3.5 Critical Infrastructure

PQC requirements for critical infrastructure¹⁾ operators.

Critical infrastructures are organizations and facilities of significant importance to the community, whose failure would have dramatic consequences.

The NIS2 Directive²⁾ defines the following sectors:

Essential Entities:

• Energy (Electricity, Gas, Oil)
• Transport (Air, Rail, Water, Road)
• Banking
• Financial Market Infrastructures
• Healthcare
• Drinking Water
• Digital Infrastructure

Important Entities:

• Postal and Courier Services
• Waste Management
• Chemical
• Food
• Manufacturing
• Digital Services

• Early PQC migration (before 2030)
• Documentation obligations
• Incident reporting requirements (within 24h)
• Regular audits
• Risk management according to ENISA³⁾ guidelines

Especially critical for critical infrastructure⁴⁾:

• Long-term sensitive data (>10 years)
• Infrastructure control data
• Key material
• Authentication data

The Federal Office for Information Security⁵⁾ recommends:

• Immediate inventory of cryptography
• Prioritization by data sensitivity
• Hybrid solutions as transitional measure
• At least FIPS 203/204/205 compliant algorithms

• NIS2 Directive (EUR-Lex)
• BSI: Critical Infrastructures
• ENISA: Post-Quantum Cryptography Report
• ENISA Risk Management