Context
The FCA has published a blog commenting on how they are talking to firms to prepare for “post-quantum cryptography”.
Key points to note and next actions
- Mark Francis, Director of Specialists at the FCA, has written a commentary on the FCA’s approach to quantum computing, whereby powerful computers could break the encryption and security systems used by financial firms, which could put customer data, payments and financial markets at risk.
- He states that firms should prepare now, as it’s not clear when this technology could become a real threat. Financial firms must start to identify where they use encryption and other security measures, and plan how to replace them with quantum-resistant technology.
- The National Cyber Security Centre (NCSC) has recommended some key deadlines firms should adopt:
- Complete a migration plan by 2028.
- Complete high-priority system upgrades by 2031.
- Move all systems, services and products to quantum-resistant cryptography by 2035.
- Senior Management must take responsibility – firms must invest sufficient time, money and resources to manage the transition safely, with clear plans, regular testing and ongoing monitoring. Mr Francis notes that poorly managed technology changes could create additional operational risks.
- The FCA will support and monitor progress. It is trialling a self-assessment tool to help firms evaluate their readiness, share good practice and identify common challenges. It also plans to consult on further cyber resilience guidance.