# NIST Sets Federal Post-Quantum Migration Deadlines

On October 27, 2026, the National Institute of Standards and Technology (NIST) finalized NISTIR 8547, setting a roadmap for moving federal systems away from quantum-vulnerable public-key cryptography. The guidance discourages affected algorithms after 2030 and disallows them under NIST standards and guidelines after 2035. Federal agencies have earlier milestones for priority systems: post-quantum key establishment by December 31, 2030, and digital signatures by December 31, 2031. The signals also identify a December 31, 2030 target for covered federal contractors under a planned FAR rule; that contractor requirement is described as planned, not as a finalized rule or current obligation.

- Agencies and contractors supporting federal systems should inventory cryptographic dependencies, identify supply-chain exposure, and prioritize systems protecting sensitive, long-lived data.
- Suppliers can prepare for demand for post-quantum implementation and readiness work, including hybrid migration approaches, signing-system upgrades, and crypto-agile, FIPS-validated products. The guidance notes that hybrid implementations may increase computational requirements.
- Contractors should distinguish the finalized NIST roadmap and agency milestones from the separate planned FAR rule before treating the contractor target as a binding requirement; the signals identify no specific solicitation, award, contract value, or procurement contact.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 30, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- U.S. federal agencies
- Office of Management and Budget (OMB)
- National Security Agency (NSA)
- National Cybersecurity Center of Excellence (NCCoE)

### Vendors
- Microsoft ()
- Google ()
- Amazon Web Services (AWS) ()
- IBM ()
- DigiCert ()

### Key Quotes
> We lay out how certain encryption algorithms people are using today will get phased out. It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.
> — Dustin Moody, Mathematician at NIST

### Sources
- [NIST Releases New Guidelines to Protect Encryption Against Future Quantum Computer Attacks](https://gbhackers.com/nist-guidelines-to-protect-encryption-against-future-quantum-computer-attacks) - GBHackers News
- [NIST Finalizes Timeline to Phase Out Quantum-Vulnerable Cryptography - Security Boulevard](https://securityboulevard.com/2026/10/nist-finalizes-timeline-to-phase-out-quantum-vulnerable-cryptography) - Security Boulevard
- [NIST Releases New Guidelines to Protect Encryption Against Future Quantum Computer Attacks](https://cyberpress.org/nist-guidelines-protect-encryption-quantum-computer) - Cyber Press