NIST releases post-quantum cryptography transition road map

The National Institute of Standards and Technology released a report on Tuesday 27 October 2026 to help organizations transition to post-quantum cryptography standards. The report, Transition to Post-Quantum Cryptography Standards, is identified as NISTIR 8547.

According to NIST, the report identified quantum-vulnerable cryptographic standards and quantum-resistant standards designed to replace them. It described migration activities and timelines for federal agencies. It also provided guidance for technology providers and organizations developing quantum-readiness road maps.

NIST released its post-quantum cryptography standards in August 2024. The standards were intended to withstand attacks by future quantum computers. National Security Memorandum 10 established 2035 as the primary target for completing the migration across federal systems.

Executive Order 14412 accelerated the timeline. It required federal high-value assets and high-impact systems to migrate by 2030 for key establishment and by 2031 for digital signatures. Many organizations that work with the federal government were also affected by the transition.

NIST said the report set out how certain encryption algorithms in use would be phased out. It also described factors organizations needed to consider, including system components and their cryptographic supply chains. NIST mathematician Dustin Moody said organizations could prioritize particularly sensitive data or data that needed to remain secure for a long time.

The report discussed migration to the PQC key establishment standard, identified as FIPS 203, and the option of combining conventional encryption with PQC. It also complemented a National Cybersecurity Center of Excellence project focused on cryptographic visibility, risk management, cryptographic agility and demonstrations of PQC implementations.