NIST's final post-quantum transition plan deprecates RSA and elliptic curve cryptography after 2030

On October 27, 2026, the National Institute of Standards and Technology (NIST) published the final NIST Internal Report (IR) 8547, its plan for moving to post-quantum cryptography (PQC). It deprecates every quantum-vulnerable public-key algorithm after 2030 and disallows them under NIST standards after 2035. That covers Rivest-Shamir-Adleman (RSA), the elliptic curve algorithms, Diffie-Hellman, and Menezes-Qu-Vanstone (MQV), at every approved key strength. The 2024 draft had deprecated only the 112-bit versions.

Federal agencies have earlier deadlines for their most sensitive systems. Under Executive Order (EO) 14412 and Office of Management and Budget (OMB) memo M-26-15, high value assets and high impact systems must use PQC for key establishment by December 31, 2030. They must use it for digital signatures by December 31, 2031. Agency migration plans were due October 22, 2026, and M-26-15 requires them to align with IR 8547, so agencies should now check their plans against the final report. Two Federal Risk and Authorization Management Program (FedRAMP) requests for comment on cloud providers' cryptography close November 17 and 19, and a proposed contract rule is due by December 19.

What changed between the draft and the final IR 8547?

The final report deprecates every quantum-vulnerable public-key algorithm after 2030, at every approved key strength. The draft deprecated only the 112-bit versions. Both versions disallow them after 2035.

Sources: IR 8547 final, Tables 2 and 4; IR 8547 draft, Tables 2 and 4.

"Deprecated" has a set meaning in NIST's transition guidance, Special Publication (SP) 800-131A. Agencies may still use a deprecated algorithm, but it carries some security risk. The data owner must examine that risk and decide whether to keep it. "Disallowed" means it is no longer allowed for the stated purpose.

The replacements are the post-quantum standards NIST published on August 13, 2024:

• Federal Information Processing Standard (FIPS) 203, the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), for key establishment.
• FIPS 204, the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), for signatures.
• FIPS 205, the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA), for signatures.

The final report also sets two 2030 dates for other algorithms. It says the few symmetric standards at the 112-bit level "will be disallowed in 2030." It says Secure Hash Algorithm 1 (SHA-1) will be disallowed in FIPS-validated cryptographic modules after 2030.

Which deadlines apply to which agency systems?

High value assets and high impact systems must move by 2030 and 2031. All agencies must support TLS 1.3 by January 2, 2030. Other systems have until 2035.

• 2030 and 2031 for the most sensitive systems. EO 14412, signed June 22, 2026, sets December 31, 2030, for PQC key establishment and December 31, 2031, for PQC signatures. These dates apply to high value assets under M-19-03 and high impact systems under FIPS 199. M-26-15 also makes other systems with highly sensitive data a priority. It says agencies should include systems whose data will still be mission-sensitive in 2030.
• 2030 for TLS 1.3. M-26-15, citing EO 14306, requires agencies to support TLS 1.3 or a later version by January 2, 2030.
• 2035 for everything else. National Security Memorandum 10 (NSM-10, 2022) set the goal of "mitigating as much of the quantum risk as is feasible by 2035." IR 8547 says that overall goal remains.

IR 8547 says the 2030 to 2035 window is for "lower-risk systems and applications with legacy constraints." It also says the window "does not alter the earlier deadlines" for high value assets and high impact systems. National security systems are outside M-26-15.

Key establishment comes first because of "harvest now, decrypt later." An adversary can record encrypted traffic today and decrypt it once a capable quantum computer exists. Signatures are not exposed to that threat, but IR 8547 says their move is also urgent because it takes longer and needs more parties to coordinate.

What does the final report mean for the plans agencies sent in October?

Plans sent in October were written while only the 2024 draft existed. A plan that kept 128-bit RSA or elliptic curve keys until 2035 now needs a risk decision for each system that keeps them past 2030. M-26-15 calls the plan "a dynamic document that will mature over time," so an update fits the memo.

OMB issued M-26-15 on June 24, 2026. It gave agencies 120 days to send a PQC migration plan to OMB and the Office of the National Cyber Director (ONCD) at PQC@omb.eop.gov. It says plans "must align" with IR 8547 "or successor document."

M-26-15 says each plan must contain, at a minimum:

• a system prioritization strategy with a risk-based reason;
• timelines and milestones for the migration phases and for TLS 1.3;
• the methods and automated tools used for the cryptographic inventory;
• a third-party coordination plan; and
• an estimate of the funding and staff needed.

What do FedRAMP's open requests for comment on cryptography change?

Two FedRAMP requests for comment (RFCs) would change the rules for cloud providers' cryptography. Comments close November 17 and 19, 2026.

M-26-15 tells agencies to engage their cloud service providers to divide PQC migration duties under the shared responsibility model. The memo calls them "FedRAMP-authorized" providers. Under the FedRAMP Consolidated Rules for 2026, "FedRAMP Certified" is now the proper term.

• RFC-0035, Cryptographic Module Use Rules Updates (closes November 17). Today a provider with a Class D FedRAMP Certification, the highest class, "MUST" use modules validated under NIST's Cryptographic Module Validation Program (CMVP) to protect federal customer data. RFC-0035 would change that to "SHOULD," the same as Class C. Switching from a validated module to an unvalidated one would become a "transformative change." The provider must give agency customers and FedRAMP notice of its initial plans at least 30 business days before work starts. A hybrid setup, which adds a post-quantum algorithm while a validated module still protects the data, would not count. The RFC says it "does not change agency obligations" under FIPS 140-3.
• RFC-0036, FedRAMP 20x Class D Cloud-Hosted Pilot Requirements (closes November 19). It covers the pilot for Class D under FedRAMP 20x, FedRAMP's newer certification path. One proposed rule is about PQC. Each provider would list the algorithms it uses for key establishment and digital signatures on federal customer data. For each one, it would say whether the algorithm is post-quantum, hybrid, or neither, and, where available, when it will move.

FedRAMP takes comments in the FedRAMP community discussions on GitHub or through the online form linked from each RFC.

What should agency security, privacy, and acquisition staff do now?

Some steps belong to specific roles:

• Chief Information Security Officers should confirm that each data owner has made the risk decision for any quantum-vulnerable algorithm a system will keep after 2030. M-26-15 requires agencies to identify systems that cannot support PQC or hybrid cryptography and give them priority for replacement or decommissioning.
• Senior agency officials for privacy should flag systems that hold personal information that must stay confidential for many years. IR 8547 names medical records as an example of long-lived sensitive data.
• Acquisition staff should check that requirements for products in the Cybersecurity and Infrastructure Security Agency's (CISA's) post-quantum product categories include PQC support, as M-26-15 asks.
• Authorizing officials should ask providers for their cryptographic module documentation before the next continuous monitoring review.

FedXchange's free Post-Quantum Cryptography Migration Plan template follows the M-26-15 plan sections.

Sources

• NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026), publication page
• NIST IR 8547 final, PDF
• NIST IR 8547 initial public draft (November 12, 2024), publication page
• NIST IR 8547 initial public draft, PDF
• NIST news: NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards (October 27, 2026)
• Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, 91 FR 38483 (June 25, 2026)
• OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography (June 24, 2026)
• National Security Memorandum 10 (May 4, 2022)
• FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard
• FIPS 204, Module-Lattice-Based Digital Signature Standard
• FIPS 205, Stateless Hash-Based Digital Signature Standard
• FIPS 140-3, Security Requirements for Cryptographic Modules
• NIST Cryptographic Module Validation Program
• FedRAMP RFC-0035, Cryptographic Module Use Rules Updates
• FedRAMP RFC-0036, FedRAMP 20x Class D Cloud-Hosted Pilot Requirements
• FedRAMP open and closed requests for comment
• FedRAMP Consolidated Rules for 2026: Cryptographic Module Use (20x)
• FedRAMP Consolidated Rules for 2026: Significant Change Notification (20x)
• FedRAMP Consolidated Rules for 2026: Definitions
• FedRAMP Consolidated Rules for 2026: FedRAMP 20x
• CISA: Product Categories for Technologies That Use Post-Quantum Cryptography Standards
• RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3
• FedXchange governance tracker: NIST IR 8547
• FedXchange governance tracker: OMB M-26-15
• FedXchange governance tracker: EO 14412
• FedXchange governance tracker: FedRAMP RFC-0035
• FedXchange governance tracker: FedRAMP RFC-0036

Icons by Font Awesome Free, licensed CC BY 4.0.