NIST IR 8547 Transition to Post-Quantum Cryptography Standards (final)

Adopt with guardrails

Why

The final report is an official, primary-source roadmap with firm dates (deprecate after 2030, disallow after 2035) that are now tied to Executive Order 14412 deadlines of 2030 for key establishment and 2031 for signatures on federal high-value assets. Compared with the 2024 draft it is stricter: all approved strengths, including P-256 and EdDSA, are deprecated after 2030. That makes it a dependable planning input. It is guidance rather than a binding rule for private organizations, and several companion documents are not final, so it supports planning and inventory work, not full engineering lock-in.

Next

Inventory quantum-vulnerable public-key use (TLS, PKI, code signing, VPN, HSMs), prioritize key establishment with ML-KEM-768 for long-lived data, and track SP 800-131A Rev 3, SP 800-56C and SP 800-52 revisions before locking in hybrid or signature designs.