Washington should prepare for quantum-resistant cryptography before a quantum computer capable of breaking today’s public-key encryption exists. No one knows when such a machine will arrive, but moving cryptography across real systems takes time—and information stolen in encrypted form today could become readable later.
Why prepare before a quantum computer arrives?
A sufficiently capable quantum computer could undermine some public-key cryptography used to protect information systems. That threat is conditional: the arrival date of a cryptographically relevant quantum computer is unknown, and predictions vary widely.
As an Amazon Associate I earn from qualifying purchases.
The uncertainty is not a reason to wait. NIST says that integrating a new algorithm into information systems has historically taken 10 to 20 years. That is general context, not a promised timeline for every system or for any organization’s post-quantum migration.
Encrypted data can remain valuable
“Harvest now, decrypt later” describes an adversary collecting encrypted information now in the hope of decrypting it when quantum capabilities mature. The risk is most relevant to data that must remain confidential for many years: information intercepted today may still matter when future decryption becomes possible.
#1 Best Overall
What standards are available now?
NIST finalized three post-quantum cryptography (PQC) standards in 2024 and says they are ready to implement. They address key establishment and digital signatures, which serve different purposes in secure systems.
| Standard | Purpose |
|---|---|
| FIPS 203 | Key-encapsulation mechanism for key establishment |
| FIPS 204 | Digital signatures |
| FIPS 205 | Digital signatures |
These standards provide approved cryptographic building blocks; they do not, by themselves, migrate an agency’s networks, applications, devices, or vendor services. Organizations still need to identify where cryptography is used, determine what it protects, and test replacement approaches so systems and counterparties continue to work together.
Rank #2
What Washington has done—and what remains unsettled
U.S. government preparation includes policy, standards, and practical migration work. NIST’s migration FAQ says National Security Memorandum 8, issued in January 2022, addresses national security systems and related assets; National Security Memorandum 10, issued in May 2022, addresses non-national-security systems and related assets. The FAQ also describes cryptographic inventory efforts for federal civilian executive-branch high-value assets and high-impact systems.
The Secretary of Commerce approved the three PQC FIPS standards in August 2024. NIST’s National Cybersecurity Center of Excellence (NCCoE) works with government and industry on cryptographic visibility and risk management, including comprehensive inventories, as well as interoperability and benchmarking.
Status matters when reading federal guidance. NIST IR 8547, published November 12, 2024, is an initial public draft describing an expected transition approach. It is not evidence of a final, binding agency deadline. The materials cited here do not establish a final IR 8547 timeline or agency-by-agency completion status.
What organizations should do now
The joint CISA, NSA, and NIST quantum-readiness factsheet urges organizations to begin preparation rather than wait for a quantum computer. For an agency, company, or critical-infrastructure operator, the practical work is to build visibility first, then use that visibility to manage risk and plan tested changes.
- Discover cryptographic use. Find where public-key cryptography is used across your systems, products, and services, including dependencies and vendor-provided components.
- Create an inventory. Record each algorithm, its purpose, the system owner, dependencies, and the data or function it protects. Maintain the inventory so it can support future updates.
- Assess and prioritize risk. Consider how sensitive the protected data is, how long it must remain confidential, how operationally important the system is, and what migration dependencies could slow a change. These are practical prioritization considerations, not a government-prescribed scoring formula.
- Engage vendors and service providers. Ask about support for the finalized NIST standards, compatibility with your environment and counterparties, performance, and migration plans.
- Plan and test before production changes. Evaluate interoperability and operational impact, then test migration approaches before replacing cryptographic components in live systems. NIST’s NCCoE work specifically includes interoperability and benchmarking.
How to evaluate migration approaches
There is no single product comparison in the cited government materials. When comparing an internal plan, vendor proposal, or technical approach, assess whether it:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- covers the vulnerable cryptographic uses identified in your inventory;
- works with the systems and counterparties that must interoperate;
- supports the finalized NIST standards;
- accounts for performance and operational effects; and
- helps the organization keep discovering, prioritizing, and updating cryptography over time.
NIST mathematician Dustin Moody, who heads NIST’s PQC standardization project, put the timing plainly: “We encourage organizations to begin their transition to these standards immediately to ensure their data remains secure in the quantum era.”
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
