NIST sets PQC migration roadmap with 2030, 2031 and 2035 federal targets

NIST has issued final guidance for moving from quantum-vulnerable cryptography to PQC, with phased federal deadlines and supply-chain planning advice.

NIST has published a final roadmap for replacing public-key cryptography that could be broken by a future large-scale quantum computer with post-quantum alternatives. The document, NIST IR 8547, gives federal agencies and their suppliers a planning framework for the transition and aligns that process with deadlines already set in U.S. policy: 2035 for most federal systems, with earlier milestones for the most sensitive systems.

What was announced

The report, Transition to Post-Quantum Cryptography Standards (NISTIR 8547), was finalized on October 27, 2026, according to NIST’s Computer Security Resource Center. NIST says the report identifies current quantum-vulnerable cryptographic standards, maps them to quantum-resistant replacements, and is intended to help federal agencies, industry and standards bodies coordinate the migration.

The guidance follows NIST’s August 2024 release of its first three finalized post-quantum encryption standards. NIST is positioning IR 8547 as the main high-level transition document for moving from legacy algorithms to those newer standards.

According to the announcement cited by The Quantum Insider, the report is meant to address a practical problem: organizations will not all migrate in the same way or on the same timetable, but they still need common milestones and a shared view of what will be phased out.

The deadlines and policy context

The roadmap supports two layers of federal timelines. The broad target remains 2035 for completing migration across federal systems, a date the news report says was established by National Security Memorandum 10.

A June 22, 2026 executive order, Executive Order 14412, set earlier deadlines for high-value assets and high-impact systems. Under that order, agencies must transition those systems to post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.

NIST’s CSRC page says IR 8547 also supports implementation of Executive Order 14412 and OMB Memorandum M-26-15, which direct agencies to prioritize their most sensitive systems.

The technical and operational guidance

NIST says the report covers both post-quantum digital signatures and key-establishment schemes. The news report highlights one specific priority area: because of the “harvest now, decrypt later” risk, organizations may want to move sensitive long-lifetime data first to the PQC key-establishment standard FIPS 203.

The guidance also urges organizations to look beyond their own networks and applications. NIST stresses that migration depends on the full cryptographic supply chain, including products and services acquired from outside vendors.

Another option described in the report is a hybrid deployment model, combining conventional cryptography with PQC. According to the announcement, NIST presents that as a more conservative security posture, though one that requires additional computing resources.

Why it matters

The report is significant less because it introduces a new algorithm than because it turns PQC adoption into a schedule-driven modernization program. For government contractors and private-sector operators tied to federal systems, the practical message is that cryptographic inventories, vendor dependencies and system upgrade cycles now need to be mapped against explicit dates.

It also reinforces that the quantum threat is being treated as present-tense from a data-protection perspective. Even before a cryptanalytically relevant quantum computer exists, adversaries can collect encrypted data today and attempt to decrypt it later.

What to watch

One near-term issue will be how quickly agencies and suppliers can identify where vulnerable cryptography is embedded in products, firmware and long-lived infrastructure. Another will be adoption of implementation blueprints coming from NIST’s National Cybersecurity Center of Excellence, which NIST says is running a separate migration project focused on cryptographic visibility, risk management and practical PQC deployments.

As Dustin Moody, who heads NIST’s PQC standardization project, put it: “We understand there’s not one strategy that fits all use cases.”