NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)
Validation and HSMs

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) PQC-7: FIPS Validated Modules, HSM Readiness, and Algorithm Validation

Deploy FIPS 140-3 validated cryptographic modules (NIST CMVP) supporting ML-KEM + ML-DSA + SLH-DSA. Test against NIST CAVP (Cryptographic Algorithm Validation Program) test vectors. Verify HSM readiness for PQC including Thales Luna 7 PQC + Entrust nShield PQC + Utimaco SecurityServer + AWS CloudHSM PQC + Microsoft Azure Managed HSM PQC. Test protocol integration with TLS 1.3 (RFC 8446 + draft-ietf-tls-hybrid-design) + SSH (draft-josefsson-ntru-ssh) + IKE/IPsec + S/MIME + PKI. Address performance and bandwidth impact (ML-KEM-768 public key 1184 bytes + ML-DSA-65 signature 3293 bytes + SLH-DSA signatures 7-49 KB).

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 88 controls across 54 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP Rev 5 · 3 controls

  • FEDRAMP-SC-13 Cryptographic Protection
  • FEDRAMP-SC-28 Protection of Information at Rest
  • FEDRAMP-SC-8 Transmission Confidentiality and Integrity

ISO/IEC 23837:2023 · 3 controls

  • 23837-1.2 Normative references
  • 23837-1.5.2 Cryptographic module requirements
  • 23837-1.5.3 Network device testing requirements

ISO/IEC 27043:2015 · 3 controls

  • ISO27043-18 Encryption of data in transit
  • ISO27043-19 Certificate management
  • ISO27043-20 Key lifecycle management

ISO/SAE 21434 · 3 controls

  • ISO21434-16 Cryptographic policy and key management
  • ISO21434-17 Encryption of data at rest
  • ISO21434-19 Certificate management

MARS-E · 3 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-3.2 Remote Access Security
  • AWWA-3.4 Encryption and Data Protection

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 2 controls

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

ISO 27799:2025 · 2 controls

  • ISO27799-02 ePHI encryption at rest and in transit
  • ISO27799-16 Transmission security and encryption

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

OWASP ASVS · 2 controls

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC IT Examination Handbook · 1 control

  • FFIEC-09 Encryption and key management

FIDO2 / WebAuthn · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO/IEC 27010:2015 · 1 control

  • 27010-10.1 Cryptographic Protection

ISO/IEC 27011:2024 · 1 control

  • 27011-8.3 Cryptography and key management

ISO/IEC 27400:2022 · 1 control

  • 27400-6.2 Device Identity and Authentication

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-7.4 Level of Assurance 4 (LoA4)

Jamaica Data Protection Act 2020 · 1 control

Kentucky Consumer Data Protection Act · 1 control

LGPD · 1 control

  • LGPD-BR-Security-Article-46-48-Breach-Notification-ANPD-Reasonable-Time-Incident-Response-CSIRT Brazil LGPD Security + Article 46-48 + Breach Notification + ANPD + Incident Response

Liechtenstein DPA · 1 control

MDS2 (Medical Device) · 1 control

  • MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS

MITRE ATT&CK · 1 control

MTCS (Singapore) · 1 control

  • MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS

Malaysia PDPA 2010 · 1 control

  • MY-PDPA-Sensitive-Personal-Data-Section-40-Health-Religious-Political-Sexual-Children-Explicit-Consent Malaysia PDPA Sensitive Personal Data + Section 40 + Health + Religious + Political + Children + Explicit Consent

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

  • MU-DPA-Sensitive-Personal-Data-Section-24-Health-Biometric-Genetic-Sexual-Section-25-Children-16 Mauritius DPA Sensitive Data + Section 24 + Health + Biometric + Genetic + Sexual + Section 25 + Children 16

Mexico LFPDPPP · 1 control

  • MX-LFPDPPP-Sensitive-Article-3-VI-Genetic-Health-Sexual-Religious-Article-9-Minors-18-Parental-Consent Mexico LFPDPPP Sensitive Data + Article 3 Section VI + Genetic + Health + Sexual + Religious + Article 9 Minors + Parental Consent

Minnesota Consumer Data Privacy Act · 1 control

  • MN-CDPA-Universal-Opt-Out-GPC-Sensitive-Data-Section-325O-02-Consumer-Health-Data-Children-Known-Child-Transgender Minnesota CDPA Universal Opt-Out + GPC + Sensitive + Section 325O.02 + Consumer Health Data + Children + Known Child + Transgender

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

  • MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation

Montana Consumer Data Privacy Act · 1 control

  • MT-CDPA-Universal-Opt-Out-Mechanism-1-January-2025-GPC-Global-Privacy-Control-Mandatory-Recognition Montana CDPA Universal Opt-Out Mechanism + 1 January 2025 + GPC + Global Privacy Control + Mandatory Recognition

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

  • NAIC-2 Information Security Program (ISP) - Section 4

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 1 control

  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

Netherlands PQC Migration Handbook (AIVD, CWI, TNO, 2nd Edition 2024) · 1 control

  • IMPL Use evaluated, production-ready implementations and track implementation weaknesses

New Hampshire Data Privacy Act · 1 control

  • NHPA-6 Reasonable Data Security and Breach Response

New Jersey Data Privacy Act · 1 control

  • NJDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-3 API Security Standards, mTLS, and Encryption

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

  • ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 88 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) controls