NIST Post-Quantum Standards Are Final — Organizations Must Begin Transition Now

Cybersecurity experts warn that the quantum computing threat to encryption is already active through 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt it once quantum tools mature. In August 2024, NIST finalized three post-quantum cryptography standards — ML-KEM, ML-DSA, and SLH-DSA — giving organizations concrete frameworks to begin migrating away from RSA and elliptic-curve cryptography. Joint guidance from CISA, NSA, and NIST urges institutions to start by inventorying systems that rely on classical encryption and engaging vendors about planned transitions. The core challenge is not replacing algorithms overnight but locating where legacy cryptography is embedded across certificates, VPNs, firmware, cloud services, and third-party products — often with no clear internal owner. The critical question organizations must now answer is not only when quantum computers will become powerful enough, but how long their sensitive data must remain protected and how long a full cryptographic migration will realistically take.