All Posts from

A cryptography and PKI playbook for the Defense Industrial Base under CMMC 2.0 and NIST SP 800-171: FIPS validation, keys, and audit evidence.

NIST, the G7, Executive Order 14412, and SWIFT have put dates on post-quantum migration. What financial institutions must do now.

How PSD2 and SCA map to cryptography: dynamic linking, QWACs, QSealCs, mutual TLS, and audit-ready certificate management.

See how the SWIFT Customer Security Controls Framework and Control 2.4 reshape cryptographic requirements across correspondent banking.

What the GLBA Safeguards Rule encryption mandate requires of non-bank financial institutions, why it decides FTC breach reporting, and how to prove it.

The FIPS 140-2 sunset and the CNSA 2.0 acquisition gate turn quantum-safe migration into a dated obligation for software vendors. Here is what to do now.

How the EU Cyber Resilience Act ties cryptography and PKI to CE marking, plus a practical readiness path for software publishers before 2027.

In June 2026, the White House signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks."

How software producers use the SSDF (NIST SP 800-218) and code signing to prove secure development to federal buyers and back up the signed attestation.

What cloud service providers need to know about FedRAMP cryptographic requirements: FIPS 140 validation, SC-13, SC-12, IA-7, and the 2026 sunset.

How IT product vendors pass Common Criteria (ISO/IEC 15408) cryptographic evaluation, and why FIPS validation is the dependency you cannot skip.

What ISO 27001:2022 Annex A 8.24 requires for cryptography and key management, and how IT and software vendors prove it to an auditor.