Introduction
QSD provides structured advisory for organisations navigating NIS2, DORA, GDPR, the EU AI Act and related security governance expectations. Our focus is practical: identify where cryptographic resilience intersects with existing obligations, align controls and evidence, and avoid building a separate compliance programme disconnected from operational reality.
2026 Regulatory Context
The 2026 compliance landscape requires careful separation of binding obligations from strategic security expectations. DORA is already in application for financial entities; CRA reporting obligations start in September 2026; NIS2 continues to shape governance and risk-management expectations across essential and important sectors; and the EU PQC roadmap establishes a coordinated policy direction for quantum-safe transition. QSD’s advisory approach treats PQC as a risk and control topic that must be mapped into the obligations that actually apply to the client—without presenting policy roadmaps as legislation or overstating regulatory requirements.
Why It Matters
- Multiple frameworks can apply to the same services, suppliers, data and security controls.
- Quantum-transition activities should be traceable to risk management, resilience, secure development, supplier governance and management oversight.
- Evidence consistency matters: policies, technical records, risk decisions and remediation status should tell the same story.
Our Approach
- Determine applicable regulatory and contractual requirements.
- Map obligations to cryptographic and security-control domains.
- Review evidence, governance and implementation gaps.
- Create a consolidated remediation and assurance plan.
What You Receive
- Applicability and obligation map
- Control crosswalk
- Compliance gap analysis
- Evidence plan
- Remediation roadmap
- Management / audit briefing
Relevant Standards & Context
NIS2 · DORA · GDPR · EU AI Act · ISO/IEC 27001 · sector-specific requirements