Atlas Global Insights · John Klein, Founder & CEO · 4-minute read
What changed
NIST announced its finalized post-quantum transition report, IR 8547, on October 27. Its announcement identifies federal migration targets of 2030 for key establishment and 2031 for digital signatures in high-value and high-impact systems, alongside the broader 2035 federal target. These are federal timelines, not a universal deadline imposed on every private organization.
Source: NIST’s announcement and linked transition report ↗
Our assessment: buying decisions come before migration
For organizations choosing infrastructure with a long service life, our practical recommendation is to start vendor discussions now. A product purchased today may still be supporting essential operations when the organization needs to change its cryptography.
The questions below are Atlas’s procurement and engineering recommendations, rather than additional requirements attributed to NIST.
Five questions for the next vendor review
- Where is cryptography embedded? Request an inventory covering data connections, device identity, certificates, management access, software updates, and signing services. A feature label on one connection does not describe the whole system.
- What is supported in a released product? Ask for specific algorithms, versions, interoperability evidence, and support commitments. Distinguish a shipping capability from a roadmap or laboratory demonstration.
- What requires replacement? Identify hardware limits, licensing, firmware dependencies, certificate changes, and end-of-support dates. Put responsibility and costs into the procurement discussion.
- How does the transition affect service? Exercise connection setup, certificate renewal, recovery, and constrained network paths under realistic load. Record resource demand and failure behavior.
- Can the next migration be managed? Require a documented process for changing cryptographic components, updating policies, validating interoperability, and recovering safely from a failed change.
Protect the workflow during the change
Consider a hospital replacing a network appliance. The evaluation should include whether clinical access, partner connections, identity services, and signed updates continue to work during certificate or protocol changes. The goal is a migration plan that preserves essential workflows, with clear owners, evidence, and acceptance criteria.
Organizations should prioritize according to their own data sensitivity, retention needs, dependencies, and applicable obligations. A multi-year roadmap becomes useful when it is connected to actual purchasing and renewal decisions.
The next equipment refresh is an opportunity to reduce the next migration’s complexity.
At Atlas Global, this is a planning priority as we develop our infrastructure and vendor requirements. It is not a claim of completed deployment, certification, or independently validated quantum-safe operation.