Cyber Resilience Briefing — May 12, 2025
Zeph Tech outlines a 2025 quantum-ready encryption playbook, balancing immediate certificate rotation with supplier attestation workflows anchored to NIST CSF 2.0 PR.AA and ISO/IEC 27001 A.10.
Executive briefing: Post-quantum cryptography planning is shifting from research to execution as agencies and enterprises publish migration roadmaps. Zeph Tech recommends staging certificate rotations by business criticality while enforcing supplier attestations that prove crypto agility across the ecosystem.
Key industry signals
- NIST algorithm selections. NIST announced CRYSTALS-Kyber and CRYSTALS-Dilithium as primary post-quantum algorithms, giving organisations concrete targets for pilot deployments.
- Federal migration deadlines. The U.S. Office of Management and Budget’s M-22-09 memorandum requires civilian agencies to inventory cryptographic systems and deliver migration plans, signalling expectations for private-sector partners.
- Ongoing standardisation updates. NIST’s Post-Quantum Cryptography project publishes migration guidance and timelines, including draft FIPS publications for chosen algorithms.
Control alignment
- NIST CSF 2.0 PR.AA. Extend asset catalogues with cryptographic metadata—key lengths, algorithm families, owners—to prioritise migration waves.
- ISO/IEC 27001 A.10. Update cryptographic policies with acceptance criteria for lattice-based algorithms, downgrade plans, and supplier attestation requirements.
Detection and response priorities
- Alert when certificates near expiration lack assigned post-quantum transition owners or when legacy RSA/ECC ciphers resurface after upgrades.
- Monitor third-party APIs advertising quantum-safe readiness for mismatched cipher suites or unsupported key exchange modes.
Enablement moves
- Publish a migration heatmap summarising which services will complete post-quantum pilots each quarter and the dependencies that govern cutover.
- Partner with procurement to add crypto agility clauses—covering algorithm support and incident notifications—to all new SaaS and infrastructure supply agreements.
Sources
- NIST announces first post-quantum cryptographic algorithms
- OMB Memorandum M-22-09: Migrating to Post-Quantum Cryptography
- NIST Post-Quantum Cryptography project
Zeph Tech orchestrates certificate discovery, rotation runbooks, and third-party attestations so your teams stay focused on business delivery.