Insights that help security teams make better decisions.

Switzerland has no single PQC statute. NCSC's technology briefs say start now; FINMA Guidance 05/2026 expects a board-backed roadmap by mid-2027, with inventory, crypto-agility and harvest-now-decrypt-later prioritisation.

What Commission Implementing Regulation (EU) 2024/2690 actually requires for cryptography and crypto-agility under NIS2, who it applies to, and what it leaves to member states.

BSI TR-02102-1 version 2026-01 names migration dates: classical-only key agreement ends 2031, high-protection systems by 2030, signatures by 2035. Here is who is in scope under BSIG and what to do first.

What DORA Articles 9-13 and the RTS on ICT risk management actually require for encryption, key management and crypto-agility, with a concrete technical checklist.

What DORA expects for encryption and key control: ICT risk, third-party concentration and evidence boards can defend, without surrendering keys to the cloud.

Build a funded post-quantum migration roadmap: inventory crypto, rank business impact and sequence algorithm change without freezing delivery.

Plan a Vault-to-OpenBao migration after HashiCorp BSL: keep the API, cut licensing cost and protect unseal keys with customer-held MPC.

Why Microsoft 365 default encryption still leaves Microsoft able to unlock content and when Double Key Encryption or Customer Key becomes a board-level control.

Data sovereignty in enterprise SaaS: how customer-managed keys for Microsoft 365 and AWS change who can be compelled to unlock your data.