| RTS Art. 6(2) — Encryption policy: data in transit |
The encryption and cryptographic controls policy must provide for encryption of data at rest and in transit, and encryption of internal network connections and traffic with external parties, based on data classification and ICT risk assessment. |
NQX operationalizes the data-in-transit and network-connection encryption requirements. It offers transparent L2/L3 encryption of internal links (data center interconnects, site-to-site, campus/branch) and of traffic crossing external, public or third-party networks. The solution does not require changes to applications or surrounding infrastructure. |
| RTS Art. 6(4) — Crypto-agility |
The policy must include provisions for updating or changing, where necessary, the cryptographic technology on the basis of developments in cryptanalysis. |
This is NQX’s core design principle. Quantum computing is the most significant foreseeable development in cryptanalysis: NQX already supports post-quantum key encapsulation (ML-KEM / FIPS 203, FrodoKEM) in hybrid mode alongside classical algorithms, and its software-based crypto engine adopts new or updated algorithms without hardware changes. |
| RTS Art. 6(3) — Selection of cryptographic techniques |
Where encryption is applied, entities must select cryptographic techniques considering leading practices and recognized standards. |
NQX builds on recognized standards: IPsec/IKEv2, X.509 PKI, NIST P-521 and DH groups for classical exchange, and NIST-standardized ML-KEM (FIPS 203) for post-quantum key encapsulation. NQX cryptography is NCSA-FI certified for national Confidential-level use.
|
| RTS Art. 7(1)–(3) — Cryptographic key lifecycle |
Keys must be managed through their whole lifecycle (generation, renewal, storage, backup, retirement, revocation, destruction), protected against loss, unauthorized access and modification, and replaceable if compromised. |
Built-in key management automates generation, rotation and renewal of keys across all tunnels, maintaining forward security with uninterrupted service. Automated renewal and replacement mechanisms remove reliance on manual key handling which is a common audit finding. |
| RTS Art. 7(4)–(5) — Certificate register and renewal |
Entities must maintain an up-to-date register of certificates and certificate-storing devices for ICT assets supporting critical or important functions, and renew certificates before expiry. |
NQX central management provides lifecycle management of node certificates, PSK-ID management for tunnels, and inventory management of nodes, configurations and software releases . This gives compliance teams a maintained register of the encryption estate. |
| RTS Art. 12 — Logging |
Entities must log relevant events to support detection, investigation and audit. |
NQX nodes and tunnels produce health, status and event data designed to support operations, troubleshooting and audit requirements, available through the central management interface. |
| RTS Art. 13(a), (j) — Segmentation and isolation |
Network security policy must cover segregation and segmentation of ICT systems and networks, and the ability to temporarily isolate subnetworks and network components. |
Discrete encrypted tunnels cryptographically segment traffic between sites and enclaves. Rule-based forwarding provides granular flow control. Fail-safe emergency purge instantly isolates links or disables an appliance. |
| RTS Art. 13(c) — Secure administration |
Network security policy must cover the use of a separate and dedicated network for the administration of ICT assets. |
NQX management supports console, LAN and inband management channels. Inband management itself uses quantum-resilient authentication keys, and administration is governed by role- and domain-based user policies. |
| RTS Art. 13(e) — Encryption of network connections |
Network connections passing over corporate networks, public networks, domestic networks, third-party networks and wireless networks must be encrypted, based on data classification and ICT risk assessment. |
This is NQX’s primary function: encrypting network connections across any transport (corporate backbones, public internet, carrier and third-party networks) with quantum-resilient cryptography, at line rate, for both Ethernet and IP traffic. |
| RTS Art. 13(k) — Secure configuration baseline |
Entities must implement a secure configuration baseline of network components and harden them against unauthorized changes. |
Pre-configured nodes, deployment wizards and predefined configurations enforce a consistent baseline whrere configuration revision management tracks changes, Secure Boot verifies firmware and software integrity, and Remote Attestation secures and controls the appliance lifecycle. |
| RTS Art. 14 — Securing information in transit |
Entities must ensure the availability, authenticity, integrity and confidentiality of data during network transmission, and the secure transfer of information with external parties. |
NQX provides authenticated, integrity-protected, confidential transport: peers are mutually authenticated (certificates, PSK, PPK), payloads are protected with authenticated encryption (AES-256-GCM), and resilience features (HA, DDoS resiliency, automated key renewal) keep protected links available. |
