NIST sets federal agencies on course for post quantum shift

The US National Institute of Standards and Technology (NIST) has issued guidance to help federal agencies meet the 2031 deadlines for transitioning to post-quantum cryptography (PQC). The guidance follows President Trump’s Executive Order 14412, which requires that high value assets and high impact systems switch to PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031.

NIST’s document lays out a transition plan for agencies and contractors working with the federal government, referencing the post-quantum algorithm standards published in 2024. NIST notes that the deadlines leave little margin and that action must be immediate and sustained across agencies, technology providers, standards bodies and infrastructure operators.

The guidance details prioritisation and risk-based approaches for different system types and data. Agencies and suppliers are urged to prioritise migration to the PQC key establishment standard (FIPS 203) for data requiring long-term protection due to the risk of harvest-now, decrypt-later attacks. A hybrid option combining conventional encryption with PQC is described for highly sensitive systems, though it requires greater computational resources.

The document also clarifies timelines for when less critical systems may continue using conventional protocols and stresses consideration of the entire cryptographic supply chain. NIST emphasises that, beyond individual components, organisations should assess the security of their overall cryptographic ecosystem, with input from researchers like Dustin Moody who explain when algorithms may be phased out or restricted in federal use.