NIST finalizes post-quantum transition roadmap for federal systems

NIST released the final NIST IR 8547, Transition to Post-Quantum Cryptography Standards, on October 27, 2026. The report identifies quantum-vulnerable algorithms and the post-quantum standards intended to replace them, with a roadmap for federal agencies, technology providers and standards organizations.

NIST says the transition requires more than replacing an algorithm. Organizations need visibility into cryptographic dependencies across applications, hardware, software libraries and suppliers. Long-lived sensitive data deserves particular attention because attackers could collect encrypted information now and attempt to decrypt it later.

The report describes a broader federal migration target of 2035, while identifying earlier milestones for federal high-value assets and high-impact systems, excluding National Security Systems: December 31, 2030, for key establishment and December 31, 2031, for digital signatures. Teams should check the underlying policy and their system’s applicability rather than treating one date as universal.

For contractors supporting ISSO, RMF and security policy work, the practical implication is to connect cryptographic inventories, supplier readiness and migration risks to agency planning and system documentation. That is an operational interpretation of the report, not a new solicitation, an award announcement or a claim that every contract has identical requirements.