up:: Doing the Work MOC
PQC for Pharma and Biotech
A pharmaceutical or biotech company holds the clearest example of the harvest-now-decrypt-later problem that exists in the private sector, and it is not patient data. It is the pipeline: molecules, formulations, process chemistry, manufacturing parameters and the clinical evidence built around them. That material has a value horizon measured against patent life and product life rather than against a breach-notification window, and unlike a credential it cannot be rotated once it is out.
This note is general education about regulation and market practice, not legal or regulatory-affairs advice.
The short version:
- The exposure is development data and process IP, whose value survives decryption delay by design.
- 21 CFR Part 11, the rule governing electronic records and signatures in this sector, was published in 1997 and is technology-neutral about cryptography.
- So the compliance framework will not tell a sponsor when its cryptography has aged, and nothing else in the stack will either.
- The estate is unusually partner-shaped: CROs, CDMOs, academic collaborators and regulators all hold copies.
- The first move is deciding which datasets have a confidentiality horizon longer than the cryptography protecting them, which in this sector is most of them.
Why is the shelf life so long here?
Because the asset is knowledge about a molecule, and knowledge does not expire on a schedule. A compound entering discovery today may reach approval more than a decade later and remain commercially meaningful for a decade after that, so a file captured now describes something that still matters in the 2040s. The shelf-life question is the general form; this sector is where it produces the least ambiguous answer.
Three categories carry the horizon:
- Pre-publication research and process chemistry. The manufacturing route is frequently more valuable than the molecule, is rarely disclosed in a patent, and is protected as a trade secret indefinitely.
- Clinical trial data. Subject-level records carry both commercial and personal sensitivity, and regulatory retention obligations keep them long after the trial closes.
- Regulatory submission dossiers. Assembled over years, exchanged with agencies, and holding the complete evidentiary picture in one place.
Applying Mosca’s theorem to a discovery pipeline produces an uncomfortable result for the same reason it does in insurance: the shelf-life term is long enough to dominate everything else in the inequality.
What does the governing rule say about cryptography?
Very little, and that is the point worth understanding rather than complaining about. 21 CFR Part 11 governs electronic records and electronic signatures for FDA-regulated activities. It sets requirements for validation, audit trails, record retention, and the binding of signatures to records, and it is deliberately technology-neutral. It was published in 1997.
Source: 21 CFR Part 11, eCFR.
⚠️ A technology-neutral rule from 1997 will not tell a sponsor that its algorithms have aged. That is a correct design choice for a rule meant to survive decades of technology change, and it means the cryptographic decision sits entirely with the company. Compare that with the sectors where the obligation moves on its own: the FTC Safeguards Rule defines encryption as “consistent with current cryptographic standards,” and Regulation SCI grants its safe harbor for consistency with “current SCI industry standards.” Pharma has no equivalent lever pulling it forward.
Where the signature question gets interesting is that Part 11 signatures are meant to be enduringly attributable. A signature whose underlying algorithm is later broken raises a question about long-term evidentiary weight that the rule does not address, which is the same structural issue non-repudiation runs into once the algorithm behind a signature has been broken.
Where does the cryptography actually live?
| Surface | Typical zone | Note |
|---|---|---|
| ELN, LIMS and research data platforms | Zone 2 | Vendor platforms holding the highest-value material |
| Clinical trial management and EDC systems | Zone 2 | Sponsor-selected, subject-level data, long retention |
| CRO and CDMO exchange | Zone 3 | ⭐ Copies of the pipeline inside partners’ estates |
| Regulatory submission gateways | Zone 2 | Agency-defined channels |
| Manufacturing execution and plant OT | Zone 1 and 2 | Process parameters, and equipment on industrial lifecycles |
| Archives and legal holds | Zone 1 | The oldest cryptography protecting data whose value has not decayed |
⭐ The partner row is the structural feature of this sector. Drug development is outsourced by design, so the pipeline exists in multiple organizations simultaneously and the weakest cryptographic posture among them is the effective one. That makes the contract the instrument, as it is everywhere the estate is somebody else’s.
What about European operations?
A sponsor operating in the EU carries obligations US-only guidance does not describe, including GDPR for subject data and, for many organizations, NIS2 as transposed by each member state. Neither names post-quantum algorithms, and both operate on a risk-appropriateness standard that a documented cryptographic inventory answers well. Treat the EU footprint as a reason the inventory has to be complete rather than as a separate program.
Common misconceptions
“Our concern is patient privacy.” Subject data matters and it is not the largest exposure. The process chemistry is.
“Patents protect the molecule, so disclosure is survivable.” A patent discloses a claim and protects it for a term. It does not disclose the manufacturing route, and it does not protect anything a competitor learns and never admits to knowing.
“Part 11 compliance covers our cryptography.” Part 11 is technology-neutral by design and dates from 1997. It sets no algorithm expectation to satisfy.
“Trial data is de-identified.” Re-identification risk aside, the commercial content of a trial dataset is unaffected by de-identification.
“Our CRO is contractually obligated to protect it.” Obligation and capability are separate questions, and the second is what the vendor-claims checklist asks about.
Questions people ask
What should a sponsor inventory first? The research data platform and the CRO exchange path, in that order. The first holds the crown jewels and the second is where copies leave the building.
How do we raise this with a CRO? As a diligence question at renewal, using the same questionnaire that already covers their security posture. Procurement language turns their answer into a term.
Does this change how we archive? It changes what an archive means. Long-term archives hold the cryptography chosen when they were written, so an archive strategy that never revisits protection is a decision to accept the algorithms of that year forever. Key management is usually the binding constraint on fixing it.
Is there a deadline? No sector-specific one. The deadlines that reach a sponsor first are a cloud provider’s migration schedule and a partner’s platform roadmap.
What about quantum computing as a research tool? A genuinely different subject with a different timeline, and worth keeping separate. Quantum chemistry as a discovery method and quantum computing as a threat to confidentiality get conflated constantly, and the conflation is how the risk conversation gets postponed.
Who should own this? Security owns the inventory, and in this sector R&D leadership has a real stake, because the assets in question are theirs and the retention decisions are theirs.
Everything here is the map, given freely. When a sponsor needs its research platforms and partner exchange paths inventoried against the actual shelf life of what moves through them, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.