Roadmap for the transition of European public administrations to a post-quantum cryptography era

Outcomes and deliverables

• Roadmap for the transition of European public administration for PQC
• Workshops, white papers and other activities to support synergies between national security agencies and public administrations.
• Collaborations between public administrations regarding the transition to PQC.

Proposals should foresee a leading role for national security agencies in developing a roadmap for the transition of public administrations to post-quantum cryptography PQC. This should take into account an inventory of systems to be replaced, the timeframe, and technical and legal aspects of the migration to PQC in public administrations. It should be achieved in particular through the following strategic actions:

• Foster a collaborative process involving stakeholders from national security agencies and other public administrations to discuss priorities, technical challenges, legal obstacles and other issues relating to the transition to PQC.
• Promote awareness among public administrations of the need to make the transition to PQC.
• Identify crucial requirements and establish a coordinated roadmap for the transition of European public administrations to PQC.

Proposals should bring together national security agencies, relevant public administrations and related stakeholders including experts in the area of PQC. Activities should be foreseen to engage stakeholders to efficiently coordinate their efforts at national and European level in order to achieve impactful outcomes leading to the adoption of PQC in European public administrations.

The roadmap should identify what encryption systems need to be replaced, what algorithms should be adopted, priorities for defending against quantum attacks across the spectrum of public administrations, and legal and technical aspects of the transition to PQC. It should foster collaborations and exchange of best practice.

This action aims at the transition of public administration towards a new paradigm that is set to be a game changer in encryption, which directly involves national security as it relates to information that must be protected against possible dependencies and vulnerabilities in cybersecurity to pre-empt foreign influence and control. Participation of non-EU entities entails the risk of highly sensitive information about security infrastructure, risks and incidents being subject to legislation or pressure that obliges those non-EU entities to disclose this information to non-EU governments, with an unpredictable security risk. Therefore, based on the outlined security reasons, the actions relating to these technologies are subject to Article 12(5) of Regulation (EU) 2021/694.