NIST finalizes its post-quantum transition roadmap
The final report distinguishes sensitive federal systems from the broader migration timetable.
NIST published the final version of IR 8547 on October 27, replacing a draft released in November 2024. The report identifies quantum-vulnerable cryptographic standards and their post-quantum replacements. Its timetable does not predict when a quantum computer capable of breaking current public-key cryptography will arrive.[1][2][3]
For federal high-value assets, high-impact systems and other prioritized sensitive systems, the report specifies December 31, 2030 for post-quantum key establishment and December 31, 2031 for digital signatures. Its broader transition schedule deprecates vulnerable public-key methods after 2030 and disallows them under NIST standards and guidelines after 2035. Those dates should retain their stated scope.[2]
For planning, connect each dependency to an owner and an upgrade route. A timetable becomes actionable when teams can identify the certificate chain, appliance or supplier-controlled component that could delay migration. Hybrid mechanisms also deserve a separate engineering review: the report describes additional implementation complexity, cost and security trade-offs.[2]
Editorial interpretation
An inventory is more useful when it records a dependency rather than merely an algorithm name. Consider a service whose application can be upgraded but whose signing hardware cannot. Counting the application as complete would hide the unresolved part. A good planning record would connect the application, key store, certificate issuer and responsible supplier, then state what evidence would close each dependency.
The order of work should also reflect the information being protected. A short-lived authentication token and a document that must remain confidential for years create different planning questions. Separating confidentiality lifetime, replacement lead time and the applicable policy date helps an owner explain why one migration belongs earlier in the schedule. That is a planning framework, not a claim that every organization has the same obligations.