Which standard satisfies which obligation

Obligations and standards are not the same thing. A regulation or contract tells you an outcome ("use phishing-resistant MFA," "migrate to post-quantum cryptography"); a standard tells you the concrete algorithm, protocol, or policy that meets it. This is the cross-reference between the two, so an auditor's question maps to a document you can point at.

Post-quantum migration

• Obligation: use post-quantum algorithms. → NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) define the approved algorithms.
• Obligation: national-security systems go quantum-safe on schedule. → NSA CNSA 2.0 sets the algorithm suite and its own exclusive-use timeline (software/firmware signing by 2030, general NSS by 2033).
• Obligation (US federal): inventory and prioritize cryptographic systems. → OMB M-23-02 and NSM-10 mandate it; NIST IR 8547 describes the transition; CISA guidance describes the how.
• Obligation: carry PQC in real protocols. → IETF RFCs/drafts (hybrid TLS 1.3, IKEv2, X.509 via LAMPS).

Authentication and identity

• Obligation: modern password policy. → NIST SP 800-63B (8-char minimum, 15+ recommended, screening, no forced rotation or composition rules).
• Obligation: phishing-resistant MFA (e.g. US federal zero trust under OMB M-22-09). → FIDO2/WebAuthn (W3C + FIDO Alliance) or PKI/PIV-based authenticators.
• Obligation: assurance-level-appropriate authenticators. → SP 800-63B authenticator assurance levels (AAL1–3).

Validated cryptography

• Obligation: use validated cryptographic modules (common in federal and regulated contexts). → FIPS 140-3 module validation, which now covers implementations of the PQC algorithms as they are added to the approved list.
• Obligation: general security-controls framework (SOC 2, ISO/IEC 27001). → map crypto controls to NIST SP 800-53 / ISO/IEC 27001 Annex A, citing the specific algorithm standards above as evidence.