NIST finalizes post-quantum cryptography transition roadmap

NIST’s final post-quantum cryptography transition report gives migration planners a framework for assessing cryptographic uses, supplier dependencies and applicable federal milestones.

Source published: 2026-10-27

Audience / jurisdiction: United States; primarily federal agencies and supporting suppliers, with wider voluntary planning relevance

What changed: a final framework for migration

The US National Institute of Standards and Technology published its final NIST IR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026. The report provides a framework for moving from quantum-vulnerable cryptography to quantum-resistant alternatives. For management-system practitioners, the development is a migration-planning reference, not a new ISO certification requirement.

This is a transition roadmap, rather than the launch of the original post-quantum cryptographic algorithms. NIST’s announcement explains that the underlying standards were released in August 2024. The report identifies vulnerable cryptographic standards, their replacements and considerations for moving between them. Its introduction identifies FIPS 203, FIPS 204 and FIPS 205 as foundations for that transition.

Sources: [1], [2]

Who should assess the report

The report’s primary policy context is the United States federal government. Federal agencies planning cryptographic migration are a central audience, alongside technology suppliers, infrastructure operators, industry partners and standards organizations supporting that work. NIST also identifies broader use by organizations developing their own quantum-readiness plans.

Its scope covers both key establishment and digital signatures. Migration considerations extend beyond individual cryptographic components to applications, supporting infrastructure and cryptographic supply chains. That makes the report relevant to teams coordinating technology ownership and supplier relationships, as well as specialists selecting cryptographic implementations.

For organizations outside the federal context, the report can inform planning without automatically creating a compliance obligation. Applicability should be assessed against the organization’s actual legal, policy and contractual commitments.

Sources: [1], [2]

Keep publication and federal milestones separate

October 27, 2026 is the publication date, not a universal migration deadline. NIST IR 8547 is a final NIST Internal Report, not an ISO standard. Its publication should therefore be distinguished from the dates attached to particular federal policy obligations.

The report states that cited federal policy instruments require the government’s most sensitive systems to adopt post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. These are federal milestones reported by NIST; they are not blanket deadlines for every private organization.

The confirmed development is the final transition framework. The report does not mean that every organization has the same migration path or timetable. NIST emphasizes differences between use cases and dependencies extending beyond an organization’s own components.

Sources: [1], [2]

Suggested next steps for management-system teams

The following are editorial implementation suggestions, not newly issued requirements. Start by assigning an accountable owner for a cryptographic inventory. Record where key establishment and digital signatures are used, including services managed by suppliers. Separate confirmed information from gaps that require technical investigation.

Use that inventory to identify systems protecting long-lived sensitive information and dependencies that could constrain migration. Ask suppliers about supported migration paths, testing dependencies and product availability rather than treating a general statement of readiness as a complete plan.

For a hypothetical supplier-managed application, an inventory entry could name the internal service owner, identify the supplier contact and record what remains unknown about migration support. This turns an unresolved dependency into a defined follow-up task without assuming a replacement is already available.

Sources: [1], [2]

Make ownership and applicability explicit

As an editorial planning approach, keep applicable federal or contractual obligations separate from voluntary internal targets. Record the authority behind each deadline, the systems it covers and the evidence needed to establish readiness. Where scope or supplier capability remains uncertain, assign a check rather than presenting an assumption as a confirmed commitment.

Which supplier-managed system would be hardest for your organization to include in a post-quantum migration inventory, and who should own that dependency?

Sources: [2]

Sources

1. NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards
2. NIST IR 8547: Transition to Post-Quantum Cryptography Standards

Your experience

Which supplier-managed system would be hardest for your organization to include in a post-quantum migration inventory, and who should own that dependency?

Related reading

• NIST opens consultation on an executive cybersecurity handbook aligned with CSF 2.0
• EU cyber authorities urge immediate action on two critical PHP vulnerabilities
• NIST opens consultation on revised operational technology security guidance

About the author

AdviseISO Editorial Team

The AdviseISO editorial team prepares practical, source-based guidance on standards, auditing and compliance.