← Back to Blog Standards

ISO/IEC and Post Quantum Cryptography: Standards in Progress (SC 27 WG 2)

6 min read

The International Standards Track

NIST FIPS 203, 204, and 205 are US standards. International harmonization runs through ISO/IEC JTC 1/SC 27 (Information security, cybersecurity, and privacy protection) and its Working Group 2 (Cryptography and security mechanisms).

Standing Document 8 on PQC

SC 27 WG 2 maintains Standing Document 8, an international consensus reference on Post Quantum Cryptography. It tracks algorithm evaluations, implementation guidance, and interoperability. As of April 2026 SD8 is an active work item.

Expected International Standards

ISO/IEC is typically 18-36 months behind NIST for mature algorithms. Expected outputs:

ISO/IEC 18033-2 (Encryption): PQC amendments adding ML-KEM.
ISO/IEC 14888 (Signatures): PQC amendments adding ML-DSA, SLH-DSA.
ISO/IEC 11770 (Key management): hybrid KEM guidance.
ISO/IEC 10118 (Hashing): alignment with SHA-3 and BLAKE3 as appropriate.

Who Participates

National bodies participate in SC 27 through their standards organizations: NIST (US), BSI (Germany), NBT (Netherlands), BSI India, BIS India, KISA (Korea), KATS, and others. Industry contributes through national delegations.

Why This Matters

Procurement: many non-US jurisdictions reference ISO/IEC standards in procurement rules rather than NIST FIPS directly.
Interoperability: ISO/IEC standards ensure global interoperability.
Export controls: Wassenaar Arrangement cryptography controls reference ISO/IEC standards.
Compliance: some regulated industries (aviation, shipping, automotive) align with ISO rather than NIST.

Frequently Asked Questions

Is ISO/IEC faster than NIST on PQC?

No. NIST leads, ISO/IEC typically follows 18-36 months later. ISO/IEC provides international consensus and often references NIST algorithms.

Will ISO/IEC pick different PQC algorithms than NIST?

Unlikely for the core primitives. ISO/IEC tends to converge on widely-deployed algorithms. Expect ISO/IEC to adopt ML-KEM, ML-DSA, SLH-DSA variants.

When will ISO/IEC PQC standards be final?

Gradually through 2026-2028. SC 27 working drafts advance through NP, WD, CD, DIS, FDIS, and IS stages over several years.

Do I need to wait for ISO/IEC to deploy PQC?

No. NIST FIPS 203/204/205 algorithms are deployable now. ISO/IEC will endorse the same algorithms over time.

Sources

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/iso-iec-pqc-standards.