NIST Finalizes Its Post-Quantum Road Map. Privacy Teams Hold the Map It Needs

The National Institute of Standards and Technology has finalized its road map for moving the United States off encryption that a future quantum computer could break. The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), names the current algorithms that are vulnerable, the quantum-resistant standards that replace them and the timelines federal agencies are expected to meet.

For privacy and compliance teams, the most important line is not about mathematics. It is NIST’s reminder that an organization’s readiness depends “not only” on its own systems “but also its entire cryptographic supply chain.” That turns a cryptography project into a vendor, inventory and data retention project, which is work privacy teams already know how to do.

What NIST published

In August 2024, NIST released its first post-quantum cryptography (PQC) standards, including FIPS 203 for key establishment. The new report is the companion plan. According to NIST’s announcement, it:

• identifies the quantum-vulnerable algorithms in NIST’s existing standards;
• maps each to the post-quantum standards designed to replace it;
• sets out timelines and migration activities for federal agencies; and
• describes the factors organizations should weigh, including the hybrid option of running classical and post-quantum algorithms together.

“We lay out how certain encryption algorithms people are using today will get phased out,” said Dustin Moody, the NIST mathematician who leads the PQC standardization project. “It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk.”

The dates that matter

National Security Memorandum 10 set 2035 as the main target for completing the migration across federal systems. Executive Order 14412 moved faster for the most sensitive systems, requiring federal high-value assets and high-impact systems to migrate by 2030 for key establishment and by 2031 for digital signatures. NIST says its report supports those timelines.

The memorandum and the order apply to federal systems. In practice they reach much further, because contractors, cloud providers, software vendors and any company that exchanges encrypted data with federal agencies will have to support the new algorithms on the same schedule. Banks and payment networks are already planning on that basis, as shown by the Treasury’s quantum-readiness task force and international work on a coordinated path for global finance.

Why privacy teams should care now

No cryptanalytically relevant quantum computer exists today. The urgency comes from what NIST and others call “harvest now, decrypt later”: an adversary can capture encrypted data today and store it until a quantum computer can read it. Data that must stay confidential for ten or twenty years is already at risk if it travels or rests under quantum-vulnerable encryption.

That makes retention a cryptography question. Health records, financial histories, biometric templates, government identifiers and trade secrets all have long confidentiality lives. Moody suggested that organizations “might prioritize migrating to the PQC key establishment standard (FIPS 203) for data that is particularly sensitive or needs to be kept secure for a long time.” Privacy teams usually know which data that is, because they classify it for other laws.

Encryption also sits inside legal duties. The GDPR names encryption as an example of an appropriate security measure, and many U.S. breach notification laws give relief when stolen data was encrypted. Our guide to GDPR encryption explains how regulators view it. If that encryption becomes breakable, the protection it offered in a breach analysis weakens too.

A five-step starting plan

1. Build a cryptographic inventory. List where encryption and digital signatures are used: TLS endpoints, VPNs, databases, backups, code signing, identity systems and third-party APIs. Record the algorithm and key size for each.
2. Rank data by confidentiality lifetime. Combine the inventory with your data map. Systems holding data that must stay secret past 2030 go first.
3. Ask vendors for their PQC road maps. Add questions to security reviews and contracts: which NIST standards they will support, when, and whether they offer hybrid modes.
4. Plan for crypto agility. Systems that can swap algorithms through configuration will migrate faster and cheaper than those with hard-coded choices.
5. Revisit retention. The cheapest data to protect from future decryption is data you have already deleted.

NIST’s National Cybersecurity Center of Excellence runs a separate project on migration to PQC, with demonstrations of cryptographic discovery tools and risk management practices. “The new report can help you understand the standards and requirements of the migration,” Moody said, “while the NCCoE project can show you the practical tools and blueprints to get the job done.”

What is new compared with the draft

NIST first released NIST IR 8547 as a draft in November 2024, and we covered it in our guide to post-quantum cryptography for privacy teams and in an earlier news report. The draft proposed deprecating quantum-vulnerable algorithms at the 112-bit security level after 2030 and disallowing them after 2035. The final report now sits alongside Executive Order 14412’s 2030 and 2031 deadlines for high-value federal systems. Teams that planned against the draft should compare its algorithm tables with the final version before updating their road maps.

How Captain Compliance can help

Captain Compliance does not perform cryptographic scanning or migration. Where we help is the data side of the plan. Our data mapping and records of processing tools record which systems hold which categories of personal data, which vendors receive it and how long it is kept. Our data security resources and vendor assessments help teams add PQC questions to supplier reviews and keep the answers. That map is what turns “migrate everything” into a ranked list.

Frequently asked questions

What is NIST IR 8547?

NIST’s report Transition to Post-Quantum Cryptography Standards. It identifies quantum-vulnerable algorithms, their replacements and federal migration timelines.

Do the deadlines apply to private companies?

Not directly. They apply to federal systems, but suppliers and partners of federal agencies will be affected, and many industries are adopting similar targets.

What are the key federal dates?

National Security Memorandum 10 targets 2035 for the full federal migration. Executive Order 14412 requires high-value assets and high-impact systems to migrate by 2030 for key establishment and 2031 for digital signatures.

What does “harvest now, decrypt later” mean?

Attackers collect encrypted data today and keep it until a quantum computer can decrypt it. Data with a long confidentiality life is at risk now.

What is a hybrid approach?

Combining a classical algorithm with a post-quantum one, so that both would have to be broken. NIST accommodates it, though it uses more computing resources.

The inventory question

Every quantum migration plan begins with the same request: show me where your encryption is and what it protects. Most organizations cannot answer it today. The ones that can will spend the next five years upgrading. The others will spend the first two years finding out what they have.