The post-quantum migration guide.

The threat

Almost all public-key cryptography in use today relies on two math problems: factoring large numbers (RSA) and discrete logarithms (Diffie-Hellman and elliptic-curve schemes such as ECDSA and ECDH). A large, fault-tolerant quantum computer running Shor’s algorithm could solve both efficiently.

Symmetric cryptography holds up much better. Grover’s algorithm offers at most a quadratic speed-up, so AES-256 and SHA-384 remain strong. The urgent problem is key exchange and digital signatures.

The new standards

In August 2024 NIST published its first three post-quantum standards:

• FIPS 203, ML-KEM: key encapsulation, replacing RSA and ECDH key exchange.
• FIPS 204, ML-DSA: general-purpose digital signatures.
• FIPS 205, SLH-DSA: hash-based signatures with conservative security assumptions.

NIST also selected HQC in 2025 as a backup key-encapsulation algorithm based on different math, and stateful hash-based signatures (LMS and XMSS, specified in NIST SP 800-208) are already approved for firmware and software signing.

For most systems today, the recommended first step is hybrid key exchange, which combines a classical algorithm with ML-KEM. The widely deployed TLS option is X25519MLKEM768.

US federal deadlines

In June 2026 the federal government moved from guidance to dates. The key milestones:

• Executive Order 14412 (June 22, 2026): federal high-value assets and high-impact systems must use post-quantum key establishment by December 31, 2030 and post-quantum digital signatures by December 31, 2031. It directs the FAR Council to propose rules extending PQC requirements to federal contractors, and CISA and NIST to publish CBOM guidance.
• OMB M-26-15 (June 24, 2026): a five-phase migration plan for civilian agencies running to 2035, with migration plans due October 22, 2026 and a requirement for automated, continuously updated cryptographic inventories.
• TLS 1.3 by January 2, 2030: carried forward from EO 14144 as amended by EO 14306.
• CNSA 2.0 (NSA): national security systems move to ML-KEM-1024 and ML-DSA-87, with new acquisitions required to comply from 2027 and exclusive use required between 2030 and 2033 depending on system type.
• NIST IR 8547: quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed after 2035.
• FIPS 140-3: remaining FIPS 140-2 validations moved to historical status in September 2026, so new federal purchases need FIPS 140-3 validated modules.

Private-sector rules are catching up through procurement and existing frameworks: CMMC for defense contractors, HIPAA for health data, PCI DSS 4.0 for card payments, and quantum-risk guidance from the OCC, the Federal Reserve and FINRA. See the full list on our federal PQC mandates page.

A six-step plan

1. Appoint an owner. Give one person budget and authority for the transition.
2. Build your CBOM. Inventory algorithms, keys, certificates and protocols across code, infrastructure and vendors.
3. Classify by risk. Rank assets by data sensitivity, shelf life and how hard they are to change.
4. Engage suppliers. Ask every critical vendor for its post-quantum roadmap and add requirements to contracts.
5. Pilot hybrid. Migrate one representative service end to end and measure the impact.
6. Roll out and repeat. Migrate in waves, re-scan to verify, and build crypto-agility so the next change is easier.

Common pitfalls

• Treating it as a library upgrade. Larger keys and signatures affect packet sizes, certificate chains, storage and embedded devices.
• Starting with easy systems. Quick wins feel like progress, but the highest-risk data may be left exposed longest.
• Ignoring third parties. Much of your cryptography sits inside products you buy. Their roadmaps set your pace.
• One-time inventories. A CBOM that isn’t maintained is out of date within months.

Want help applying this to your estate? Book a scoping call or run a free scan.