No private company can face the monumental cybersecurity challenge alone. Now is the time for the public and private sectors to step up their collective efforts to improve nations’ cybersecurity for decades to come. The Charter of Trust is one of the key platforms to achieve this.
by Jonathan Sage, Cybersecurity Policy Europe, IBM
As our dependency on technology continues to grow so will the scale and sophistication of cybersecurity threats. For businesses, the intensification of cybercrime can be explained by Sutton’s law: that’s where the money is. The cost of cybercrime – already in the billions of dollars – rises each year and continues to increase in frequency, scope, and severity of impact.
While some attacks are costly and inconvenient, others can be crippling. With cybersecurity quickly becoming a new battleground for state competition, businesses and government share a collective responsibility to collaborate on preventing cyberattacks that could have a devastating impact or prompt national or global crises. We must join forces now to shore up the security of the critical infrastructure that keeps our society functioning.
As a leading enterprise security firm, IBM is uniquely positioned to help. Our teams use cloud and AI-powered software to manage 150 billion cybersecurity events each day for more than 17,000 commercial and government clients worldwide. Drawing on this breadth of expertise and capabilities, IBM is ready to do its part to help build enduring cybersecurity.
In a recent meeting with U.S. President Biden and members of his Cabinet, IBM’s Chief Executive, Arvind Krishna had in-depth discussions on how America’s digital defenses can be strengthened, making five key commitments that IBM is pledging to help address this imperative, which align well with IBM’s engagement as a founding member of the Charter of Trust:
1. Building a more robust and diverse cyber workforce
With nearly 500,000 unfilled cybersecurity jobs across the U.S. (Source: NIST), IBM is going to help prepare more American students and workers for those vital roles by training more than 150,000 people in cybersecurity skills over the next three years through a range of programs, such as SkillsBuild. Workforce issues, training and diversity are key elements in the Charter of Trust’s Principle 6, “Education”. We also will partner with more than 20 Historically Black Colleges & Universities to establish Cybersecurity Leadership Centers to build a more diverse U.S. cyber workforce.
2. Measuring progress and results
We need to go beyond cybersecurity commitments and focus on measuring tangible progress and results. Measurement tools already exists in Environmental, Social, and Governance (ESG) reporting. In line with Principle 1 of the Charter of Trust, “Ownership for cyber and IT security”, IBM is calling for the establishment of voluntary public reporting standards on cybersecurity practices. We believe the cyber framework developed by the National Institutes of Standards and Technology (NIST) could serve as a strong starting point for building such a reporting system.
3. Protecting critical infrastructure
Dealing with a cybersecurity crisis is a matter of when, not if. To help critical infrastructure organizations better prepare for and recover from ransomware attacks, we are announcing IBM Safeguarded Copy—a new data storage solution that can shorten the time it takes for organizations to recover from days to hours. IBM is already working with industries that operate critical infrastructure and will expand this offering to other clients.
4. Accelerating quantum-safe cryptography
While quantum computers will help solve new categories of problems that are beyond the reach of even today’s most powerful traditional computers, they will also make our current encryption methods obsolete. As we prepare for a quantum world, IBM is committed to developing and deploying new, quantum-safe encryption methods such as lattice-based cryptography.
5. Securing the Technology Supply Chain
Finally, IBM participates in an effort led by the National Institute of Standards and Technology (NIST) to develop a comprehensive framework to improve the security of the technology supply chain, reflecting the goal in Principle 2 of the Charter of Trust, “Responsibility throughout the digital supply chain”. This work builds on IBM’s engagement with NIST on software supply chain security following the U.S. President’s recent cybersecurity executive order, and it also will include a focus on open-source technology in which IBM has decades of expertise.
Protecting the digital economy: A concerted effort
As we have seen in just the past few months, cyberattacks can cause widescale disruption, economic upheaval, and even physical damage. If nothing is done, future attacks could become even more destructive and impact the power, transport, and communications systems we all depend upon to live and work.
IBM is already taking action on many fronts to protect the digital economy – from keeping our data secure, to helping cyber-defenders become as collaborative as cybercriminals, to inspiring a new generation to pursue careers in cyber, and more.
That said, no private company can face this monumental challenge alone. Now is the time for the public and private sectors to step up their collective efforts to improve nations’ cybersecurity for decades to come. The Charter of Trust is one of the key platforms to achieve this.
PREVIOUS POST
New Chairwoman for the Global External Engagement Group
NEXT POST
Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter
You may also like
Post-Quantum Cryptography
Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter
The transition to post-quantum cryptography is not a future problem — it is a present one. The threat of adversaries harvesting encrypted data today for decryption once quantum computing matures means that organizations with long-lived data and systems are already exposed. Waiting for cryptographically relevant quantum computers to arrive before acting is not a viable risk management strategy.
Exposure is not uniform across sectors. Financial services, government and defense, operational technology, and healthcare face the sharpest quantum risk, driven by decades-long data retention obligations, slow system replacement cycles, and the societal consequences of cryptographic failure. For these sectors, PQC readiness has moved from best practice to strategic imperative.
Globally, the direction of travel is clear. The United States, European Union, United Kingdom, Singapore, and Australia have each established structured PQC transition frameworks, with mandatory deadlines converging around the late 2020s and 2030. Organizations operating across jurisdictions should expect compounding compliance requirements and align migration plans accordingly.
At the same time, the geopolitical dimension of PQC standardization is becoming increasingly salient. The emergence of a “splinternet” infrastructure, characterized by regionally fragmented digital ecosystems, suggests that cryptographic standards diverge along political and strategic lines. As a result, organizations must not only manage technical migration but also navigate a politically charged landscape in which interoperability, regulatory alignment, and long-term cryptographic agility become critical strategic considerations.
This paper offers a comparative overview of regional PQC transition frameworks and identifies the business and systemic risks associated with quantum-vulnerable cryptography, providing insights for organizations preparing for the transition to post-quantum cryptography. Overall, PQC migration is a strategic transformation, not a technical patch. Cryptographic inventory, governance structures, crypto-agility, and supply chain engagement are as central to success as algorithm selection — and organizations that treat PQC readiness as an architectural and organizational challenge will be best positioned as quantum risks continue to mature.
Exposure is not uniform across sectors. Financial services, government and defense, operational technology, and healthcare face the sharpest quantum risk, driven by decades-long data retention obligations, slow system replacement cycles, and the societal consequences of cryptographic failure. For these sectors, PQC readiness has moved from best practice to strategic imperative.
Globally, the direction of travel is clear. The United States, European Union, United Kingdom, Singapore, and Australia have each established structured PQC transition frameworks, with mandatory deadlines converging around the late 2020s and 2030. Organizations operating across jurisdictions should expect compounding compliance requirements and align migration plans accordingly.
At the same time, the geopolitical dimension of PQC standardization is becoming increasingly salient. The emergence of a “splinternet” infrastructure, characterized by regionally fragmented digital ecosystems, suggests that cryptographic standards diverge along political and strategic lines. As a result, organizations must not only manage technical migration but also navigate a politically charged landscape in which interoperability, regulatory alignment, and long-term cryptographic agility become critical strategic considerations.
This paper offers a comparative overview of regional PQC transition frameworks and identifies the business and systemic risks associated with quantum-vulnerable cryptography, providing insights for organizations preparing for the transition to post-quantum cryptography. Overall, PQC migration is a strategic transformation, not a technical patch. Cryptographic inventory, governance structures, crypto-agility, and supply chain engagement are as central to success as algorithm selection — and organizations that treat PQC readiness as an architectural and organizational challenge will be best positioned as quantum risks continue to mature.
Read more
April 07, 2026
•
Post-Quantum Cryptography
A Quantum Leap for Cybersecurity: The Charter of Trust’s PQC Ambition
The Charter of Trust is taking decisive steps to secure our digital future in the quantum era. As quantum computing advances, the risks to today’s cryptographic systems grow ever more urgent. Our dedicated working group is leading the way in raising awareness, promoting standards-based migration, and fostering collaboration across industries, governments, and academia. Together, we are committed to a proactive, well-coordinated, and risk-driven transition to post-quantum cryptography—ensuring digital trust and resilience for generations to come. Discover our vision and join us as we shape a secure digital world for the quantum age.
Read more
November 03, 2026
•
Artificial Intelligence
Read the Charter's contribution to the European Commission's public consultation on the Digital Omnibus Package
The rapid expansion of EU digital regulation has strengthened security, privacy, and trust, but it has also created overlapping obligations, inconsistent timelines, and administrative complexity. The Digital Omnibus Package provides a timely opportunity to streamline these rules, ensure greater coherence, and enable businesses to focus resources on resilience and innovation rather than redundant compliance tasks.
The Charter of Trust welcomes the Commission’s initiative to harmonize digital regulations across the EU, aiming to reduce administrative burdens while maintaining high standards of security and privacy. Representing the unified views of its Partners, this paper addresses all key legislation within the scope of the Digital Omnibus and offers comprehensive recommendations. It emphasizes the need for a unified incident reporting system, risk-based notification requirements, and fair compliance processes to minimize regulatory overlap. The Charter calls for clearer liability clauses, global recognition of certifications, and stronger supply chain security.
In data regulation, the Charter advocates ensuring alignment between the rules on data intermediation services under the DGA and B2B data sharing under the Data Act and extending exemptions to mid-cap companies, all while safeguarding trade secrets. For artificial intelligence, the paper recommends a phased approach to new requirements, integrated conformity assessments, harmonized compliance templates, and clear definitions, supported by sector-specific guidance and transparent AI categorization. The Charter also encourages the European Commission to ensure that ePrivacy reform is future-proof, fosters innovation, and reflects the needs of both businesses and consumers. Finally, it recommends robust security standards and cross-border recognition for the EU Business Wallet, with industry involvement in technical standards and integration with data access systems.
Collectively, these measures are designed to foster innovation, resilience, and trust in the EU’s digital landscape, allowing businesses to thrive in a coherent and future-ready regulatory environment.
The Charter of Trust welcomes the Commission’s initiative to harmonize digital regulations across the EU, aiming to reduce administrative burdens while maintaining high standards of security and privacy. Representing the unified views of its Partners, this paper addresses all key legislation within the scope of the Digital Omnibus and offers comprehensive recommendations. It emphasizes the need for a unified incident reporting system, risk-based notification requirements, and fair compliance processes to minimize regulatory overlap. The Charter calls for clearer liability clauses, global recognition of certifications, and stronger supply chain security.
In data regulation, the Charter advocates ensuring alignment between the rules on data intermediation services under the DGA and B2B data sharing under the Data Act and extending exemptions to mid-cap companies, all while safeguarding trade secrets. For artificial intelligence, the paper recommends a phased approach to new requirements, integrated conformity assessments, harmonized compliance templates, and clear definitions, supported by sector-specific guidance and transparent AI categorization. The Charter also encourages the European Commission to ensure that ePrivacy reform is future-proof, fosters innovation, and reflects the needs of both businesses and consumers. Finally, it recommends robust security standards and cross-border recognition for the EU Business Wallet, with industry involvement in technical standards and integration with data access systems.
Collectively, these measures are designed to foster innovation, resilience, and trust in the EU’s digital landscape, allowing businesses to thrive in a coherent and future-ready regulatory environment.
Read more
October 14, 2025
•
