Post-Quantum Cryptography Intelligence
The standards, mandates and deadlines that decide when you replace RSA and ECC, plus the tools to prove you are on track.
Until RSA and ECC are disallowed federally
Compliance clocks tracked
NIST algorithms tracked
Vendors mapped
Four obligations, four dates. Most organizations sit on more than one.
Executive departments and agencies, excluding NSS
Agency PQC migration plans due to OMB and ONCDOct 22, 2026
Contractors and, through flow-down, their suppliers
Proposed FAR PQC rule due from the FAR CouncilDec 19, 2026
Private sector, critical infrastructure, international
NIST FIPS 206 (FN-DSA) signature standard expected finalDec 31, 2026
NSS owners, DoD components and their integrators
New NSS acquisitions expected to support CNSA 2.0Jan 1, 2027
Three questions federal suppliers are being asked right now, answered in a form you can file.
Ten questions on contract vehicles, CUI and FedRAMP posture. Returns a determination, your clocks, and a dated memorandum.
Run the determinationA draft structured against every element M-26-15 requires, with your organization, owners and dates filled in.
Generate a draftTrack each system with no PQC option, the compensating control and the refresh date, then generate an exception memo.
Open the registerStandards decisions, regulation, funding and real-world deployment, filtered for signal.
Feed updated October 9, 2026
With agency migration plans due to OMB and ONCD this month, federal PQC leads told an AFCEA DC audience that agencies are still in the discovery and inventory phase, and that PKI and PIV/CAC card readiness is a gating dependency.
XJTLU's PQC-X lab found a universal forgery attack on the Origami signature scheme, a Round 1 candidate in China's Next-Generation Commercial Cryptography program. A laptop and the public key are enough to forge signatures at all four security levels.
Microsoft Security says PQC authentication needs its own planning: inventory certificate dependencies, check vendor roadmaps, find long-lived infrastructure, and stand up non-production PKI test environments. It describes a PQC TLS pilot for certificate authorities.
GAO-27-108740 assessed the 24 CFO Act agencies against three OMB-derived practices: a prioritized cryptographic inventory, funding estimates, and PQC testing. None fully addressed all three, citing gaps in cryptography expertise among the causes.
Germany's BSI now recommends not using Classic McEliece in new deployments after new cryptanalysis weakened its security assumptions. Existing hybrid implementations are not considered practically vulnerable.
NSA announced new PQC initiatives for the Department of War and the Defense Industrial Base. Per CNSSP 15, new commercial NSS must support quantum-resistant algorithms starting in 2027, and legacy systems that cannot are to be phased out by 2030.
ML-KEM, ML-DSA, SLH-DSA, FN-DSA and HQC with status, security levels and every dated milestone.
Open the trackerSourced vendor posture, residual risk scoring, and a dated exception memo you can file.
Open the registerMosca's inequality made concrete: horizon, migration time and Q-Day, and how much slack is left.
Run the modelFree with sign-up
Target-state algorithms, the full deadline map, a five-phase program and a first-90-days checklist. Downloads the moment you create an account.
One email a week: what changed in standards, what regulators did, who raised money, and what it means for migration planning.
