Skip to main content
NSA CNSA 2.0: JAN 2027US OMB M-23-02: ANNUAL CBOM
Q-Day Audits
FOLIO SECTION 02 · STATUTORY MANDATE LEDGER5 JURISDICTIONS MAPPED · CNSA 2.0 / M-23-02 / DORA / ISM

Global Post-Quantum Cryptography Mandate Matrix & Auditor Workpapers

Compare statutory deadlines, mandatory parameter sets, and required audit evidence across NSA CNSA 2.0, US White House NSM-10 and OMB M-23-02, NIST IR 8547, EU DORA Article 9, and the Australian ASD Information Security Manual.

Inspect CycloneDX v1.6 SchemaGenerate Mandate-Aligned RFP
Symmetrical architectural facade lines representing structured enterprise compliance audits
PLATE II · CROSS-JURISDICTION REGULATORY HORIZON MATRIX2025 DORA → 2027 CNSA 2.0 → 2030 NIST / ASD

Cross-Jurisdiction Regulatory Comparison Ledger

Use this reference matrix during audit committee scoping to align your internal CycloneDX inventory fields with the exact statutory horizon governing each operating subsidiary.

Mandate / StandardRegulated ScopeEnforcement HorizonTechnical RequirementPrimary Auditor Check
NSA CNSA 2.0US National Security Systems & Defense Suppliers1 Jan 2027 (New NSS) / 2030-2033 Full ExclusivityML-KEM-1024 (FIPS 203), ML-DSA-87 (FIPS 204), LMS / XMSS (SP 800-208), AES-256, SHA-384/512Verify firmware/software signing uses LMS or XMSS now, and confirm 2027 acquisition contracts require CNSA 2.0 parameter sets.
US NSM-10 & OMB M-23-02US Federal Civilian Agencies (FCEB) & ContractorsAnnual Inventory Cycle through 2035 MigrationAutomated cryptographic inventory prioritizing High-Value Assets (HVAs) vulnerable to CRQCsInspect machine-readable CBOM submissions, HVA boundary definitions, and annual cost-estimation schedules.
NIST IR 8547 & FIPS 203-205Global Baseline / FIPS 140-3 Validated Modules2030 Classical Deprecation / 2035 DisallowanceDeprecates RSA-2048/3072, ECDSA, and ECDH (112-bit strength) by 2030; disallows classical public-key by 2035Audit all certificates, offline root CAs, and long-retention archives whose lifetimes cross the 2030 deprecation gate.
EU DORA (Reg. 2022/2554 Art. 9)EU Financial Entities & Critical ICT Third-Party ProvidersEnforced from 17 Jan 2025 + Ongoing Threat ReviewDocumented cryptographic policy, cryptographic key lifecycle register, and crypto-agility per RTS Art. 6-7Verify board-approved cryptographic policy, key-rotation logs, and ICT third-party exit/agility clauses aligned with ENISA PQC guidance.
Australian ASD ISM (Cryptographic Controls)Australian Government & Critical Infrastructure2030 Classical Asymmetric Retirement TargetASD-approved cryptographic algorithms and protocols; transition from RSA, DH, ECDH, and ECDSA by 2030Review ISM cryptographic equipment register, supplier PQC roadmaps, and prohibition of unvetted custom post-quantum primitives.

Regime-by-Regime Audit Workpaper Requirements

1. NSA CNSA 2.0: 1 January 2027 Acquisition Gate & Parameter Specificity

Unlike commercial guidance that permits Security Category 3 (ML-KEM-768 and ML-DSA-65), the US National Security Agency Commercial National Security Algorithm Suite 2.0 standardizes exclusively on Category 5 parameter sets (ML-KEM-1024 and ML-DSA-87) alongside SHA-384 or SHA-512 and AES-256.

  • Procurement gate check: any NSS-adjacent hardware or software tendered on or after 1 January 2027 must document CNSA 2.0 support.
  • Software and firmware signing check: verify stateful hash-based signature state management (LMS / HSS or XMSS / XMSS^MT) inside FIPS 140-3 Level 3+ HSMs so one-time keys can never be reused across cluster failovers.
  • Legacy phase-out ledger: identify networking appliances incapable of firmware upgrades before the 2030 non-compliant equipment cutoff.

2. US White House NSM-10 & OMB M-23-02: Annual Inventory Cadence

National Security Memorandum 10 and OMB Memorandum M-23-02 establish recurring reporting obligations for federal civilian agencies and flow down into federal systems integrators and FedRAMP cloud operators.

  • Prioritized High-Value Asset (HVA) register mapping asymmetric key exchange, digital signatures, and key establishment protocols.
  • Separation of active production listeners from dormant library dependencies using CycloneDX v1.6 reachability annotations.
  • Multi-year engineering cost model distinguishing configuration-only TLS upgrades from capital HSM replacements.

3. NIST IR 8547: The 2030 Deprecation & 2035 Disallowance Cliff

NIST IR 8547 translates FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) into concrete lifecycle cutoffs. Classical 112-bit asymmetric primitives (RSA-2048, P-256 ECDSA/ECDH) move to deprecated status in 2030 and full disallowance in 2035.

  • Certificate validity horizon scan: flag every internal CA root, intermediate CA, IoT device leaf, or SAML signing certificate with notValidAfter >= 2030-01-01.
  • Hybrid transition verification: confirm whether regulated workloads require FIPS-validated hybrid constructions (SP 800-56Cr2 / SP 800-227) during migration.
  • Data retention overlay: flag encrypted backups or regulated records whose statutory retention extends past 2030.

4. EU DORA Article 9 & Regulatory Technical Standards (RTS)

Under Regulation (EU) 2022/2554 (DORA) and Commission Delegated Regulation (EU) 2024/1774 on ICT risk management, European banks, insurers, and investment firms must maintain an auditable cryptographic policy and key-management register responsive to emerging cryptanalytic threats.

  • Cryptographic policy review: verify annual updates explicitly addressing quantum cryptanalysis and cryptographic agility.
  • Key lifecycle register: verify generation, custodial storage, backup, rotation, and destruction logs for asymmetric keys.
  • Critical ICT third-party register: inspect contractual audit rights and post-quantum transition schedules for cloud and core-banking suppliers.

5. Australian Signals Directorate (ASD) Information Security Manual (ISM)

The Australian Cyber Security Centre (ACSC) within ASD updates the Information Security Manual quarterly, setting 2030 as the target retirement horizon for traditional asymmetric cryptography across Australian government and Systems of National Significance.

  • Cryptographic inventory aligned with ASD Essential Eight and ISM Guidelines for Cryptography.
  • Verification that post-quantum pilots rely strictly on standardized NIST/IETF algorithms rather than proprietary cipher suites.
  • Procurement assurance confirming network encryptors and cloud gateways support hybrid TLS 1.3 and IKEv2.

Reviewed by Evelyn Mercer, Principal Cryptographic Governance & GRC Editor

Reviews OWASP CycloneDX CBOM schemas, federal post-quantum procurement mandates, and PKI governance frameworks.

Last reviewed:

All regulatory mandate timelines, CycloneDX v1.6 schema references, audit scoping weights, and RFP clauses are reviewed every 3 months, or sooner whenever NIST, NSA, OMB, ENISA, or the Australian Signals Directorate issues updated guidance.

AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.

Verified Primary Sources

Track Regulatory PQC Deadline Revisions

Enterprise CBOM & PQC Audit Governance

Save your email for quarterly updates whenever NIST, NSA, EU financial supervisors, or ASD amend post-quantum deprecation dates.

Protected by Cloudflare Turnstile · Isolated per-site D1 (qdayaudits-leads).