NIS2 - Cybersecurity Risk-Management Cryptography (Post-Quantum)

Description

PQC-scoped view of the EU NIS2 Directive (Directive (EU) 2022/2555). Article 21(2)(h) requires policies and procedures on the use of cryptography and encryption — implying a cryptographic inventory. NIS2 sets no post-quantum deadline, so quantum-vulnerable cryptography is surfaced as advisory migration debt.

Rationale

NIS2 makes cryptography and encryption policies a risk-management requirement for essential and important entities, without naming a PQC timeline. Modelling the inventory obligation as hard and the post-quantum exposure as advisory stays faithful to the directive.

Benefits

Entities in NIS2 scope get an inventory-backed view of post-quantum exposure aligned with their cryptography-policy obligations without overstating a deadline the directive does not set.

Checkpoints

NIS2 — Cryptographic Inventory Maintained

ID

nis2_pqc/crypto_inventory_established

Severity

high

Category

cryptography/post_quantum

Optional

false

Tags

crypto, inventory, nis2, pqc

Description

Checks that a cryptographic inventory (a CBOM) is maintained for the project, supporting the NIS2 Article 21(2)(h) cryptography and encryption policy obligation.

Rationale

NIS2 requires policies on the use of cryptography and encryption; a cryptographic inventory is the prerequisite for such a policy and for any post-quantum planning.

Verification

Xygeni passes the checkpoint when a non-empty cryptographic inventory is available — ingested from a CBOM supplied with --cbom or produced on demand by the crypto-asset detector — and fails when none was produced.

Remediation

Generate and maintain a cryptographic bill of materials for the project as part of the NIS2 cryptography and encryption policy.

NIS2 — Quantum-Vulnerable Cryptography (Advisory)

ID

nis2_pqc/no_quantum_vulnerable_crypto

Severity

info

Category

cryptography/post_quantum

Optional

true

Tags

crypto, nis2, pqc, quantum

Description

Surfaces quantum-vulnerable (Shor-broken) public-key cryptography in the project’s inventory as advisory migration debt. NIS2 sets no post-quantum deadline, so this control never fails — it reports a partial result while such algorithms are present.

Rationale

NIS2 requires cryptography and encryption policies but states no PQC timeline. Reporting the exposure without a fabricated deadline keeps the assessment honest while flagging the migration as part of cybersecurity risk management.

Verification

Xygeni assembles the cryptographic inventory (from a CBOM supplied with --cbom or the crypto-asset detector), classifies quantum risk, and reports a partial result when Shor-broken algorithms are present; it passes when none are.

Remediation

Include post-quantum migration in NIS2 cryptography policy: plan replacement of quantum-vulnerable public-key algorithms with NIST post-quantum schemes (ML-KEM, ML-DSA, SLH-DSA), prioritising long-lived confidential data.