BSI Releases National Guidelines for Post-Quantum Cryptography Migration by 2026

The German Federal Office for Information Security (BSI) has published a national guideline outlining a risk-based transition to post-quantum cryptography. Organizations are advised to complete initial inventory and planning by the end of 2026, with high-risk applications migrated by 2030 and medium-risk systems by 2035. The guidance addresses the threat of future quantum computers breaking RSA and elliptic curve cryptography through store-now-decrypt-later attacks. Bitkom welcomes the framework but calls for clearer responsibilities and timelines for both government and industry. The document recommends hybrid cryptographic schemes and crypto-agility to enable smooth future updates. A Bitkom study shows that 43 percent of larger German companies already view quantum computing as a major IT security risk.

Security-InsiderNovember 5, 2026Translated from German

Read at source

The German Federal Office for Information Security (BSI) has published a national guideline that sets clear milestones for the migration to post-quantum cryptography. The document, titled “Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie,” was developed jointly by the Federal Ministry for Digital Affairs, the Federal Ministry of the Interior and the BSI.

According to the guideline, organizations should finish their initial preparation and planning phase by the end of 2026. This includes creating a first inventory of all cryptographic systems in use and beginning early migration steps. High-risk applications must be switched to quantum-resistant algorithms by the end of 2030 at the latest, while medium-risk applications should be migrated by 2035.

Risk-based prioritization and data protection duration

The BSI recommends a risk-based approach that takes into account how long data must remain confidential. The “store now, decrypt later” threat is highlighted as a key concern: adversaries may already be collecting encrypted data today with the intention of decrypting it once sufficiently powerful quantum computers become available.

Hybrid cryptographic schemes that combine classical and post-quantum algorithms are advised during the transition period. Systems should also be designed with crypto-agility in mind so that algorithms can be replaced quickly when new requirements arise.

Bitkom calls for concrete responsibilities

The digital association Bitkom welcomed the publication but urged authorities to define clear responsibilities, priorities and timelines for both the public and private sectors. Bitkom President Ralf Wintergerst stated that the migration will take years and must begin immediately.

A recent Bitkom study found that 43 percent of German companies with more than 100 employees consider quantum computing a significant risk to their IT security. Within the group that has already examined the topic, only 29 percent have implemented or planned a switch to quantum-safe encryption.

RSA BSI Bitkom Ralf Wintergerst EU Roadmap

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Policy & Regulation

Dutch Parliament Questions Minister Hermans on Cyber Attack Attempt at French Blood Bank

Members of the Dutch Tweede Kamer have submitted formal questions to Minister Hermans of Public Health following a reported cyber attack attempt on cooling systems at the French blood bank. Attackers tried to raise temperatures on three cooling installations, but the intrusion was detected before any damage occurred. CDA MPs Zwinkels and Poortman are seeking clarification on obligations under the Cyberbeveiligingswet for blood banks and other critical healthcare facilities. The questions also address coordination of emergency plans and physical fallback options when digitally controlled equipment is targeted. Additional queries focus on whether such cooling systems fall under the Cyber Resilience Act, applicable cybersecurity requirements, and manufacturer responsibilities for vulnerability remediation. The minister has three weeks to provide answers on legal liability distribution among manufacturers, suppliers, and users, as well as any available information on the attackers.

Security.NLNov 5, 2026Translated from NL

Policy & Regulation

Microsoft Enables Automatic Windows 11 Settings Backup on Entra Devices by Default

Microsoft is changing the default behavior of Windows Settings backup on managed business devices joined to Microsoft Entra ID. Starting with the next feature update of Windows 11, the backup of user settings, personalization preferences, and Microsoft Store apps will activate automatically on Entra-joined or hybrid-joined devices. Administrators retain control only through explicitly configured Group Policy or Intune settings, while devices in the European Union remain exempt under the Digital Markets Act. The backup runs silently every eight days and stores data in the organization's tenant, but does not include personal files or classic desktop applications. Recovery remains disabled by default and requires a separate policy. Organizations outside the EU must review the change against their data protection requirements before the update deploys.

Security-InsiderNov 5, 2026Translated from German

Policy & Regulation

US Politicians and DuckDuckGo Criticize Google's AI Requirements for Schools

American politicians and the privacy-focused search engine DuckDuckGo have strongly criticized Google over its policy linking school access to Google Search with mandatory adoption of AI tools. Google initially stated that schools using its educational software would lose access to Google Search unless they agreed to integrate AI features such as Gemini. Vice President of Education Chris Phillips explained that Google Search and the company's AI tools are deeply integrated, meaning opting out of AI would remove search functionality for students. Senator Bernie Sanders described the move as extortion and called for a temporary pause on AI rollout, while Senator Richard Blumenthal accused Google of prioritizing profits over student success. DuckDuckGo founder Gabriel Weinberg and communications head Kamyl Bazbaz publicly condemned the approach as monopolistic behavior and offered guidance for schools to adopt DuckDuckGo as a default search engine with optional AI use. Following the backlash, Google clarified that schools could continue using the search engine even if AI tools are disabled.

Security.NLNov 5, 2026Translated from NL