The National Institute of Standards and Technology (NIST) on Oct. 27 finalized a road map for transitioning to post-quantum cryptography (PQC). In a new report, it outlines how agencies should replace vulnerable algorithms as their most sensitive systems face PQC migration deadlines beginning in 2030.
The report, Transition to Post-Quantum Cryptography Standards, supports existing requirements for federal high-value assets and high-impact systems to adopt quantum-resistant methods for establishing shared secret keys by Dec. 31, 2030, and for digital signatures by Dec. 31, 2031. Agencies must give the same priority to other systems holding highly sensitive data, including information expected to remain mission-sensitive in 2030.
The broader goal of completing the federal transition by 2035 remains in place. However, NIST makes clear that the longer transition window does not change the earlier deadlines for priority systems under Executive Order 14412 and Office of Management and Budget (OMB) Memorandum M-26-15.
OMB Memorandum M-26-15 does not apply to national security systems.
For agency technology leaders, the report connects those policy deadlines to decisions about cryptographic inventories, product upgrades, infrastructure dependencies, and systems that may need replacement.
“The report describes different use cases and says why one migration might take longer than another,” said Dustin Moody, a NIST mathematician who heads the PQC standardization project, in the agency’s announcement.
NIST outlines the algorithm transition
NIST plans to deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. Deprecation means an algorithm may still be used, but users must accept some security risk. Disallowance means it can no longer be used to apply cryptographic protection.
The schedule covers widely used public-key algorithms for digital signatures and key establishment. The report identifies the quantum-resistant standards that should replace them, building on the first three PQC standards NIST finalized in August 2024.
Those standards include a key-encapsulation mechanism for establishing shared secret keys and two digital signature algorithms. Digital signatures help verify the origin and integrity of software, documents, and other information.
The transition does not require replacing all cryptography. NIST says its approved symmetric cryptographic methods offering at least 128 bits of classical security are believed to meet at least the lowest of its five post-quantum security categories.
“We lay out how certain encryption algorithms people are using today will get phased out,” Moody said. “It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”
Agencies must account for long migration times
Although a quantum computer capable of breaking today’s vulnerable public-key cryptography has not yet been built, NIST warns that adversaries can collect encrypted information now and decrypt it when the technology becomes available. Data that must remain confidential for years therefore warrants an early transition.
NIST says past cryptographic transitions have taken 10 to 20 years from standardization to full integration into information systems. That process includes incorporating algorithms into commercial products, procuring those products, and integrating them into existing infrastructure.
“Organizations should treat the migration to PQC as a current operational priority, beginning with cryptographic inventories, migration planning, and early deployments of PQC-enabled products and services,” the report states.
The work extends across software libraries, cryptographic hardware, digital certificate infrastructure, applications, and network protocols. Because some devices cannot update the code used to verify software signatures after manufacturing, NIST notes that those devices must be designed to quantum-resistant signatures on the executable code if they are expected to remain in service for many years.
The report also discusses hybrid approaches that combine conventional and quantum-resistant algorithms. These hybrid solutions are designed to remain secure if at least one of the component algorithms is secure, but NIST notes that they should only be temporary due to implementation complexity, cost, and potential security risks.
GAO finds gaps in agency preparations
The NIST report follows a Government Accountability Office (GAO) report made public Oct. 6 that found none of the 24 Chief Financial Officers Act agencies had fully addressed all three practices it evaluated for preparing to transition to PQC.
Those practices covered inventories of vulnerable cryptography, assessments of transition funding needs, and testing PQC in agency environments. GAO attributed the gaps in part to shortages of cryptography expertise, inadequate inventory and funding processes, and missing testing plans. The public report reflects an audit underlying a sensitive report issued in September 2025.
NIST has been working with industry to expand PQC adoption. In September, NIST Director Arvind Raman described efforts to scale PQC across critical sectors, including collaboration with 60 companies through the agency’s National Cybersecurity Center of Excellence.
The new report complements the center’s Migration to PQC project, which is developing practical demonstrations and resources for identifying cryptography, prioritizing migration, and implementing the new PQC standards.