The US National Institute of Standards and Technology (NIST) has published official guidance designed to help federal government agencies meet the 2031 deadline to transition post-quantum cryptography (PQC).
President Trump’s Executive Order 14412, published in June 2026, mandated that all US federal agencies transition “high value assets” and “high impact systems” to use PQC for key establishment by December 31 2030 and for “digital signatures” by December 31 2031.
NIST’s new document sets out a transition plan for agencies and organizations that work with the federal government to meet this deadline. The guidance references the post-quantum algorithm standards that NIST published in 2024.
“These deadlines leave little margin: meeting them will require immediate and sustained action by federal agencies and by the technology providers, standards organizations, and infrastructure operators on which federal systems depend,” NIST wrote.
How to Prioritize the PQC Transition
The NIST report emphasized the logistical complexity that comes with the PQC transition. It outlined the approaches that can be taken for different types of systems and data to ensure security teams to take a risk-based approach to the transition.
For example, agencies and federal suppliers should prioritize the migration to the PQC key establishment standard (FIPS 203) for data that is particularly sensitive or needs to be kept secure for a long time, due to the risk of “harvest now, decrypt later” attacks.
The NIST guidance also accommodates a hybrid option for particularly sensitive systems, which combines conventional encryption with PQC – essentially providing two layers of security. However, this approach would demand more computational resources.
It also sets out how long less critical systems can continue to use conventional encryption protocols.
NIST mathematician Dustin Moody commented: “We lay out how certain encryption algorithms people are using today will get phased out. It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”
The report also urges federal agencies to look beyond their own system components and at its entire cryptographic supply chain.
Post-Quantum Preparations Ramp Up
The new NIST guidance follows a series of pledges around PQC transition from other governments and across the tech world.
Governments like Canada, Australia, Japan, and the UK have set deadlines ranging from 2028 to 2030 as milestones for ensuring critical government systems are quantum safe.
While many of these mandates are focused on government and critical infrastructure organizations, they generally come with a push for other sectors to follow suit and set a roadmap for PQC migration.
Large tech firms, including Cloudflare, Google and Microsoft, have set a 2029 deadline for full PQC migration. Meanwhile, Apple, AWS, IBM and Meta, have officially started rolling out NIST-approved PQC algorithms into their products.
Read now: How Cybersecurity Vendors Are Preparing for the Post-Quantum Era
The situation has been made more urgent after warnings from tech companies like Microsoft that advances in quantum R&D mean that cryptographically relevant quantum computers (CRQCs) capable of cracking asymmetric encryption could appear sooner than anticipated – potentially within the next five years.