Post-quantum cryptography in C5:2026: building a crypto inventory and migration plan

This page covers post-quantum cryptography as a focus topic of C5:2026. Cryptography policy, key management and rotation as a whole are covered on CRY domain.

What does post-quantum cryptography mean under C5:2026?

The catalogue counts post-quantum cryptography among its new focus topics (section 1.1). The aim is protection against adversaries in possession of a quantum computer. CRY-01.01AC requires a documented PQC strategy for this. CRY-01.02AC names four elements: an inventory of the cryptographic mechanisms in use with a priority level for each entry, staying informed about the state of the art, the use of hybrid cryptography models, and the definition of trigger events, resources, transition plans and success criteria. Under CRY-01.03AC, the strategy including the inventory and risk assessment is reviewed at least annually or in case of significant changes.

These three subcriteria are complementing, so they are not mandatory. They are audited if you include them in the audit scope. How that works is explained on C5 criteria catalogue. Three basic criteria already prepare the ground for every provider, though:

• Crypto-agility (CRY-01.01B no. 9): The cryptography policy has to consider that mechanisms can be replaced efficiently during their lifetime.
• Change management (CRY-01.01B no. 8 and CRY-02): Changes to cryptographic systems are evaluated for their effects, including on workloads that customers manage themselves, and customers are informed of these effects.
• Review (CRY-01.02B and CRY-03): The policy is checked against the BSI Technical Guideline TR-02102 or suitable NIST guidelines, and the mechanisms are reviewed against the state of the art at least annually and after incidents involving cryptographic components.

In practice you already need an inventory of mechanisms for these basic criteria: without knowing where which mechanism runs, you can demonstrate neither replaceability nor review. For the healthcare market, our classification is this: Section 393 SGB V refers to an attestation covering the basic criteria, or under certain conditions to evidence under the C5 Equivalence Ordinance (C5GleichwV) instead. The PQC strategy is not part of either (see Section 393 SGB V and C5 Equivalence Ordinance).

Why the topic is on the table now is explained in the catalogue’s supplementary information with the “store now, decrypt later” scenario: data that is transmitted or stored in encrypted form today could be captured and decrypted later. For the migration, it refers among others to the BSI guideline “Quantum-safe cryptography - fundamentals, current developments and recommendations”, an implementation roadmap of the European Commission and drafts of NIST SP 1800-38.

Starting point: a billing platform with long-lived data

Fictitious example, not a client. A provider runs a platform through which home care providers bill for their services. The service runs on the infrastructure of a large cloud provider (hyperscaler). Under the contracts with the customers, billing data stays stored for many years. Customers connect the platform to their practice software through an interface with client certificates, and documents are signed electronically.

This is the situation before the project:

• The cryptography policy names “state of the art” and TLS from version 1.2, but no mechanisms per purpose.
• The team knows from memory where encryption runs: at the load balancer, in the service mesh, in the database, in the backup and for the signatures. There is no inventory.
• The signature library is hard-coded; a different mechanism would mean rebuilding several services.
• The customers’ client certificates run for several years and come from the provider’s own certificate authority.

Management wants to include the PQC strategy in the audit scope because public sector customers ask for it. For that, the team first needs the inventory.

Who is responsible for what: provider, platform, customer?

The PQC strategy is the provider’s business. Many mechanisms run in platform services, though, and customers feel every change at their interfaces. Our classification for the example:

For CRY-01 and CRY-03 the catalogue lists no complementary customer criteria. You still presuppose that customers change over their clients. That belongs in the system description as a complementary customer control (CUEC).

Work product: crypto inventory with priorities

The inventory under CRY-01.02AC no. 1 needs a priority level for each entry, based on the impact and probability of quantum computing attacks and on the effort to remediate. The columns below are our suggestion. The rating is that of the fictional provider from its own risk assessment, not a general classification of mechanisms.

The inventory comes with a migration plan that answers the requirements of CRY-01.02AC no. 4 for each entry: what triggers the changeover (for example a recommendation in the current TR-02102-1 or an offering from the platform), what resources it needs, what the transition looks like (for example a hybrid mechanism for a transitional period) and how you recognise success. According to the supplementary information, hybrid models combine classical and quantum-safe mechanisms so that the system remains secure if one component is compromised. Which mechanisms count as quantum-safe you take from the guidelines named in the catalogue, in their current version. This page does not specify any mechanisms.

Example control description for CRY-01.03AC

An inventory is only as good as its maintenance. The following control keeps inventory and strategy up to date (own wording, not catalogue text):

The 30-day deadline is an example value, not a catalogue requirement. How a cryptographic change ticket with customer information works is covered on CRY domain.

What evidence the auditor wants to see

If the additional criteria are in scope, the auditor wants to see strategy, inventory and review. For the basic criteria, the cryptography policy with crypto-agility and the reviews under CRY-03. Examples from the scenario:

How to keep track of which evidence supports which subcriterion is shown on evidence and documentation.

Possible gaps: cause, effect, remedy

The following gaps follow from the wording of the criteria and the scenario. If a subcriterion in the audit scope is not met, the criterion counts as not met and the auditor reports the deviation (sections 3.4.12 and 3.4.13).

Whether you include the additional criteria in the first attestation or secure the basic criteria first is a question of prioritising measures.

Criteria related to PQC

Criterion titles as in the English catalogue version 1.0.1, subcriteria counted according to section 5 (B = basic, AS = additional (sharpening), AC = additional (complementing)). The column “What it is about” is our own short description, not catalogue text. The wording of the criteria in the catalogue is binding.

CRY-02 and CRY-03 are new in C5:2026 with no predecessor. The other 16 criteria of the domain are listed on CRY domain.

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3).