BSI

BSI Releases National Guidelines for Post-Quantum Cryptography Migration by 2026

The German Federal Office for Information Security (BSI) has published a national guideline outlining a risk-based transition to post-quantum cryptography. Organizations are advised to complete initial inventory and planning by the end of 2026, with high-risk applications migrated by 2030 and medium-risk systems by 2035. The guidance addresses the threat of future quantum computers breaking RSA and elliptic curve cryptography through store-now-decrypt-later attacks. Bitkom welcomes the framework but calls for clearer responsibilities and timelines for both government and industry. The document recommends hybrid cryptographic schemes and crypto-agility to enable smooth future updates. A Bitkom study shows that 43 percent of larger German companies already view quantum computing as a major IT security risk.