Question

To ask the Secretary of State for Digital, Culture, Media and Sport, whether the Cyber Security and Resilience Bill confers power to require regulated entities to migrate to post-quantum cryptography by a specified date.

The Cyber Security and Resilience (Network and Information Systems) Bill strengthens the UK’s existing cyber resilience framework for essential services and equips the Secretary of State with powers to update that framework as needed in the future. These powers will enable the Government to set clear expectations on how regulated entities should manage the risks which new technologies pose to their systems, including (but not limited to) the risks posed by quantum computing.

In addition, the Bill makes provision for a Statement of Strategic Priorities that will set overarching objectives for the regulators. We intend, subject to public consultation, for these objectives to be framed to ensure that regulators fully engaging with the latest technological development and reflecting this in their guidance to regulated entities

DCMS engages closely with the NCSC and regulators on the topic of Post-Quantum Cryptography. DCMS is working to produce a series of guidance documents to support organisations in managing their transition to Post-Quantum Cryptography in line with guidance and deadlines set by the NCSC. The first of these guidance documents is due to be published later this year.