Tessera PQC
PX-04
The deadlines
Every finding mapped to the date that applies.
Tessera PQC ships a profile for each of these and scores every control from live evidence. Several are guidance rather than binding rules; we say which, and re-check every date against its source before each release.
01
02
What the regulators ask, and when
Source | What it asks | Status |
|---|---|---|
DST Quantum-Safe Roadmap (India) | Critical sectors including BFSI: inventory by Dec 2027, high-priority systems by Dec 2028, full PQC by Dec 2029. Vendor CBOMs from FY 2027-28 | Guidance; sector regulators enforce |
RBI | Q-SAFE expert committee formed May 2026; payment providers urged to start | No binding deadline yet |
SEBI | Quantum-resilient framework targeted for 2028-29 | Planned |
CERT-In | BOM guidelines v2.0 include a cryptographic BOM | Directions and guidelines |
NIST IR 8547 (US) | RSA and ECC deprecated after 2030, disallowed after 2035 | Federal standard; global reference |
EU coordinated roadmap | Start by 2026, high-risk systems by 2030 | Recommendation |
UK NCSC | Discovery by 2028, priority migration by 2031, complete by 2035 | Guidance |
PCI DSS 4.0.1 · 12.3.3 | A reviewed inventory of cipher suites and protocols in use | Mandatory for card data |
DORA (EU) | Encryption policy and cryptographic key lifecycle evidence | Binding regulation |
← Swipe for the rest of the table →
← Drag for the rest of the table →
Also built in: CNSA 2.0, MAS, the G7 Cyber Expert Group, FS-ISAC and OMB M-23-02. Dates as of 3 November 2026.
02
02
Evidence an auditor will accept
01
Scored from evidence
Each control is evaluated from live findings in the engagement. Controls that need a document stay not assessed until a lead attests.
02
One CBOM
A CycloneDX 1.6 cryptographic bill of materials, as CERT-In and the DST roadmap ask for, on demand.
03
PCI 12.3.3 export
The cipher and protocol inventory with the annual review fields the requirement asks for.
04
Signed evidence pack
The report, CBOM, findings, tasks, test results, compliance status and audit trail in one archive, signed with Ed25519 and ML-DSA-65 — so it stays verifiable after a quantum computer could forge classical signatures.
05
Vendor CBOMs
Import and verify signed CBOMs from your vendors, and produce your own for the products you sell.
06
A trail that cannot be edited
Every action is in a hash-chained, append-only audit trail with signed checkpoints.