management.

Verification

Xygeni assembles the cryptographic inventory (from a CBOM supplied with --cbom or the crypto-asset detector), classifies quantum risk, and reports a partial result when Shor-broken algorithms are present; it passes when none are.

Remediation

Treat post-quantum migration as part of DORA ICT risk management: plan replacement of quantum-vulnerable public-key algorithms with NIST post-quantum schemes (ML-KEM, ML-DSA, SLH-DSA), prioritising long-lived confidential data.