How Quantum Computing Will Impact CIS Benchmark Requirements

Why Quantum Computing Threatens Current CIS Benchmarks

CIS Benchmarks today rely heavily on the computational hardness assumptions of classical cryptographic algorithms — RSA, Diffie-Hellman, and elliptic curve cryptography (ECC). These algorithms underpin TLS configurations, digital signatures, code signing, VPN tunnels, and identity federation across every system that a CIS Benchmark touches. Shor's algorithm, when executed on a sufficiently powerful fault-tolerant quantum computer, can solve the integer factorization and discrete logarithm problems in polynomial time. That means RSA-2048, a mainstay of current hardening guides, could be broken in hours or minutes once a machine of roughly 4,000 logical qubits exists.

The immediate implication is that every CIS Benchmark rule that references a cryptographic control — roughly 30 to 40 percent of all controls in the server and network device benchmarks — will need to be rewritten. Consider a typical CIS Benchmark for Windows Server that recommends disabling TLS 1.0 and 1.1 and configuring TLS 1.2 with specific cipher suites. That rule is valid today, but it will be obsolete the moment quantum-capable attacks become practical. The replacement benchmark will need to validate that the system supports and enforces hybrid key exchange mechanisms (for example, X25519Kyber768 or similar NIST-approved PQC combinations) and that digital certificates are issued under a PQC-compatible public key infrastructure.

The Timeline: Quantum Readiness and Regulatory Pressure

Enterprise security teams often ask, "How long do we have?" The honest answer, based on the current cryptographic transition timelines published by NIST and national cyber authorities, is that the transition window is already open and the back end is closer than most organizations realize.

The gap between standard publication and enterprise adoption historically spans three to five years for major cryptographic transitions. The migration from SHA-1 to SHA-2 took nearly a decade. The TLS 1.0 to 1.2 migration took even longer. Quantum migration is more complex because it affects asymmetric cryptography at every layer — from boot firmware and kernel modules to cloud API authentication and code signing. CIS Benchmarking Tool users are already reporting that their 2025 hardening audits are flagging cryptographic inventory gaps that did not exist in the 2023 baseline.

CIS Controls v8 vs. Quantum Risks: Which Controls Are Most Affected

The CIS Controls v8 are organized into 18 Implementation Groups (IG1, IG2, IG3) and six control families. Quantum computing does not affect every control equally. The most impacted controls fall into three categories: cryptographic configuration management, software supply chain integrity, and data protection at rest and in transit.

Safeguard 3.10: Cryptographic Configuration Management

This safeguard requires organizations to "cryptographically protect data in transit and at rest using approved cryptographic algorithms and key lengths." Under current CIS Benchmarks, "approved" typically means AES-256, RSA-2048, and ECDH P-384. Under a quantum-ready regime, "approved" will exclude all ECC-based key exchange in favor of module-lattice or code-based key encapsulation mechanisms (KEMs) such as ML-KEM (FIPS 203) and ML-DSA (FIPS 204). The benchmark rule will need to add a validation step that checks whether the system's cryptographic library supports and prefers PQC algorithms in the default policy.

Safeguard 10.2: Software Integrity and Code Signing

Software integrity verification relies on digital signatures that are currently ECC or RSA based. A quantum attacker could forge signatures on malicious updates, bypassing all existing code-signing protections. The updated benchmark will require that all software packages, container images, and firmware updates carry dual signatures (classical + PQC) during the transition period. This affects the CIS Benchmark sections for SAP Guardian and other enterprise application baselines that verify update integrity.

Safeguard 13.1: Data Protection at Rest

Full-disk encryption, database encryption, and backup encryption today rely on key wrapping using RSA or ECDH. An attacker who exfiltrates an encrypted backup today and stores it for five years will be able to decrypt it with a quantum system in 2030. The "store now, decrypt later" (SNDL) threat is already driving changes in the compliance automation space, where organizations are being advised to transition to hybrid encryption schemes that combine symmetric data encryption with quantum-resistant key encapsulation.

How CIS Benchmark Requirements Will Change in Practice

To make this concrete, we will examine specific CIS Benchmark rules that will change and what the new rule might look like. This is not speculative — it is based on the cryptographic transitions that NIST has already mandated and that leading cloud providers and operating system vendors are already implementing.

Cryptographic Agility: The New CIS Benchmark Mandate

Perhaps the most significant change to CIS Benchmark requirements will be the introduction of cryptographic agility as a first-class control objective. Cryptographic agility is the ability of a system to replace cryptographic algorithms and parameters without requiring fundamental architectural changes. Today, most CIS Benchmarks check for the presence of specific algorithms (e.g., "Is TLS 1.2 configured with AES-GCM?"). Future benchmarks will check for the ability to rotate cryptographic primitives dynamically — for example, "Does the system support a cryptographic provider abstraction layer that allows algorithm substitution without recompilation?"

This is a paradigm shift. Organizations that hard-code algorithm identifiers, rely on monolithic cryptographic libraries, or lack a centralized cryptographic policy engine will fail these new controls. The SIEM tools in use today will need to ingest cryptographic policy drift events and correlate them with the evolving benchmark requirements.

The Role of CIS Benchmarks in Harvest-Now-Decrypt-Later Mitigation

One of the most urgent drivers for quantum-ready CIS Benchmarks is the "harvest now, decrypt later" (HNDL) threat. Adversaries — including nation-state actors — are actively exfiltrating encrypted data packets, encrypted databases, and encrypted communications today. They cannot decrypt them with current classical computers, but they are storing them for future quantum decryption. This applies to any data with a long shelf life: national security secrets, intellectual property, financial records, healthcare data, and legal communications.

CIS Benchmarks in the 2026 timeframe will include specific controls to address HNDL risk. These controls will require:

• Inventory of all data encrypted with classical asymmetric algorithms
• Risk classification based on data sensitivity and shelf life
• Re-encryption of long-lived data using hybrid or PQC-only cryptographic schemes
• Validation that backup and archival systems support key rotation with PQC algorithms
• Logging and alerting when data is accessed by non-PQC-capable clients

Enterprises in regulated sectors such as financial services and healthcare will feel this pressure first, as regulators begin to incorporate HNDL risk into compliance frameworks like PCI DSS, HIPAA, and SOX.

Quantum-Safe Authentication and Access Control

CIS Benchmarks place heavy emphasis on authentication controls — password policies, multi-factor authentication, privileged access management (PAM), and identity federation. Quantum computing threatens these controls in two ways: through forged authentication tokens and through compromise of the PKI that underpins certificate-based authentication.

Password-Based Authentication Limitations

Grover's algorithm, when run on a quantum computer, can speed up brute-force search against symmetric cryptographic primitives. While AES-256 remains quantum-safe with reduced security margin (effectively dropping to 128-bit security), hashed password storage using PBKDF2, bcrypt, or Argon2 could see a quadratic speedup in preimage search. CIS Benchmarks that currently recommend specific password hashing algorithms and iteration counts will need to be revised to account for Grover's impact. The likely outcome is that benchmark requirements will increase minimum iterations by a factor of two to four and will recommend memory-hard hash functions as the baseline.

PKI and Certificate Authority Hardening

Enterprise public key infrastructure (PKI) — including Active Directory Certificate Services, internal CAs, and code-signing CAs — relies almost entirely on RSA or ECC. A quantum attacker who obtains a CA's private key could forge certificates for any domain or code publisher. Future CIS Benchmarks for Active Directory and PKI will require that internal CAs support PQC certificates (e.g., X.509v3 extensions for ML-DSA or SLH-DSA) and that the root CA keys use a quantum-resistant algorithm at a minimum security strength of 128 bits post-quantum.

Impact on Cloud and Container Security Benchmarks

Cloud service providers — AWS, Azure, and Google Cloud — have already announced or implemented PQC support for key management services and TLS termination. However, the CIS Benchmarks for cloud infrastructure (CIS AWS Foundations, CIS Azure Foundations, CIS GCP Foundations) currently lag in validating whether organizations have actually adopted these capabilities. The benchmarks today check for S3 bucket encryption using AES-256 with KMS, but they do not verify that the KMS key wrapping uses a quantum-resistant key encapsulation mechanism.

Container security benchmarks — CIS Docker Benchmark and CIS Kubernetes Benchmark — will face similar challenges. Container image signing (e.g., Sigstore/cosign) currently uses ECDSA signatures. The CIS Kubernetes Benchmark will need to validate that admission controllers enforce PQC-signed images and that the container runtime supports PQC TLS for registry communication. DevSecOps engineers will need to update their CI/CD pipelines to incorporate dual-signing of artifacts, and this will become a standard benchmark rule rather than an optional hardening recommendation.

Network Device and IoT Benchmarks

Network devices — routers, switches, firewalls, and load balancers — are among the hardest systems to retrofit for PQC because many run on embedded firmware with long lifecycles and limited cryptographic agility. The CIS Benchmark for Cisco IOS, for example, includes dozens of controls for SSH configuration, SNMPv3 security, IPsec VPNs, and HTTPS management access. All of these will need to be updated to support PQC key exchange and authentication.

IoT device benchmarks will be even more challenging. Many IoT devices ship with hard-coded ECC keys that cannot be rotated. The CIS IoT Benchmark will need to introduce a requirement for factory-provisioned PQC identity keys, or at minimum, a mechanism to accept over-the-air firmware updates signed with PQC algorithms. Given the limited compute resources on many IoT devices, this may require moving to lightweight PQC schemes such as SPHINCS+ for signature verification offloading, or NIST's recently selected Ascon family for lightweight authenticated encryption.

Mapping the Transition Roadmap

Enterprise teams often ask for a structured approach to this transition. The following process flow outlines the phased approach that aligns with both CIS Benchmark evolution and regulatory deadlines.

What CIS Benchmark Authors and Working Groups Are Doing

The Center for Internet Security (CIS) is actively working through its Community Defense Model and Benchmark development process to integrate quantum readiness. The CIS Controls v9, which is expected in the 2026–2027 timeframe, will almost certainly include a dedicated control family for cryptographic posture management and PQC migration. Early signals from CIS working groups suggest that the new controls will align closely with NIST SP 800-131A Rev. 2 and CNSA 2.0 requirements.

For system administrators and compliance officers who participate in CIS Benchmark development — and you should — this is the moment to advocate for three specific additions to your platform's benchmark:

• A cryptographic inventory control that requires automated discovery and classification of all cryptographic assets
• A PQC readiness scoring control that measures the percentage of systems supporting at least one NIST-approved PQC algorithm
• A hybrid configuration control that validates dual-signature and hybrid key exchange configurations

The Cost of Inaction

Delaying PQC readiness has concrete financial and compliance costs. Consider the following scenarios based on current industry benchmarks and regulatory guidance:

• Audit failure: If your next CIS Benchmark assessment reveals that critical systems still rely on RSA-2048 or ECDH for key exchange after the PQC transition window closes, you will receive failing scores on multiple safeguards. This could delay FedRAMP authorization, invalidate PCI DSS compliance, or trigger corrective action plans under SOX.
• Supply chain disqualification: Government agencies and large financial institutions are beginning to include PQC readiness as a vendor evaluation criterion. Government and defense contractors that cannot demonstrate PQC capabilities may lose contract eligibility.
• Data exposure liability: The SNDL threat creates a growing body of exfiltrated encrypted data that will become readable in the 2030s. Organizations with long-lived sensitive data face class-action exposure, regulatory fines, and reputational damage if that data is later decrypted.
• Emergency migration costs: Organizations that wait until the last regulatory deadline will face emergency migration costs that are 3 to 5 times higher than planned, phased migrations. The shortage of cryptographic engineers and PQC-literate compliance professionals will only worsen as demand accelerates.

Practical First Steps for System Administrators and CISOs

Rather than waiting for the next CIS Benchmark revision, enterprise teams can begin preparing today with practical, low-cost actions that will pay dividends regardless of the exact timeline:

1. Enable cryptographic audit logging everywhere. Ensure that all systems log their negotiated cipher suites, certificate chains, and key exchange mechanisms. This data is essential for future benchmark assessments and for demonstrating due diligence during audits.
2. Update your configuration management playbooks. If you use Ansible, Puppet, Chef, or the CIS Benchmarking Tool from CyberSilo, update your compliance profiles to include cryptographic inventory collection as a baseline check. Even if the rule is informational today, it will become a scoring control tomorrow.
3. Begin PQC testing in non-production environments. Most major operating systems and TLS libraries (OpenSSL 3.x, BoringSSL, LibreSSL) now include experimental PQC support. Stand up a few test systems, enable hybrid key exchange, and measure the performance impact. Document the results for your compliance team.
4. Engage with your PKI vendor. Ask your certificate authority vendor when they will support PQC certificate generation and issuance. Microsoft, DigiCert, Let's Encrypt, and others have published roadmaps. Ensure your procurement language includes PQC readiness requirements.
5. Update your risk register. Add quantum computing risk to your enterprise risk register. Even a placeholder entry with a 2027–2029 risk horizon raises visibility and prevents surprise findings during the next audit cycle.

Industry-Specific Considerations

Different industries face different quantum risk profiles, and CIS Benchmarks will need to reflect these differences in their Implementation Group assignments and sector-specific guidelines.

Financial Services

Banks, insurance companies, and fintech firms handle large volumes of long-lived sensitive data: transaction records, personally identifiable information (PII), credit histories, and investment strategies. The financial sector is also subject to stringent data retention requirements that often exceed 10 years. The SNDL risk is acute. CIS Benchmarks for financial services will likely require the highest readiness levels, with IG3 compliance expected by 2028.

Healthcare

Protected health information (PHI) under HIPAA has a retention period of six years or longer, depending on state regulations. Healthcare IoT devices — insulin pumps, MRI machines, patient monitors — often have 10+ year lifespans with minimal cryptographic agility. The CIS Healthcare Benchmark will need to address both data protection and device lifecycle management with PQC requirements that are feasible for constrained environments.

Government and Defense

The NSA's CNSA 2.0 suite sets the most aggressive timeline. National Security Systems must be fully compliant by 2030, with interim milestones starting in 2025. CIS Benchmarks for government systems will map directly to CNSA 2.0 controls, and any CIS Benchmarking Tool used in the public sector will need to include CNSA 2.0-specific validation rules by the end of 2025.

Energy and Utilities

Industrial control systems (ICS) and operational technology (OT) present unique challenges. These systems are typically built for 20+ year lifespans and use proprietary cryptographic implementations. The CIS Benchmark for ICS will need to introduce novel controls that validate the availability of PQC firmware updates and the ability to perform cryptographic key rotation without taking critical infrastructure offline.

Our Conclusion & Recommendation