NIST Sets Out Plan to Help Organisations Prepare for Post-Quantum Encryption

The US National Institute of Standards and Technology (NIST) has released official guidance to help federal agencies and the organisations that work with them move to post-quantum cryptography (PQC). This is a form of encryption designed to stay secure against future quantum computers. The guidance supports Executive Order 14412, published in June 2026, which requires agencies to move "high value assets" and "high impact systems" to PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031.

NIST warned that the deadlines leave little margin and will need immediate and sustained action from agencies and from the technology providers, standards bodies and infrastructure operators they rely on. The guidance encourages a risk-based approach. Data that is particularly sensitive, or must stay secure for a long time, should be prioritised for migration to the FIPS 203 key establishment standard because of "harvest now, decrypt later" attacks. For very sensitive systems, a hybrid option combines conventional encryption with PQC for two layers of protection, though it needs more computing resources.

The document also explains how long less critical systems can keep using conventional encryption, and how some of today's algorithms will be phased out. NIST mathematician Dustin Moody said knowing whether an algorithm will be disallowed after a certain date, or allowed only at the user's own risk, can help organisations plan. The report also urges agencies to look beyond their own systems at their entire cryptographic supply chain.