NIST has already finalized its first post-quantum cryptography standards and is encouraging organizations to begin transitioning rather than waiting for a cryptographically relevant quantum computer to arrive.
For banks and credit unions, the first challenge is not selecting a new encryption algorithm.
It is answering a much more basic question:
Where is public-key cryptography actually being used across the institution?
Consider the scope.
- TLS certificates
- VPNs
- Digital signatures
- Email security
- Authentication systems
- APIs
- Mobile banking
- ATMs and other endpoint devices
- Cloud platforms
- Backup systems
- Network appliances
- Core and digital-banking integrations
- Third-party connections
Some of those cryptographic dependencies are visible to Information Security. Many are buried inside applications, hardware, vendor platforms, and contractual relationships. That creates a governance issue.
An institution cannot develop a credible post-quantum migration strategy if it does not know which systems depend on RSA, elliptic-curve cryptography, or other algorithms that will eventually need to be replaced. And replacement will not occur on a single “quantum readiness” date.
Some systems can be updated through software. Others may require certificates to be reissued, integrations redesigned, hardware replaced, or vendors to deliver new capabilities. Long-lived infrastructure can make that transition particularly important to identify early. There is also the harvest-now, decrypt-later concern: information encrypted today may remain sensitive long enough for an adversary to retain it and attempt decryption when more capable quantum computing becomes available.
For financial institutions, this suggests a practical starting point: Add cryptographic dependencies to asset and third-party inventories now.
For critical systems, identify what cryptography is used, where keys and certificates are managed, how long protected information must remain confidential, whether the technology supports cryptographic agility, and what the vendor's post-quantum migration roadmap looks like.
A worthwhile question for the next Information Security Committee meeting:
If we were asked today which critical systems cannot migrate away from their current public-key cryptography without replacement or vendor intervention, could we answer?
If not, quantum readiness may need to begin with discovery—not procurement.
NIST — Post-Quantum Cryptography Standards
#Banking #CreditUnions #Cybersecurity #PostQuantumCryptography #CyberGovernance #RiskManagement
Back to Articles & Insights