The standards milestone changes the question
In August 2024, NIST finalized FIPS 203 for ML-KEM key establishment, FIPS 204 for ML-DSA signatures and FIPS 205 for SLH-DSA signatures. The central organizational question is no longer which first-round algorithms NIST will choose. It is where vulnerable public-key cryptography exists, which data and signatures must remain trustworthy for how long, and how to move without breaking interoperability. NIST explicitly encourages administrators to begin transition work; waiting for a cryptographically relevant quantum computer would leave insufficient time for complex estates.
Quantum risk is unusual because exposure can precede the attack capability. An adversary can collect encrypted traffic now and attempt decryption later if the information retains value. Digital signatures present a different time dimension: long-lived firmware, software updates, identity credentials and archival records may need their authenticity protected well into the future. A migration plan should therefore distinguish confidentiality lifetime, signature trust lifetime and system replacement time rather than applying one generic deadline.
Build a cryptographic inventory that can drive decisions
A conventional asset inventory rarely identifies algorithms, key sizes, certificate chains, protocol versions, libraries or hardware roots of trust. Post-quantum preparation requires discovery at those layers. The US Office of Management and Budget directed federal agencies to prioritize inventories of cryptographic systems, focusing on high-impact systems and high-value assets. CISA, NSA and NIST similarly advise organizations to establish a quantum-readiness roadmap, inventory quantum-vulnerable systems, assess risk and engage suppliers.
The inventory should connect each cryptographic dependency to an owner, business function, data class, confidentiality or authenticity lifetime, upgrade route and vendor commitment. It should include embedded and operational technology, code-signing pipelines, backups, inter-service authentication, VPNs, public-key infrastructure, secrets management and third-party appliances. Discovery output is not complete until it supports a migration decision. A list of certificates without system context cannot tell a board which exposure to fund first.
Choose standards by function and security profile
ML-KEM is a key-encapsulation mechanism, not a signature scheme. ML-DSA and SLH-DSA provide signatures using different mathematical foundations and operational trade-offs. FIPS 203 defines three ML-KEM parameter sets. Higher security strength generally increases keys, ciphertexts or computational work, so selection should follow the threat model and protocol profile rather than a reflex to choose the largest option. Implementers also need validated libraries, randomness, side-channel resistance, key management and correct protocol composition.
Algorithm diversity is deliberate. NIST selected HQC in 2025 for future standardization as a backup key-establishment approach based on different mathematics, while FN-DSA remains under development as an additional signature standard. That does not mean every system should deploy every algorithm. It means architectures need cryptographic agility: the ability to change suites, parameters and certificate formats without redesigning the application. Agility must be exercised in tests; a configuration flag that has never survived a rotation is not evidence of readiness.
Treat migration as a protocol and supply-chain programme
Replacing a primitive inside a library is only one step. Larger keys and signatures can affect handshake sizes, packet fragmentation, constrained devices, certificate issuance, hardware security modules, logging and storage. Mixed estates require negotiated transitions, and hybrid constructions may combine classical and post-quantum mechanisms during an interim period. Those designs should follow standards-track protocol guidance and receive interoperability testing; inventing an unaudited hybrid can create new failure modes while appearing safer.
Supplier evidence should be specific. Ask which product versions implement which finalized FIPS, whether implementations are validated, how keys are generated and protected, which protocols expose the algorithms, and when dependent certificates or firmware chains will migrate. Contractual roadmaps should include end-of-support dates and rollback procedures. Organizations should maintain a test environment that exercises latency, message size, device constraints, observability and failure recovery across real application paths.
Prioritize by exposure window, not headlines
A practical priority score combines the time data must remain protected, the time required to migrate, the impact of compromise, external exposure and the replaceability of the system. Long-lived secrets carried over public networks rank differently from transient public data. Code-signing roots and device identities can be critical because compromise undermines trusted updates across an installed base. Systems with ten-year service lives may need action before frequently updated web services even when their current traffic volume is lower.
Draft NIST IR 8547 describes a proposed path to deprecate and ultimately remove quantum-vulnerable algorithms, with 112-bit security strength deprecated after 2030 and disallowed after 2035, and stronger quantum-vulnerable public-key algorithms disallowed after 2035. These dates are planning anchors for relevant US standards, not proof that a quantum computer arrives then. National-security guidance can require earlier transitions. Each organization should map applicable rules and its own exposure lifetimes to a funded schedule.
Measure readiness as an engineering state
Useful programme metrics include the percentage of critical systems with complete cryptographic inventories, the proportion with an approved target profile, supplier coverage, successful interoperability tests, mean time to rotate an algorithm, and residual exposure by data lifetime. Avoid vanity measures such as the number of systems scanned when scan coverage is unknown. Every reported percentage should define its denominator and confidence. Exceptions should have owners, compensating controls and expiry dates.
Quantum resource estimates explain urgency but not arrival time. A 2025 study reduced a modelled RSA-2048 attack to fewer than one million noisy qubits and less than a week under assumptions including 0.1% physical gate error and microsecond error-correction cycles. It is a conditional design estimate, not evidence of an existing machine. Security planning does not require a precise forecast. It requires recognizing that migration itself can take a decade, standards are available, and long-lived exposure is already accumulating.
Scope and limitations
Quantum-computer timelines remain uncertain, and resource estimates depend strongly on architecture, error rates and control assumptions. NIST IR 8547 is cited as an initial public draft, so its proposed dates may change. Organizations must also account for sector rules, national requirements, implementation validation and evolving protocol standards rather than treating this article as a compliance checklist.
References
Source review: 20 August 2026. Quantitative values retain their original definitions, periods, and boundaries.
- 01Announcing Approval of Three Federal Information Processing Standards for Post-Quantum Cryptography
National Institute of Standards and Technology · 2024
csrc.nist.gov ↗ - 02FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
National Institute of Standards and Technology · 2024
csrc.nist.gov ↗ - 03NIST IR 8547 Initial Public Draft: Transition to Post-Quantum Cryptography Standards
National Institute of Standards and Technology · 2024
csrc.nist.gov ↗ - 04M-23-02: Migrating to Post-Quantum Cryptography
US Office of Management and Budget · 2022
www.whitehouse.gov ↗ - 05Quantum-Readiness: Migration to Post-Quantum Cryptography
CISA, NSA and NIST · 2023
www.cisa.gov ↗ - 06Post-Quantum Cybersecurity Resources
National Security Agency · 2025
www.nsa.gov ↗ - 07How to factor 2048 bit RSA integers with less than a million noisy qubits
arXiv · 2025
arxiv.org ↗