NIST · Final
The main standard for post-quantum key establishment: how two systems agree a secret key.
Standards and guidance
The sources behind our quantum readiness work, each checked against its publisher on 2026-10-23. Drafts are marked as drafts. The dates below are what governments require of themselves and their suppliers, not predictions of when quantum computers will break encryption.
NIST · Final
The main standard for post-quantum digital signatures.
NIST · Final
A second signature standard built on a different kind of mathematics, as a backup.
NIST · Selected; draft standard not yet published
A backup to ML-KEM. ML-KEM remains the recommended choice.
FIPS 206: FN-DSA (based on Falcon)
Not yet publishedNIST · Under development; no public draft
A further signature standard that NIST is still writing.
NIST · Initial public draft
Proposes deprecating 112-bit RSA and elliptic-curve algorithms after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. Still a draft, though federal agencies must plan against it (OMB M-26-15).
NIST · Final
How to use key-encapsulation mechanisms such as ML-KEM correctly.
CSWP 39: Considerations for Achieving Crypto Agility
2025-12-19 (updated 2026-06-29)NIST · Final
Strategies for building systems that can change algorithms without being rebuilt.
NIST National Cybersecurity Center of Excellence · Preliminary drafts
Practical guidance on finding where cryptography is used and testing the new algorithms.
CISA, NSA and NIST · Final
Start now: build a roadmap, inventory cryptography, assess risk and engage vendors.
CISA · Live
CISA's hub for post-quantum guidance, including guidance for operational technology.
CISA · Published; updated periodically
Product categories where post-quantum support is widely available, for federal buyers.
The White House (Federal Register) · In force
Federal high-value assets and high-impact systems: post-quantum key establishment by 2030-12-31 and signatures by 2031-12-31. Directs a FAR rule for covered federal contractors, not yet proposed.
Office of Management and Budget · In force (federal civilian agencies)
Agency migration plans, prioritized migration from 2028 to 2030, and alignment with NIST IR 8547.
Office of Management and Budget · Issued
Federal agencies inventory their cryptographic systems every year.
US Congress · Law
Federal agencies inventory quantum-vulnerable systems and plan their migration.
Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
2025-05-30 (update)NSA · Current; national security systems only
The timeline for national security systems and their vendors. Not the timeline for civilian, state or local systems.
State guidance
On 2026-10-23 we found no post-quantum guidance from New York State, the New York State Department of Financial Services, NASCIO or the MS-ISAC. We will add it here when it is published.
Start with the free assessment
Free 30-minute call, free assessment, gap report and free results review. No obligation. Or write to support@securitymedic.com.
Book a free 30-minute call