The Clock That Started Before You Were Ready: NIST's Post-Quantum Framework and the Enterprise Migration Imperative
Executive Summary
The threat posed by cryptographically relevant quantum computers is not yet operational, but the data collection phase of the attack is already underway. Nation-state actors are harvesting encrypted network traffic today with the intent of decrypting it once sufficiently capable quantum systems become available — a technique designated Harvest Now, Decrypt Later (HNDL). The practical consequence is that any organization handling data whose confidentiality must remain intact beyond a five-to-ten year horizon is already exposed, regardless of whether quantum computing itself has matured.
Against this backdrop, NIST has advanced two milestone documents. The March 2025 publication of NIST IR 8545 concluded the Fourth Round of the PQC Standardization Process with the selection of HQC as a backup key-encapsulation algorithm. The September 2025 initial public draft of NIST Cybersecurity White Paper 48 (CSWP 48) maps NCCoE PQC migration capabilities directly to CSF 2.0 and SP 800-53 controls — translating cryptographic transition from a technical project into an enterprise governance obligation.
Immediate actionable guidance: Begin or accelerate cryptographic discovery and inventory now; the governance scaffolding to support and justify that investment is in place.
Key Finding: NIST's 2025–2026 publications shift the post-quantum transition from a theoretical future concern to an immediate enterprise governance obligation: CSWP 48 maps PQC migration directly to CSF 2.0 and SP 800-53 controls, meaning organizations without a cryptographic inventory and migration plan are now measurably out of alignment with established risk management frameworks — and the data already being harvested by adversaries cannot be retrieved.
What Happened
NIST's Post-Quantum Cryptography Standardization Process began in 2016 with an open call for proposals. By August 2024, three primary algorithms had been standardized: FIPS 203 (ML-KEM, derived from Kyber, for key encapsulation), FIPS 204 (ML-DSA, derived from Dilithium, for digital signatures), and FIPS 205 (SLH-DSA, derived from SPHINCS+, for stateless hash-based signatures). These three publications established the baseline to which organizations are now expected to migrate.
The Fourth Round addressed a specific gap in that baseline: the primary algorithms are predominantly lattice-based, meaning that a critical vulnerability in lattice mathematics — however unlikely — could compromise the entire suite simultaneously. On March 11, 2025, NIST published NIST IR 8545, concluding the Fourth Round evaluation of four candidate mechanisms — BIKE, Classic McEliece, HQC, and SIKE — and selecting HQC (Hamming Quasi-Cyclic), a code-based algorithm, as the complement to ML-KEM. HQC was chosen over BIKE primarily on security analysis and design properties. HQC's draft standard is expected to be released for public comment within approximately two years of the March 2025 announcement, with a final standard anticipated around 2027.
On September 18, 2025, the NIST NCCoE released an initial public draft of NIST Cybersecurity White Paper 48 (CSWP 48), titled "Mappings of Migration to PQC Project Capabilities to Risk Framework Documents." The public comment period closed October 20, 2025. CSWP 48 maps two specific NCCoE project workstreams to existing risk management controls. The first — Cryptographic Discovery — focuses on automated scanning and inventory tools to identify where and how asymmetric cryptography is deployed. The second — Interoperability and Performance — tests how NIST PQC algorithms function within TLS, SSH, and IPsec protocols and with hardware security modules (HSMs). CSWP 48 connects both workstreams to the Identify and Protect functions of CSF 2.0 and to specific control families within SP 800-53 Revision 5 — including System and Communications Protection (SC), Configuration Management (CM), and Identity and Authentication (IA).
A companion publication, CSWP 39 (Considerations for Achieving Crypto Agility: Strategies and Practices), was finalized on December 19, 2025, providing operational guidance on designing systems for flexible cryptographic replacement without requiring structural code rewrites.
This governance-layer work coincides with active threat activity. DHS and NSA have both documented that state-sponsored actors are conducting HNDL operations — capturing encrypted TLS, SSH, and IPsec sessions at scale for retrospective decryption once quantum computing capability reaches the cryptographically relevant threshold. NSA's Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) establishes migration timelines extending through 2031 for national security systems. Industry survey data cited in Cloud Security Alliance research indicates that while more than 80 percent of security managers acknowledge quantum risk, fewer than 6 percent have operationalized a functional PQC deployment.
Why It Matters
For CISOs & Security Leaders
CSWP 48 reframes PQC migration in terms that CISO-level stakeholders can apply directly: it is no longer adequate to treat quantum risk as a future technology problem deferred to the engineering team. By mapping migration capabilities to CSF 2.0 and SP 800-53, NIST has established PQC readiness as a governance and compliance matter. Organizations unable to demonstrate a cryptographic inventory aligned to the Identify function of CSF 2.0, or lacking configuration management controls addressing the PQC transition, are now measurably out of alignment with the risk framework most widely referenced by auditors, regulators, and federal contracting requirements. The practical implication: cryptographic discovery investment is now justifiable as documented risk management expenditure rather than speculative future-proofing.
For Enterprise Architects & Security Engineers
The two NCCoE workstreams outlined in CSWP 48 — discovery and interoperability — identify the specific technical capabilities organizations need to develop, in sequence. Discovery must precede migration; organizations cannot plan migration without a cryptographic asset inventory. That inventory must catalog not only explicitly managed certificates and key stores, but also asymmetric cryptographic dependencies embedded in third-party libraries, vendor software, custom application code, and network protocol configurations. PQC algorithms produce significantly larger keys and ciphertexts than RSA and elliptic-curve equivalents — ML-KEM public keys and ciphertexts are hundreds to thousands of bytes larger than RSA-2048 equivalents — carrying practical consequences for legacy hardware, network packet handling, and application buffer allocations.
For Compliance, Legal & Risk Professionals
The HNDL threat model introduces a compliance dimension not captured by traditional vulnerability management timelines. A data breach that occurs through future quantum decryption of currently intercepted traffic is difficult to detect, attribute, or remediate after the fact. For organizations subject to data retention obligations, long-term confidentiality requirements, or fiduciary responsibilities over proprietary information, the relevant question is not whether quantum computers exist today but whether data being transmitted today will retain its confidentiality obligation past the projected 2030–2033 capability window.
For Workforce Development & Security Awareness Professionals
The gap between organizational awareness of quantum risk and operational readiness — documented at more than 80 percent aware, fewer than 6 percent operationally deployed — reflects a workforce preparation deficit as much as a technical one. Cryptographic agility requires security engineers who understand not only which algorithms to deploy but how to build systems that can replace cryptographic primitives without architectural disruption. Organizations planning multi-year migration programs should account for workforce development investment alongside tooling and infrastructure costs.
Operational Implications
Immediate (Now Through 2026)
The most consequential immediate action is cryptographic discovery. Without a comprehensive inventory of where asymmetric cryptography is deployed — across network infrastructure, application dependencies, certificate management systems, HSMs, firmware signing authorities, and SaaS integrations — migration planning cannot proceed with accuracy or appropriate prioritization. The NCCoE Discovery workstream demonstrates that this inventory requires a combination of active scanning tools, passive monitoring tools, and cryptographic asset management platforms. The CSWP 48 framework mapping provides a mechanism for embedding the cryptographic inventory into existing governance structures, creating an auditable record of current cryptographic risk posture.
Short-Term (2026–2028)
Organizations should enter a prioritized migration planning phase informed by their cryptographic inventory. Prioritization should be driven by data sensitivity and retention horizon: systems processing or transmitting data that must remain confidential past the projected quantum capability threshold should be addressed first. Interoperability testing should be conducted in isolated laboratory or staging environments before any production deployment of hybrid cryptographic configurations. Hybrid approaches combining a classical algorithm such as ECC with a NIST PQC algorithm such as ML-KEM provide protection against both conventional threats and quantum-enabled decryption during the transition period.
Long-Term (2028–2031 and Beyond)
NSA's CNSA 2.0 guidance establishes 2031 as the outer boundary of the national security system migration window. Organizations should plan for multiple migration phases rather than a single transition event: initial hybrid deployments, followed by deprecation of legacy algorithms once vendor and partner ecosystem support is confirmed, followed by adoption of HQC as the finalized backup key-encapsulation standard around 2027. Cryptographic agility should be treated as a long-term architectural requirement — systems that can adopt new algorithms through configuration changes rather than code rewrites reduce the cost and risk of all future cryptographic transitions.
Recommended Actions
Actions are organized by organizational maturity. NIST IR 8545, CSWP 48, and CSWP 39 are free, publicly available resources that should serve as the starting point for all organizations.
* For organizations beginning PQC program planning.
- 1 — Conduct an executive briefing on HNDL risk framed specifically around the organization's data retention requirements and confidentiality obligations: data being transmitted today under RSA or ECC encryption may be decryptable in the future.
- 2 — Assign ownership of PQC migration within the existing enterprise risk management or compliance function — CSWP 48 has established this as a governance and compliance matter, not solely an engineering project.
- 3 — Obtain and review NIST IR 8545, NIST CSWP 48 (initial public draft), and NIST CSWP 39 as baseline orientation documents.
- 4 — Identify the data assets most critical to long-term confidentiality obligations; these represent the first-priority targets for migration planning.
* For organizations with active security programs and compliance functions.
- 1 — Deploy at least one cryptographic discovery tool in passive monitoring mode on a representative network segment to begin building a cryptographic asset inventory.
- 2 — Map cryptographic inventory findings to CSF 2.0 Identify outcomes and to SP 800-53 SC and IA controls using CSWP 48 as the mapping reference; create a baseline against which migration progress can be measured.
- 3 — Initiate vendor assessments for all material third-party software and SaaS dependencies: what is the vendor's PQC roadmap, and what timeline are they committing to for FIPS 203/204/205 support?
- 4 — Begin formal planning for deprecation of RSA and ECC within the organization's cryptographic standards documentation, with target dates aligned to CNSA 2.0 timelines.
* For organizations with mature cryptographic governance and security engineering capacity.
- 1 — Establish a non-production laboratory environment for interoperability and performance testing of hybrid PQC configurations — specifically TLS 1.3 with ML-KEM, SSH with ML-DSA, and IPsec with hybrid configurations — against representative network infrastructure including edge appliances, load balancers, and VPN concentrators.
- 2 — Develop a Cryptographic Bill of Materials (CBOM) for internally developed software, mapping each application's cryptographic dependencies to specific algorithm implementations and library versions.
- 3 — Engage with the NCCoE PQC Community of Interest (COI) to access pre-publication draft guidance and participate in the collaborative development of migration practices relevant to the organization's sector.
- 4 — Implement formal deprecation planning for RSA and ECC within the organization's cryptographic standards documentation, with target dates aligned to the CNSA 2.0 2031 boundary for the most sensitive systems.
Closing Statement
The post-quantum migration timeline is shaped by a constraint that most enterprise risk models do not naturally accommodate: the threat is partially historical. Data that has already been transmitted under RSA or ECC encryption and captured through an HNDL operation cannot be retroactively protected, regardless of when the organization completes its migration. This is not a reason for urgency to the point of paralysis, but it is a reason to understand the migration window as one that closes on two ends simultaneously — the advancing capability of quantum computing on one side, and the receding utility of action on already-intercepted data on the other.
NIST's 2025–2026 framework work gives organizations the governance language, the algorithmic building blocks, and the compliance mapping to act systematically rather than reactively. Bridging the awareness gap on quantum risk means moving past the question of whether the threat is real and toward the question of what, specifically, is already exposed — and what the organization is prepared to do about it.