NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205): every control, and what you already have

8 controls 126 frameworks share controls with it United States (NIST) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	5	measure it →
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0	5	measure it →
FFIEC IT Examination Handbook	5	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	5	measure it →
IEC 62351	5	measure it →
ISO/IEC 27400:2022	5	measure it →
MITRE ATT&CK	5	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	5	measure it →
MTCS (Singapore)	5	measure it →
Nebraska Data Privacy Act	5	measure it →
Nigeria Data Protection Act 2023 (NDPA)	5	measure it →
NIST SP 800-171A Rev 3	5	measure it →

Every control

Code	Control	Also in
`PQC-1`	PQC Scope, Quantum Resistance Rationale, and Mathematical Foundations	0
`PQC-2`	FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism	51
`PQC-3`	FIPS 204 ML-DSA Implementation - Module-Lattice Digital Signature	0
`PQC-4`	FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature	81
`PQC-5`	Cryptographic Inventory and PQC Migration Roadmap	60
`PQC-6`	Crypto-Agility Architecture and Hybrid Composite Mode Strategy	0
`PQC-7`	FIPS Validated Modules, HSM Readiness, and Algorithm Validation	60
`PQC-8`	Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response	60

Tell me when NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Annual review
Supplier inventory + classification
Risk assessments per supplier
Contractual cyber clauses
ENISA coordinated risk assessment alignment
DORA TPRM cross-walk
Key management procedures
Data protection and classification
Encryption of data at rest and in transit
Key management

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No inventory named by 8 frameworks
No key management named by 5 frameworks

What this page is

A control-level reference for NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition