NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite

United States (NSA)

v2.0 (2022, timeline to 2033)

5 domains

11 controls

The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), announced September 2022, establishes the quantum-resistant cryptographic algorithms required for National Security Systems (NSS). CNSA 2.0 replaces CNSA 1.0 and mandates transition to post-quantum algorithms. Timeline: software/firmware signing (2025), web browsers/servers and cloud services (2025), traditional networking equipment (2026), operating systems (2027), niche equipment (2030), legacy equipment retirement (2033). Key algorithms: CRYSTALS-Kyber (ML-KEM), CRYSTALS-Dilithium (ML-DSA), XMSS/LMS (stateful hash-based signatures), SHA-384/512, and AES-256.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Digital Signatures

3 controls

Controls in the Digital Signatures domain of NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite — 3 controls
Code	Title	Description
CNSA2-DS-1	ML-DSA Digital Signatures	Use NIST-standardized ML-DSA (Module-Lattice-Based Digital Signature Algorithm) for digital signatures
CNSA2-DS-2	LMS Hash-Based Signatures	Use LMS with SHA-256/192 per NIST SP 800-208 Section 4.2 for firmware and software signing
CNSA2-DS-3	XMSS Stateful Signatures	XMSS approved for use in NSS but multi-tree variants HSS and XMSSMT are not allowed

Hash Functions

2 controls

Controls in the Hash Functions domain of NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite — 2 controls
Code	Title	Description
CNSA2-HASH-1	SHA-384 Requirement	SHA-384 remains approved in CNSA 2.0 providing sufficient security for National Security Systems
CNSA2-HASH-2	SHA-512 Support	SHA-512 now supported by CNSA 2.0 as designers often prefer it for performance reasons

Implementation and Validation

3 controls

Controls in the Implementation and Validation domain of NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite — 3 controls
Code	Title	Description
CNSA2-IMP-1	NIAP Product Validation	QR algorithms should be implemented as NIAP validated products per NSM-10 and CNSSP-11
CNSA2-IMP-2	CMVP Module Validation	Cryptographic modules must be validated by NIST Cryptographic Module Validation Program
CNSA2-IMP-3	Transition Timeline Compliance	Equipment transitions to be completed by December 31, 2030 with majority quantum resistant by 2031

Key Establishment

2 controls

Controls in the Key Establishment domain of NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite — 2 controls
Code	Title	Description
CNSA2-KE-1	ML-KEM Key Encapsulation	Use NIST-standardized ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) for key establishment
CNSA2-KE-2	Quantum-Resistant Key Exchange	Replace classical RSA and ECDH key exchange with post-quantum lattice-based algorithms

Symmetric Encryption

1 controls

Controls in the Symmetric Encryption domain of NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite — 1 controls
Code	Title	Description
CNSA2-SYM-1	AES-256 Requirement	Symmetric encryption must use AES-256 for protecting National Security Systems information

Maps to 249 other frameworks

11 total controls

California IoT Security Law

3 source controls mapped|4 target controls covered

27%

BSIMM

3 source controls mapped|4 target controls covered

27%

ISO/IEC 23837 — Security Requirements for Quantum Key Distribution

3 source controls mapped|3 target controls covered

27%

IEC 62351 — Power Systems Communication Security

3 source controls mapped|1 target controls covered

27%

NIST SP 800-171A — Assessing CUI Security Requirements

3 source controls mapped|4 target controls covered

27%

3GPP Security Architecture (TS 33.501 — 5G Security)

3 source controls mapped|4 target controls covered

27%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

3 source controls mapped|2 target controls covered

27%

ISO/IEC 27010:2015

3 source controls mapped|1 target controls covered

27%

Bahrain PDPL

3 source controls mapped|1 target controls covered

27%

CCPA/CPRA

3 source controls mapped|1 target controls covered

27%

OWASP ASVS

3 source controls mapped|4 target controls covered

27%

FBI CJIS Security Policy

3 source controls mapped|2 target controls covered

27%

US Gramm-Leach-Bliley Act (GLBA) — Higher Education Safeguards Rule

3 source controls mapped|2 target controls covered

27%

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

3 source controls mapped|2 target controls covered

27%

HIPAA Security Rule

3 source controls mapped|2 target controls covered

27%

Switzerland FADP

3 source controls mapped|1 target controls covered

27%

OWASP API Security Top 10:2023

3 source controls mapped|1 target controls covered

27%

Azure Security Benchmark

3 source controls mapped|1 target controls covered

27%

Belgium CyberFundamentals

3 source controls mapped|1 target controls covered

27%

CISA Zero Trust Maturity Model

3 source controls mapped|1 target controls covered

27%

OWASP Top 10:2025

3 source controls mapped|2 target controls covered

27%

Privacy Act 1988 (Australia)

3 source controls mapped|1 target controls covered

27%

ANSSI Cybersecurity Framework

3 source controls mapped|1 target controls covered

27%

BCBS 239

3 source controls mapped|1 target controls covered

27%

CAIQ (CSA)

3 source controls mapped|1 target controls covered

27%

BSI IT-Grundschutz

3 source controls mapped|1 target controls covered

27%

APPI

3 source controls mapped|1 target controls covered

27%

Argentina PDPA

3 source controls mapped|1 target controls covered

27%

CMMC 2.0

3 source controls mapped|1 target controls covered

27%

Chile DPL

3 source controls mapped|1 target controls covered

27%

HL7 FHIR Security Framework

3 source controls mapped|2 target controls covered

27%

UK Defence Standard 05-138 — Cyber Security for Defence Suppliers

3 source controls mapped|1 target controls covered

27%

Chile Personal Data Protection Law (Law No. 21.719)

3 source controls mapped|1 target controls covered

27%

ASD Strategies to Mitigate Cyber Security Incidents

3 source controls mapped|1 target controls covered

27%

ISO/IEC 29115:2023 — Entity Authentication Assurance Framework

3 source controls mapped|1 target controls covered

27%

Cyber Essentials Plus

3 source controls mapped|1 target controls covered

27%

ISO/IEC 27400:2022

3 source controls mapped|1 target controls covered

27%

3GPP Security

3 source controls mapped|4 target controls covered

27%

ISO/IEC 27011:2024

3 source controls mapped|1 target controls covered

27%

AWS Well-Architected Security Pillar

3 source controls mapped|1 target controls covered

27%

C5 (Germany)

3 source controls mapped|1 target controls covered

27%

ISO/IEC 27557:2022 — Organisational Privacy Risk Management

3 source controls mapped|1 target controls covered

27%

AS9100D:2016 — Quality Management Systems for Aviation, Space, and Defence

3 source controls mapped|1 target controls covered

27%

EMV 3-D Secure (3DS2) — Payment Authentication Protocol

3 source controls mapped|1 target controls covered

27%

EDM Council CDMC — Cloud Data Management Capabilities Framework

3 source controls mapped|1 target controls covered

27%

NIST SP 800-53 Rev 5

3 source controls mapped|3 target controls covered

27%

SWIFT CSCF

3 source controls mapped|1 target controls covered

27%

W3C Verifiable Credentials (VC) Data Model 2.0

3 source controls mapped|1 target controls covered

27%

PAS 1192-5:2015 — Security-Minded Approach to BIM and Digital Built Environments

3 source controls mapped|3 target controls covered

27%

Canada ITSG-33 — IT Security Risk Management

3 source controls mapped|3 target controls covered

27%

New Zealand Information Security Manual (NZISM)

3 source controls mapped|3 target controls covered

27%

MARS-E — Minimum Acceptable Risk Standards for Exchanges

3 source controls mapped|3 target controls covered

27%

South Korea Cloud Security Assurance Program (CSAP)

3 source controls mapped|3 target controls covered

27%

NRC 10 CFR 73.54 — Nuclear Facility Cybersecurity

3 source controls mapped|3 target controls covered

27%

SWIFT CSP

3 source controls mapped|1 target controls covered

27%

UK PSTI Act

3 source controls mapped|4 target controls covered

27%

ISO 27799

3 source controls mapped|2 target controls covered

27%

RBI Cybersecurity Framework for Banks

3 source controls mapped|1 target controls covered

27%

ISO 27002:2022

3 source controls mapped|4 target controls covered

27%

PDPA Singapore

3 source controls mapped|1 target controls covered

27%

NIST SP 800-181

3 source controls mapped|4 target controls covered

27%

Qatar DPL

3 source controls mapped|1 target controls covered

27%

Connecticut DPA

3 source controls mapped|1 target controls covered

27%

DORA

3 source controls mapped|1 target controls covered

27%

CSA CCM v4

3 source controls mapped|3 target controls covered

27%

NIST SP 800-183

3 source controls mapped|4 target controls covered

27%

PCI DSS v4.0

3 source controls mapped|3 target controls covered

27%

NIST SP 800-218

3 source controls mapped|3 target controls covered

27%

FDA 21 CFR Part 11

3 source controls mapped|2 target controls covered

27%

Kentucky Consumer Data Protection Act

3 source controls mapped|1 target controls covered

27%

Colorado Privacy Act

3 source controls mapped|1 target controls covered

27%

OWASP MASVS

3 source controls mapped|3 target controls covered

27%

NIST SP 800-63

3 source controls mapped|3 target controls covered

27%

OpenSSF Scorecard

3 source controls mapped|5 target controls covered

27%

Mauritius DPA

3 source controls mapped|1 target controls covered

27%

Singapore Government Instruction Manual on ICT&SS Management (IM8)

3 source controls mapped|1 target controls covered

27%

NIST SP 800-88

3 source controls mapped|4 target controls covered

27%

NATO STANAG 4774/4778 — Confidentiality Metadata Labels

3 source controls mapped|2 target controls covered

27%

OSFI B-13

3 source controls mapped|1 target controls covered

27%

Norway PDPA

3 source controls mapped|1 target controls covered

27%

MITRE ATT&CK

3 source controls mapped|4 target controls covered

27%

UNECE WP.29 R156

3 source controls mapped|4 target controls covered

27%

NSA Quantum-Resistant (QR) Cryptography Migration Guidance

3 source controls mapped|3 target controls covered

27%

NIST SP 800-150

3 source controls mapped|3 target controls covered

27%

MAS TRM

3 source controls mapped|1 target controls covered

27%

CCSDS 350.0-G-3 — Space Communications Security (Consultative Committee for Space Data Systems)

3 source controls mapped|4 target controls covered

27%

NIST SP 800-115

3 source controls mapped|4 target controls covered

27%

Ecuador LOPDP

3 source controls mapped|1 target controls covered

27%

Peru DPL

3 source controls mapped|1 target controls covered

27%

CNCF Cloud Native Security (Cloud Native Computing Foundation)

3 source controls mapped|2 target controls covered

27%

NIST SP 800-207

3 source controls mapped|3 target controls covered

27%

TISAX — Trusted Information Security Assessment Exchange

3 source controls mapped|3 target controls covered

27%

Dominican Republic DPL

3 source controls mapped|1 target controls covered

27%

China PIPL

3 source controls mapped|1 target controls covered

27%

EAR — Export Administration Regulations

3 source controls mapped|2 target controls covered

27%

EU Digital Markets Act

3 source controls mapped|1 target controls covered

27%

SSDF (NIST)

3 source controls mapped|4 target controls covered

27%

RFC 2350 — Expectations for Computer Security Incident Response (BCP 21)

3 source controls mapped|1 target controls covered

27%

NIST SP 800-171A Rev 3 — Assessing CUI Security Requirements

3 source controls mapped|3 target controls covered

27%

FedRAMP Rev 5

3 source controls mapped|3 target controls covered

27%

ISO 27701

3 source controls mapped|1 target controls covered

27%

NIST SP 800-187

3 source controls mapped|5 target controls covered

27%

Iowa Consumer Data Protection Act

3 source controls mapped|1 target controls covered

27%

ISO 27043

3 source controls mapped|4 target controls covered

27%

Utah Consumer Privacy Act

3 source controls mapped|1 target controls covered

27%

PCI SSF

3 source controls mapped|1 target controls covered

27%

NIST SP 800-160

3 source controls mapped|5 target controls covered

27%

Spain ENS

3 source controls mapped|1 target controls covered

27%

NIST SP 800-92

3 source controls mapped|4 target controls covered

27%

NIST SP 800-137

3 source controls mapped|4 target controls covered

27%

NIST AI Risk Management Framework (AI RMF 1.0)

3 source controls mapped|1 target controls covered

27%

NIST AI 600-1 Generative AI Profile

3 source controls mapped|1 target controls covered

27%

NIST Privacy Framework 1.0

3 source controls mapped|1 target controls covered

27%

Saudi Arabia PDPL

3 source controls mapped|1 target controls covered

27%

ISO 27017

3 source controls mapped|1 target controls covered

27%

Taiwan PDPA

3 source controls mapped|1 target controls covered

27%

HKMA SPM

3 source controls mapped|1 target controls covered

27%

POPIA

3 source controls mapped|1 target controls covered

27%

PTES

3 source controls mapped|4 target controls covered

27%

ISO/SAE 21434

3 source controls mapped|4 target controls covered

27%

FAA Cybersecurity Framework for Aviation

3 source controls mapped|1 target controls covered

27%

Oman National Cybersecurity Framework

3 source controls mapped|1 target controls covered

27%

Uruguay DPL

3 source controls mapped|1 target controls covered

27%

ASD Information Security Manual (ISM)

3 source controls mapped|6 target controls covered

27%

ISO 13485

3 source controls mapped|2 target controls covered

27%

DISA Security Technical Implementation Guides (STIGs)

3 source controls mapped|5 target controls covered

27%

MDS2 (Medical Device)

3 source controls mapped|2 target controls covered

27%

NIST SP 800-61

3 source controls mapped|3 target controls covered

27%

Virginia CDPA

3 source controls mapped|1 target controls covered

27%

UK Gambling Commission — Cyber Resilience Requirements

3 source controls mapped|1 target controls covered

27%

NIST SP 800-53A

3 source controls mapped|1 target controls covered

27%

NIST SP 800-34 Rev 1 — Contingency Planning Guide

3 source controls mapped|1 target controls covered

27%

Digital Economy Partnership Agreement (DEPA)

3 source controls mapped|1 target controls covered

27%

Saudi NCA ECC

3 source controls mapped|1 target controls covered

27%

US ITAR and EAR — Export Control and Data Security

3 source controls mapped|2 target controls covered

27%

EU Cyber Resilience Act

3 source controls mapped|4 target controls covered

27%

FFIEC IT Examination Handbook

3 source controls mapped|1 target controls covered

27%

US Executive Order 14028 — Improving the Nation's Cybersecurity

3 source controls mapped|1 target controls covered

27%

NIST SP 800-123

3 source controls mapped|4 target controls covered

27%

NIST SP 800-146

3 source controls mapped|1 target controls covered

27%

APRA CPS 234

3 source controls mapped|1 target controls covered

27%

ISO 27018

3 source controls mapped|1 target controls covered

27%

Turkey KVKK

3 source controls mapped|1 target controls covered

27%

ILO Nursing Personnel Convention C149 (1977)

3 source controls mapped|1 target controls covered

27%

EU Anti-Money Laundering Directive (AMLD6 / Directive 2018/1673)

3 source controls mapped|1 target controls covered

27%

ISO 8000 — Data Quality

3 source controls mapped|1 target controls covered

27%

FATF Recommendation 16 — Virtual Asset Travel Rule

3 source controls mapped|1 target controls covered

27%

Privacy by Design (PbD) — Seven Foundational Principles

3 source controls mapped|1 target controls covered

27%

BS 65000:2014 — Guidance on Organizational Resilience

3 source controls mapped|1 target controls covered

27%

IRS Publication 1075 — Tax Information Security Guidelines

3 source controls mapped|1 target controls covered

27%

ENISA Privacy Enhancing Technologies (PETs) Guidance

3 source controls mapped|2 target controls covered

27%

3GPP 5G Security Architecture (TS 33.501)

3 source controls mapped|2 target controls covered

27%

Montana Consumer Data Privacy Act

3 source controls mapped|1 target controls covered

27%

SLSA

3 source controls mapped|4 target controls covered

27%

Nigeria Open Banking Regulatory Framework (CBN, 2023)

3 source controls mapped|1 target controls covered

27%

NIS2 Directive Implementing Acts

3 source controls mapped|1 target controls covered

27%

NIST SP 800-66

3 source controls mapped|2 target controls covered

27%

NIST SP 800-161

3 source controls mapped|4 target controls covered

27%

NIST SP 800-128

3 source controls mapped|4 target controls covered

27%

Indonesia PDP Law

3 source controls mapped|1 target controls covered

27%

UNECE WP.29 R155

3 source controls mapped|3 target controls covered

27%

ISO 22739:2024 — Blockchain and Distributed Ledger Technologies Vocabulary

3 source controls mapped|1 target controls covered

27%

NIST SP 800-144

3 source controls mapped|1 target controls covered

27%

ECB TIBER-EU

3 source controls mapped|1 target controls covered

27%

Maryland Online Data Privacy Act

3 source controls mapped|1 target controls covered

27%

CISA Secure by Design Principles

3 source controls mapped|2 target controls covered

27%

New Jersey Data Privacy Act

3 source controls mapped|1 target controls covered

27%

MTCS (Singapore)

3 source controls mapped|1 target controls covered

27%

Nigeria NDPR

3 source controls mapped|1 target controls covered

27%

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)

3 source controls mapped|5 target controls covered

27%

Liechtenstein DPA

3 source controls mapped|1 target controls covered

27%

SIG (Shared Assessments)

3 source controls mapped|4 target controls covered

27%

PDPA Thailand

3 source controls mapped|1 target controls covered

27%

ESRB Privacy Certified Programme

3 source controls mapped|2 target controls covered

27%

Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act)

3 source controls mapped|2 target controls covered

27%

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

3 source controls mapped|3 target controls covered

27%

ISO 27001:2022

3 source controls mapped|1 target controls covered

27%

FIDO2 and W3C WebAuthn Standard

3 source controls mapped|1 target controls covered

27%

Tennessee IPA

3 source controls mapped|1 target controls covered

27%

ETSI EN 303 645

3 source controls mapped|5 target controls covered

27%

MARS-E

3 source controls mapped|2 target controls covered

27%

Colombia Habeas Data Law

3 source controls mapped|1 target controls covered

27%

Philippines DPA

3 source controls mapped|1 target controls covered

27%

Malaysia PDPA 2010

3 source controls mapped|1 target controls covered

27%

FTC GLBA Safeguards Rule (16 CFR Part 314)

3 source controls mapped|1 target controls covered

27%

DoD Zero Trust Reference Architecture

3 source controls mapped|1 target controls covered

27%

NIST SP 800-172

3 source controls mapped|1 target controls covered

27%

SOC for Cybersecurity — Cybersecurity Risk Management Examination

3 source controls mapped|1 target controls covered

27%

NIST SP 800-145

3 source controls mapped|1 target controls covered

27%

CSA STAR (Security, Trust, Assurance, and Risk)

3 source controls mapped|1 target controls covered

27%

NIST SP 800-190

3 source controls mapped|1 target controls covered

27%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

3 source controls mapped|2 target controls covered

27%

GLI-33 — Gaming Laboratories International Event Wagering Systems

3 source controls mapped|2 target controls covered

27%

EIOPA Guidelines on ICT Security and Governance (2020)

3 source controls mapped|2 target controls covered

27%

Telecommunications Sector Security Reforms (TSSR)

3 source controls mapped|2 target controls covered

27%

Defence Security Principles Framework (DSPF)

3 source controls mapped|2 target controls covered

27%

Protective Security Policy Framework (PSPF) Release 2024

3 source controls mapped|2 target controls covered

27%

UK Open Banking Standard

3 source controls mapped|2 target controls covered

27%

ISMAP (Japan)

3 source controls mapped|1 target controls covered

27%

NIST SP 800-122

3 source controls mapped|1 target controls covered

27%

South Korea ISMS-P

3 source controls mapped|1 target controls covered

27%

FTC Safeguards Rule (16 CFR Part 314)

3 source controls mapped|1 target controls covered

27%

LGPD

3 source controls mapped|1 target controls covered

27%

Oregon Consumer Privacy Act

3 source controls mapped|1 target controls covered

27%

AICPA SOC 1

3 source controls mapped|1 target controls covered

27%

Minnesota Consumer Data Privacy Act

3 source controls mapped|1 target controls covered

27%

Nebraska Data Privacy Act

3 source controls mapped|1 target controls covered

27%

MITRE D3FEND

3 source controls mapped|4 target controls covered

27%

NAIC Insurance Data Security Model Law (MDL-668)

3 source controls mapped|3 target controls covered

27%

Mexico LFPDPPP

3 source controls mapped|1 target controls covered

27%

Rwanda DPL

3 source controls mapped|1 target controls covered

27%

Jamaica DPA

3 source controls mapped|1 target controls covered

27%

FERPA

3 source controls mapped|1 target controls covered

27%

New Hampshire Privacy Act

3 source controls mapped|1 target controls covered

27%

UK Data Protection Act 2018

3 source controls mapped|1 target controls covered

27%

India DPDP Act

3 source controls mapped|1 target controls covered

27%

PIPEDA

3 source controls mapped|1 target controls covered

27%

FISMA

3 source controls mapped|1 target controls covered

27%

New Zealand Privacy Act

3 source controls mapped|1 target controls covered

27%

GLBA

3 source controls mapped|1 target controls covered

27%

HKMA Cyber Resilience Assessment Framework (C-RAF)

3 source controls mapped|1 target controls covered

27%

COPPA

3 source controls mapped|1 target controls covered

27%

NIST SP 800-124 Rev 2 — Mobile Device Security

3 source controls mapped|3 target controls covered

27%

HITECH Act

3 source controls mapped|1 target controls covered

27%

OWASP SAMM

3 source controls mapped|3 target controls covered

27%

Vietnam PDPD

3 source controls mapped|1 target controls covered

27%

NIST SP 800-171

3 source controls mapped|1 target controls covered

27%

AICPA SOC 3

3 source controls mapped|1 target controls covered

27%

PSD2 SCA

3 source controls mapped|1 target controls covered

27%

PCI PIN Security

3 source controls mapped|1 target controls covered

27%

Indiana Consumer Data Protection Act

3 source controls mapped|1 target controls covered

27%

Open Banking Security

3 source controls mapped|1 target controls covered

27%

Texas Data Privacy Act

3 source controls mapped|1 target controls covered

27%

Ghana Cybersecurity Act

3 source controls mapped|1 target controls covered

27%

Kenya DPA

3 source controls mapped|1 target controls covered

27%

Iceland DPA

3 source controls mapped|1 target controls covered

27%

UK Telecommunications (Security) Act 2021

3 source controls mapped|1 target controls covered

27%

O-RAN Alliance Security Specifications (O-RAN.WG11)

3 source controls mapped|1 target controls covered

27%

NIST SP 800-82 Rev 3 — Guide to OT Security

3 source controls mapped|1 target controls covered

27%

Delaware Personal Data Privacy Act

3 source controls mapped|1 target controls covered

27%

UAE PDPL

3 source controls mapped|1 target controls covered

27%

PCI P2PE

3 source controls mapped|1 target controls covered

27%

CISA ICS-CERT Advisories and Industrial Control Systems Security Guidelines

1 source controls mapped|1 target controls covered

IACS Unified Requirements E26/E27 — Cyber Resilience of Ships and On-Board Systems

1 source controls mapped|1 target controls covered

Sigstore — Software Artifact Signing and Verification

1 source controls mapped|1 target controls covered

DFARS 252.204-7012 — Safeguarding Covered Defense Information

1 source controls mapped|1 target controls covered

Connecticut Data Privacy Act (CTDPA)

1 source controls mapped|1 target controls covered

Illinois Biometric Information Privacy Act (BIPA)

1 source controls mapped|1 target controls covered

Modern Slavery Act 2018 (Australia)

1 source controls mapped|1 target controls covered

Compare NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite with California IoT Security Law

Frequently Asked Questions

What is NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite?

NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite is a compliance framework from United States (NSA) with 5 domains and 11 controls. The NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), announced September 2022, establishes the quantum-resistant cryptographic algorithms required for National Security Systems (NSS). CNSA 2.0 replaces CNSA 1.0 and mandates transition to post-quantum algorithms. Timeline: software/firmware signing (2025), web browsers/servers and cloud services (2025), traditional networking equipment (2026), operating systems (2027), niche equipment (2030), legacy equipment retirement (2033). Key algorithms: CRYSTALS-Kyber (ML-KEM), CRYSTALS-Dilithium (ML-DSA), XMSS/LMS (stateful hash-based signatures), SHA-384/512, and AES-256. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite have?

NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite has 11 controls organised across 5 domains. The largest domains are Digital Signatures (3 controls), Implementation and Validation (3 controls), Hash Functions (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite map to?

NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite maps to 249 other compliance frameworks. The top mapping partners are California IoT Security Law (27% coverage), BSIMM (27% coverage), ISO/IEC 23837 — Security Requirements for Quantum Key Distribution (27% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite compliance?

Start your NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NSA CNSA Suite 2.0 — Commercial National Security Algorithm Suite requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 11 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 692 frameworks.

Get Started Free →

Free forever — no credit card required