Consider the certificate behind your single sign-on or the key that signs your software updates. The keys that protect your database backups belong on the same list. All of them rely on RSA or elliptic-curve cryptography, and NIST has now set a date to retire both. On October 27, 2026, NIST published the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards. It deprecates RSA and elliptic-curve cryptography after 2030, and it disallows them under NIST standards after 2035. That gives most organizations about four years to find every place these algorithms run.

The report reaches well beyond the federal government. NIST wrote it for agencies and for the companies that build technology products for the federal agencies. It also calls itself a blueprint for critical infrastructure and for other organizations making the same change. Vendors will plan their products around these dates, so the schedule will reach most organizations through the software and hardware they buy.

This post explains what the report says, what changed from the 2024 draft, and where to start.

What NIST IR 8547 says

The report lists the public-key algorithms that a future quantum computer could break. It also names the new post-quantum algorithms that replace them and sets the dates for the switch.

The retirement dates

Two groups of algorithms are affected, and both follow the same schedule.

  • Digital signatures. RSA, ECDSA, and EdDSA are deprecated after 2030 and disallowed after 2035.

  • Key establishment. Diffie-Hellman, MQV, and RSA key transport are also deprecated after 2030 and disallowed after 2035. Key establishment is how two systems agree on a shared secret key.

The two terms have specific meanings. A deprecated algorithm can still be used, but the data owner must look at the risk and decide to accept it. A disallowed algorithm can no longer be used to protect data under NIST standards.

The replacements

NIST has already published the new standards. ML-KEM (FIPS 203) replaces the old key-establishment methods, and NIST recommends ML-KEM-768 as the default setting. ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) replace the old signature methods. Two more standards, HQC and a signature scheme based on FALCON, are still in development.

Earlier deadlines for federal systems

Executive Order 14412 and OMB Memorandum M-26-15 set a faster schedule for the government's most sensitive systems. These systems must use post-quantum key establishment by December 31, 2030, and post-quantum signatures by December 31, 2031. Agencies must also support TLS 1.3 by January 2, 2030.

What changed from the 2024 draft

The November 2024 draft gave stronger keys, such as RSA-3072 and the P-256 curve, more time. They were scheduled only for removal after 2035, with no earlier warning stage. The final report puts every quantum-vulnerable algorithm on the same "deprecated after 2030" path. The final version also ties the schedule to the new federal deadlines. In addition, it says that systems unable to support post-quantum cryptography should be found and scheduled for replacement or retirement.

What the report does not require

NIST IR 8547 is not a law for private companies. It does not require hybrid setups that combine old and new algorithms, although NIST will accept them. It does not ask anyone to replace AES, SHA-2, or SHA-3, because NIST does not expect to move away from these symmetric standards. Finally, the report makes no prediction about when a large quantum computer will be built.

Why the 2030 date matters outside government

Most organizations will feel the report even if no regulator ever names it. There are three main reasons.

Your vendors will change on this schedule

Companies that sell to federal agencies have to meet the 2030 and 2031 deadlines. Their cryptographic libraries, hardware security modules, cloud services, and certificate tools will change to match. NIST's own announcement says that "many organizations that work with the federal government will be affected as well."

Every deprecated algorithm needs an owner

After 2030, each remaining use of RSA or elliptic-curve cryptography becomes a risk that someone has to accept on purpose. That person needs to know where the algorithm runs, what it protects, and when it will be replaced. Without a clear list, nobody can make that decision in a way that holds up.

Some systems take years to change

NIST points out that hardware has long design and manufacturing cycles. Some devices cannot update the code that checks software signatures after they leave the factory. These devices may still be in use once a large quantum computer exists. For those devices, NIST says quantum-resistant signatures should be required from the start. NIST also names "harvest now, decrypt later" collection as a reason to move key establishment first. In that attack, someone records encrypted data today and waits until they can decrypt it.

Why the transition is harder than it looks

The hardest part is not the quantum computer. It is the cryptography that organizations already run without a clear record of where it lives or who owns it. Quantum-vulnerable algorithms tend to hide in five places.

  • Certificates. A manufacturer's internal certificate authority may issue RSA certificates to factory equipment and internal web apps. Some of those certificates stay valid for years.

  • Source code. A firmware update tool or a software licensing module may name ECDSA directly in its code. Changing the algorithm means a code change, new tests, and a new release.

  • Databases. The keys that protect database backups are often wrapped with RSA keys from a separate key manager. As a result, the database cannot move until the key manager does.

  • Applications. Off-the-shelf HR, ERP, or engineering tools often ship with their own cryptographic library. That leaves you waiting on each vendor's plan.

  • Configuration files. Settings such as SAML signing for single sign-on and SSH keys for deployment scripts live in configuration files. Those files are spread across servers and cloud accounts.

Many of these places already hold problems today, such as expired certificates, weak keys, or SHA-1. NIST will stop allowing SHA-1 in FIPS-validated modules after 2030. Quantum computing did not create these gaps, but it now puts a firm date on fixing them.

Seven questions to answer before 2030

  1. Where do RSA, ECDSA, EdDSA, and Diffie-Hellman run in our systems, and is each one used for signatures or for key establishment?

  2. Which of our data must stay private well past 2030, and how are its keys exchanged today?

  3. Which of our vendors have published plans for ML-KEM and ML-DSA, and which have not?

  4. Which systems cannot support post-quantum cryptography, and will we replace them or retire them?

  5. Which devices check software signatures with code that cannot be updated later?

  6. Who owns each certificate authority, signing key, and configuration file?

  7. If a customer or auditor asked tomorrow, could we show a current, ranked list of our cryptography?

Build your PQC work list with ISARA Advance

NIST IR 8547 makes post-quantum migration a cryptographic posture problem. You need to know what you run, decide what to fix first, and show that the work is moving. ISARA Advance is an Autonomous Crypto Posture Management (ACPM) platform built for that job.

ISARA Advance finds cryptography across all 8 surfaces of your IT systems and shows which problems to fix first. Its main output is a prioritized cryptographic bill of materials (CBOM). The CBOM is a ranked list of the quantum-vulnerable algorithms and weak settings that the report's tables describe. ISARA Advance can also pull from sources you already have, such as your CMDB. That way, each finding links to a known system and owner.

ISARA Advance does not change your cryptography by itself. It sends each finding to the team that owns the system via ServiceNow or Webhooks, and that team makes the fix. Over time, this builds the record you need to show which risks were accepted and which were closed.

Plan for more than one change

NIST is clear that 2035 will not be the last algorithm change. HQC and the FALCON-based standard are still coming, and NIST will revise SP 800-131A and SP 800-52 with more detailed schedules. Teams that adopt hybrid setups will also face a second move later, to post-quantum algorithms alone. For these reasons, the report calls for building long-term crypto agility into your systems.

This is where quantum computing speeds things up. The gaps described above have existed for years. The post-quantum transition turns a routine key-size update into the retirement of a whole family of algorithms on a fixed schedule. Organizations that can find, rank, and replace cryptography as a repeatable process will meet the 2030 and 2035 dates. They will also be quantum-ready for whatever NIST standardizes next.

Start with the inventory, but don't stop with a snapshot report

NIST names the first step at the start of the report: build a cryptographic inventory, then plan your migration from it. That inventory should cover certificates, source code, network, databases, servers, applications, and configurations, and it should show which findings to fix first.

Find out how the Autonomous Cryptographic Posture Management tool can support your team's transition to PQC.

FAQ

What is NIST IR 8547?

NIST IR 8547, Transition to Post-Quantum Cryptography Standards, is a NIST report published in final form on October 27, 2026. It lists the public-key algorithms that a quantum computer could break, the post-quantum algorithms that replace them, and the dates for the switch.

When will RSA and ECC be deprecated?

RSA, ECDSA, EdDSA, and Diffie-Hellman are deprecated after 2030 and disallowed under NIST standards after 2035. The most sensitive federal systems must move sooner: by December 31, 2030, for key establishment and by December 31, 2031, for signatures.

Does NIST IR 8547 apply to private companies?

Not directly. NIST IR 8547 is guidance for federal agencies and their suppliers, not a law for private companies. Even so, it will reach most organizations through their vendors, since companies that sell to the government are updating their products to meet the same dates.

What changed from the 2024 draft?

In the 2024 draft, stronger keys such as RSA-3072 and P-256 could be used as normal until 2035. The final report changes that. Every quantum-vulnerable algorithm is now deprecated after 2030, and the schedule is tied to the new federal deadlines.

What should we do first?

Build a cryptographic inventory that covers certificates, network, source code, databases, servers, applications, and configurations. Then rank what you find, plan replacements for systems that cannot support post-quantum cryptography, and assign an owner to each deprecated algorithm you keep.