Home / Rules by market
The rules that apply to you
The amendment is a mechanism standard. The obligation an organisation actually carries comes from the law and the frameworks of its market, which point at the cryptography. This page names the held frameworks per market, in market order, and says where a regime is named but not analysed.
The record this product reads
ISO/IEC 14888-3:2018/Amd 1, 33 records, at stage 60.00. The amendment in the compliance library. Open the record.
Three questions the amendment raises
- Inventory: can you list every signature mechanism in use, with its arithmetic setting and parameter set? Clause 6.1 now counts twelve certificate-based mechanisms across three settings.
- Verifier: does your verifier reject a malformed encoding before it runs the group equation? Clause 6.13.5.2 puts that rule on the verifier.
- Hash: does the hash strength meet the parameter pair for each mechanism? Clauses 6.3.2, 6.5.2 and 6.6.1 tighten that rule.
What is out of scope here
This page does not restate a statute and does not decide whether the amendment applies to you. It names the held frameworks so a reader can see what the record covers and what it does not.
United States
United States
A federal agency or a supplier to one reads the amendment into the cryptographic protection controls it already reports against. The quantum transition guidance is the reason an approved mechanism list is now a living document rather than a one-off decision.
The held frameworks named for this market
- NIST SP 800-53 Rev 5, the SC-12 and SC-13 control families on key management and cryptographic protection
- NSA Guidance for Transition to Quantum-Resistant Cryptography
- NIST Post-Quantum Cryptography Standards, FIPS 203, 204 and 205
Chosen by scanning the held library for the buyer's activity and the data they hold, in market order. A framework with no requirement leaves in the library is named and not analysed.
European Union
European Union
A trust service provider or an entity in scope of NIS2 reads the amendment into its cryptographic controls and its supplier requirements. eIDAS sets the signature formats for regulated electronic signatures; this record does not analyse it.
The held frameworks named for this market
- NIS2 Directive, the cybersecurity risk management duties on essential and important entities
- eIDAS 2.0, the EU digital identity regulation, named not analysed here
- ISO/IEC 27001:2022, the information security management controls used across markets
Chosen by scanning the held library for the buyer's activity and the data they hold, in market order. A framework with no requirement leaves in the library is named and not analysed.
United Kingdom
United Kingdom
An organisation holding personal data reads the amendment into the technical measures it can evidence. A maker of connected products reads it into the security requirements it publishes for its products.
The held frameworks named for this market
- UK GDPR, the security principle and the appropriate technical measures
- UK Product Security and Telecommunications Infrastructure Act, for consumer connected products
- NCSC cryptographic guidance, named not analysed here
Chosen by scanning the held library for the buyer's activity and the data they hold, in market order. A framework with no requirement leaves in the library is named and not analysed.
Australia
Australia
An Australian government entity or a supplier to one reads the amendment into the ISM cryptographic guidance. An organisation running the Essential Eight reads it into the signature verification behind application control.
The held frameworks named for this market
- Australian Information Security Manual, the cryptographic fundamentals and guidelines
- ACSC Essential Eight, the application control and patching practices that depend on signature verification
- Privacy Act 1988, named not analysed here
Chosen by scanning the held library for the buyer's activity and the data they hold, in market order. A framework with no requirement leaves in the library is named and not analysed.
What this page is not
It is not a legal register and it does not state the text of any law. It names the frameworks the record holds for each market so the boundary is visible. Where a market's regime is named but not analysed, the page says so.
Not legal advice; does not certify.