Short answer
NIST publishes the post-quantum algorithm standards and transition guidance that most organizations use to plan migration away from RSA and elliptic-curve cryptography. This page summarizes that guidance and how its timelines affect planning. NIST documents are the authority for algorithms and deadlines; check them directly before relying on dates. QCI-QS1 does not restate NIST deadlines; it governs how an organization evidences its own migration.
In one sentence: NIST sets the post-quantum algorithms and transition timelines; organizations plan their migration against them.
Part of Standards and regulation in the Knowledge Center
Think Earlier.
The quantum problem starts before the quantum computer arrives.
Planning to NIST's PQC transition timeline: QCI's suggested four phases, 2025 to 2035.
NIST IR 8547, still an initial public draft, proposes deprecating RSA-2048 after 2030 and disallowing quantum-vulnerable public-key algorithms after 2035. This page sets out a four-phase plan QCI suggests for meeting that timeline, mapped to QCI-QS1. The phases are QCI's planning suggestion, not a NIST publication.
The dates that drive the plan.
NIST finalizes PQC standards.
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) published.
Proposed: 112-bit algorithms deprecated.
NIST IR 8547 initial public draft, Section 4.1: 112-bit quantum-vulnerable algorithms such as RSA-2048 would be deprecated. Not yet final.
Proposed: quantum-vulnerable public-key algorithms disallowed.
NIST IR 8547 initial public draft, Section 4.1. NSM-10 sets 2035 as the U.S. federal target. Sector regulators set their own expectations.
A four-phase plan (QCI suggestion).
Discovery and governance.
Stand up cryptographic inventory (CBOM/QASI), assign QRAF accountability, classify data by confidentiality lifetime, and produce a baseline Q-Risk Score. The joint CISA, NSA and NIST factsheet recommends that organizations begin by building a cryptographic inventory.
Source: CISA/NSA/NIST, Quantum-Readiness: Migration to Post-Quantum Cryptography (August 21, 2023) · QCI-QS1 Clause 5.1
Vendor roadmaps and contracts.
Require PQC roadmaps from every vendor with signing or encryption authority. Insert crypto-agility clauses into renewals. Begin pilot deployments of ML-KEM (FIPS 203) for key establishment behind feature flags. NIST IR 8547, still an initial public draft, proposes deprecating 112-bit quantum-vulnerable algorithms such as RSA-2048 after 2030 and disallowing all quantum-vulnerable public-key algorithms after 2035.
Source: NIST IR 8547 ipd (November 2024), Section 4.1, Tables 2 and 4 · FIPS 203 · FIPS 204
Migration of customer-facing and identity surfaces.
Roll out ML-DSA (FIPS 204) signing identities, certificate-chain refresh, hybrid TLS, and PQC for high-value customer authentication. This is where most institutions discover their machine-identity and workload-credential gaps; if your QASI inventory is not complete, this phase stalls.
Source: FIPS 204 (August 2024) · NIST SP 800-208 (October 2020, stateful hash-based signatures) · QCI-QS1 Clause 4.6
Completion, attestation, and decommissioning.
Decommission RSA-2048 and ECC-256 across all production surfaces. Issue executive attestation. Complete vendor compliance evidence. Reach the 81–100 band with all score gates passed and produce the Clause 8 governing-body insert. Under the draft timeline, quantum-vulnerable public-key algorithms would be disallowed after 2035.
Source: NIST IR 8547 ipd, Section 4.1 (proposed disallowance after 2035) · QCI-QS1 Clauses 6.5 and 8
The NIST-finalized algorithms you will be deploying.
FIPS 203: ML-KEM
Module-Lattice-based Key Encapsulation Mechanism. Replaces RSA and ECDH for TLS, VPN, and key exchange. Formerly known as CRYSTALS-Kyber.
FIPS 204: ML-DSA
Module-Lattice-based Digital Signature Algorithm. Replaces RSA and ECDSA for code signing, document signing, and certificate chains. Formerly CRYSTALS-Dilithium.
FIPS 205: SLH-DSA
Stateless Hash-based Digital Signature Algorithm. Backup signature scheme based on different mathematical assumptions, recommended for high-assurance signing.
NIST PQC publications and their status
Statuses checked on each NIST publication page on October 5, 2026. Check the linked page before relying on a status.
| ID | Name | Use | Status |
|---|---|---|---|
| FIPS 203 | ML-KEM, Module-Lattice-Based Key-Encapsulation Mechanism Standard | Key establishment | Final, August 13, 2024 |
| FIPS 204 | ML-DSA, Module-Lattice-Based Digital Signature Standard | Signatures | Final, August 13, 2024 (potential-errata list posted July 31, 2026) |
| FIPS 205 | SLH-DSA, Stateless Hash-Based Digital Signature Standard | Signatures | Final, August 13, 2024 |
| SP 800-208 | Recommendation for Stateful Hash-Based Signature Schemes (LMS, XMSS) | Signatures, controlled uses | Final, October 2020 |
| SP 800-227 | Recommendations for Key-Encapsulation Mechanisms | Key establishment guidance | Final, September 2025 |
| Falcon (FN-DSA) | Signature algorithm selected for standardization | Signatures | Selected; standard not yet final |
| HQC | Key-encapsulation algorithm selected in the fourth round (NIST IR 8545) | Key establishment (backup) | Selected March 2025; standard not yet final |
| NIST IR 8547 | Transition to Post-Quantum Cryptography Standards | Transition guidance | Initial public draft, November 12, 2024 |
Final, selected and draft are different. Final FIPS can be used now; NIST says ML-KEM, ML-DSA and SLH-DSA "can and should be put into use now." Selected algorithms do not yet have a final standard. IR 8547 is a draft: its proposed dates for deprecating and removing quantum-vulnerable algorithms may change.
No universal deadline. A NIST standard does not set a deadline for every organization. Deadlines come from the laws, regulations, contracts and policies that apply to you; record them in your applicability register (QCI-2.2-01). See how QCI-QS1 relates to regulation.
How QCI's suggested phases map to QCI-QS1 governance.
NIST specifies the algorithms and proposes the transition timeline. QCI-QS1 sets requirements for governing and evidencing the migration. The pairing below follows QCI's suggested phases; NIST does not define these phases.
The draft dates are close enough to plan against now.
A scored Q-Risk posture, a phased roadmap against the NIST timeline, and the evidence behind each recommendation, mapped to QCI-QS1.