Loading today’s stories
Security2 distinct publishers3 min readPublished
The Trusted Computing Group's baseline is PTP 1.07, with two readiness labels and a certification tier still to come. Until that lands, verification means reading a vendor's evidence packet.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
A TPM holds a machine's keys and records measurements of its firmware, so the platform can later prove it has not been altered [8]. That is why a single algorithm name was never a useful answer to a procurement question. Platform identities, attestation keys and firmware measurements are three different objects that have to survive the same transition, and TCG says they may need to remain secure for decades [11]. TCG president Joe Pennisi frames the requirement as looking "beyond individual algorithm support" to "the broader requirements for quantum-safe identities, attestation, and hardware-anchored trust" [9]. The failure mode TCG names is more specific than that: TPMs that advertise compliance while failing to provide full, end-to-end security capabilities [13].
The profile behind the new guidance was not drafted narrowly. Infosecurity Magazine reports that TCG brought together almost 90 contributors in March 2026, from government, academia, semiconductor companies and computing hardware providers including Intel, Google, Hewlett Packard Enterprise, Microsoft, NVIDIA, Lenovo and STMicroelectronics, to develop PTP 1.07 [12]. So the vendors a buyer will now ask for evidence are substantially the vendors who set the bar. That is normal for hardware standards, and it is also the case for the certification tier: an evidence request answered by the author of the requirement carries less weight than a result from a third party. About five months separated the drafting work from the guidance that tells buyers how to check against it [17].
Scale is what makes the interval matter. TPM 2.0 is part of the Windows 11 system requirements [c14a], so the chip in question is not specialist inventory, and refresh cycles will keep moving whether or not the certified tier exists. TCG's own advice points at the lifecycle rather than the purchase order: recognise the risk in platforms and TPMs that are not yet PQC-ready, plan for it, and work out where quantum-safe primitives are genuinely required and where transition planning is enough [20]. Read that way, the upgradable designation is worth only as much as the vendor's upgrade commitment, which is a contract term, not a chip property.
The sequencing is the part to hold onto. Designations arrived first; certification requirements for a TCG-certified PQC-ready TPM come only after TCG finishes enhancing its programs [7]. Hardware bought in between will be judged on evidence packets measured against a public document, which is a real improvement on an adjective and is not a test result [21]. The written baseline does not verify anything by itself. It just means that when a vendor says quantum-safe, there is now a specific document number the answer can be checked against, and a specific silence when the answer avoids it.
Ranked by verification strength, evidence, and original report placement.
The Trusted Computing Group has published requirements that spell out what a Trusted Platform Module has to do before anyone calls it quantum-safe, so buyers can ask a vendor for evidence against a written baseline and avoid TPMs that advertise compliance without full capability.
TCG released the new guidance on August 24, and it accompanies PTP 1.07 by helping businesses verify whether their TPMs meet the profile's requirements, according to Infosecurity Magazine.
TCG states the critical requirement for a PQC-ready TPM is implementation of the TCG PC Client Platform TPM Profile (PTP) 1.07, which is the baseline for a PQC-ready TPM.
PTP 1.07 defines the required PQC-specific elements from the recently published TPM 2.0 Library Specification Version 1.85, and defines TPM 2.0 implementations that support PQC algorithms.
PTP 1.07 outlines the minimum requirements for PQC-ready TPMs; vendors developing TPMs may choose to implement additional optional PQC algorithms in their designs.
TCG has defined two transition designations: a 'TCG PQC-ready TPM' implements PTP 1.07, and a 'TCG PQC-upgradable TPM' does not presently support PTP 1.07 but has the capability to be upgraded to that support.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Named documents, but a single originating announcement
The core facts are documentary and specific — PTP 1.07 as the stated baseline, two named designations, an announced certification plan — and both outlets report them consistently. Weakening the picture: both accounts trace to the same TCG announcement rather than independent inspection, no third-party test or certification result exists yet, the 90% roadmap statistic arrives without provenance, and the two reports cite incompatible TPM 2.0 version numbers.
Standard published and broadly co-authored; no verified parts
Real adoption signal exists on the standards side: almost 90 contributors including major silicon and platform vendors developed PTP 1.07, and TPM 2.0 is already a Windows 11 requirement, so the substrate is widely deployed. But nothing in the supplied sources names a shipping TPM designated PQC-ready or PQC-upgradable, no certification exists to count against, and no vendor has disclosed a compliant part, ship date or volume.
Modestly overstated: verification framing outruns the mechanism
The reporting frames this as a way to prove hardware is quantum-safe, and one headline calls it an industry benchmark, but the mechanism delivered is a document plus two self-descriptive labels: the certification that would make a claim third-party testable is only announced. PTP 1.07 is also explicitly a floor with optional algorithms left to vendors, so the label alone does not equalise two devices. The overstatement is moderate rather than severe because the underlying documents are real, dated and named, and both outlets do disclose that certification is still to come.
Member-vendor consortium defining the label its members will market
TCG is an industry consortium and the profile was developed with almost 90 contributors including Intel, Google, HPE, Microsoft, NVIDIA, Lenovo and STMicroelectronics — the same class of firms that will sell parts and platforms carrying the PQC-ready designation, and that stand to gain from an announced certification badge. The guidance is also framed against a market where existing TPMs are said to overclaim compliance, which supports replacement or upgrade. Both articles reproduce the announcement's framing without noting these interests; nothing in the sources shows fees, pricing or licence terms, so the reading rests on structure, not disclosed money.
Facts solid, interpretation and outcomes open
Documentary facts — release date, profile name, designations, certification plan, contributor list — are reported consistently and are unlikely to be wrong. Confidence is held to the middle because there is only one originating source behind two same-week trade reports, the TPM 2.0 version references conflict, the 90% figure is unattributed, and there is no adoption or certification data to test whether the designations will actually change purchasing.
build
TCG hands hardware buyers a version number: PC Client TPM Profile 1.071 distinct publisher
product
Washington's secret AI test is coming for open weights, and release dates go with it2 distinct publishers
invest
Nvidia's August 26 print: 92% of the quarter rides on one segment1 distinct publisher
build
Hugging Face's $13B process puts most teams' model pipeline under a single owner2 distinct publishers
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 24, 2026
1 article · August 24, 2026