NIS2 and DORA, What They Ask of Your Cryptography and Where Post-Quantum Comes In

Neither NIS2 nor DORA names an algorithm. Both still lead to post-quantum cryptography, because both ask for a cryptography that follows the state of the art, is reviewed on a schedule, and can be changed when the state of the art moves.

Here is what each text asks, in its own words, and what that means for the policy you write this year.

What NIS2 asks

Article 21 of the NIS2 directive lists the measures every essential or important entity must take, "taking into account the state-of-the-art". Point (h) covers "policies and procedures regarding the use of cryptography and, where appropriate, encryption".

For digital service providers, such as cloud and data centre operators, managed service providers and DNS providers, Implementing Regulation (EU) 2024/2690 details that policy in section 9 of its annex.

• The strength of the measures. The type, strength and quality of the cryptography protecting each asset, at rest and in transit, according to its classification.
• The algorithms. The protocols, algorithms and cipher strengths adopted, and where appropriate "a cryptographic agility approach".
• The keys. An approach to key management, from generating and storing keys to dealing with compromised ones and setting their activation and deactivation dates.
• The reviews. A policy reviewed at planned intervals, "taking into account the state of the art in cryptography".

The directive asks Member States to allow fines of at least €10 million or 2% of worldwide annual turnover, whichever is higher, for an essential entity, and at least €7 million or 1.4% for an important one.

In France, the transposition law is still pending. The Senate adopted it in March 2025, and the Assemblée nationale has not voted on it yet, after withdrawing it from its agenda in early October 2026. ANSSI already offers voluntary pre-registration on MonEspaceNIS2. The measures of article 21 come from the directive itself, so the French law will set when they become enforceable, and the preparation can start now.

What DORA asks

DORA has applied since 17 January 2025 to banks, insurers, investment firms and most of the financial sector. Its technical standard on ICT risk management, Delegated Regulation (EU) 2024/1774, gives two articles to cryptography.

• A policy on encryption and cryptographic controls. Built on leading practices and standards (article 6).
• The duty to change. The policy must include "provisions for updating or changing, where necessary, the cryptographic technology on the basis of developments in cryptanalysis" (article 6(4)).
• The whole key lifecycle. Generating, renewing, storing, backing up, archiving, retrieving, transmitting, retiring, revoking and destroying keys (article 7), with a register of certificates renewed before they expire.

Recital 9 of the same text gives the reason. Financial entities should follow a flexible approach "to deal with the dynamic landscape of cryptographic threats, including threats from quantum advancements".

The supervisors read it the same way. In September 2026, the joint committee of the three European supervisory authorities wrote that DORA requires financial entities to adopt state-of-the-art cryptography against new threats, and warned about "harvest now, decrypt later". In July 2026, ECB Banking Supervision told banks that the adoption of post-quantum cryptography "must start now".

Where post-quantum comes in

Put the pieces side by side. Both texts ask for cryptography in line with the state of the art, reviewed regularly, and able to change when cryptanalysis moves. Since August 2024, the state of the art includes NIST's post-quantum standards. The European roadmap of June 2025 asks Member States to start the transition by the end of 2026 and to move high-risk uses by the end of 2030 at the latest.

A cryptographic policy written today without a post-quantum section will be hard to defend at the next review. The assessor will ask the question the texts already contain. What happens to the data you encrypt today the day its algorithm falls?

What to put in the policy this year

• The inventory. Which data is encrypted or signed, with which algorithm, and how long it must stay protected. The European roadmap asks for it first.
• The target. Hybrid post-quantum algorithms for data that must stay confidential beyond 2030, as ANSSI recommends.
• The agility. How an algorithm is replaced without losing access to what was already encrypted. The NIS2 regulation names it, and the DORA standard requires it.
• The keys. A rotation that keeps old messages readable, backups, and a register.
• The dates. The end-2026 and end-2030 milestones of the European roadmap, applied to your own systems.

Neither text names an algorithm. Both ask you to change yours when the state of the art moves, and it has moved.

What Feranor PQC Suite brings

Feranor PQC Suite covers the data part of that policy. It encrypts and signs files and messages in hybrid post-quantum cryptography, ML-KEM with ECDH and SLH-DSA co-signed with ECDSA, under an ANSSI profile applied to everything it reads and writes. Its messages are standard CMS, and each one names its algorithms, so a new algorithm can be added next to the existing ones. Its key store rotates keys while keeping the old ones, and backs them up in a single file.

It will not make you compliant on its own, and no product can. It gives the cryptography section of your policy something concrete to point to.