EU Coordinated Roadmap for the Transition to Post-Quantum Cryptography
Description
Maps a project’s cryptographic inventory to the EU coordinated post-quantum transition roadmap: governance and inventory from 2026, high-risk use cases migrated by 2030, all systems by 2035, with hybrid classical+PQC constructions encouraged during the transition.
Rationale
The EU coordinated roadmap sets a common transition timeline across member states. Expressing a project’s Shor-broken inventory against the 2030/2035 milestones produces audit evidence aligned with the EU’s hybrid-friendly posture.
Benefits
Organisations operating in the EU get migration evidence aligned to the coordinated roadmap milestones, supporting planning and supervisory reporting.
EU PQC Roadmap — Cryptographic Inventory Established
ID |
eu_pqc_roadmap/crypto_inventory_established |
Severity |
high |
Category |
cryptography/post_quantum |
Optional |
false |
Tags |
crypto, eu-pqc, inventory, pqc |
Description
Checks that a cryptographic inventory (a CBOM) has been established for the project, the EU roadmap’s 2026 governance-and-inventory milestone.
Rationale
The EU roadmap’s first milestone is governance and a cryptographic inventory by 2026; subsequent migration of high-risk (2030) and all (2035) systems depends on it.
EU PQC Roadmap — No Quantum-Vulnerable Cryptography
ID |
eu_pqc_roadmap/no_quantum_vulnerable_crypto |
Severity |
high |
Category |
cryptography/post_quantum |
Optional |
false |
Tags |
crypto, eu-pqc, pqc, quantum |
Description
Checks the project’s cryptographic inventory for quantum-vulnerable (Shor-broken) public-key cryptography and evaluates it against the EU PQC roadmap milestones: high-risk use cases migrated by 2030, all systems by 2035.
Rationale
The EU coordinated roadmap expects classical public-key cryptography to be progressively retired, with hybrid constructions encouraged in the interim. Surfacing the inventory against these milestones aligns findings with EU supervisory expectations.