Post-Quantum Cryptography Is Here: What Organizations Should Migrate First
NIST has standardized post-quantum algorithms. Learn what ML-KEM, ML-DSA and SLH-DSA do and how to plan a realistic migration.
A future quantum computer does not need to exist in your server room to create a security problem today. If an attacker captures encrypted information now and can decrypt it years later, the information may still be sensitive when that future arrives.
That scenario is one reason post-quantum cryptography (PQC) has moved from research into standards. In August 2024, the US National Institute of Standards and Technology approved three Federal Information Processing Standards: FIPS 203, FIPS 204 and FIPS 205. The standards define algorithms intended to withstand attacks from sufficiently capable quantum computers.
This is not a claim that today's public-key encryption has already been broken at scale. It is a reason to plan for long-lived systems rather than waiting for an emergency.
Understand the three standards without the mathematics
Traditional public-key cryptography supports tasks such as establishing secure communication and verifying signatures. The NIST standards address those jobs using different mathematical foundations.
| Standard | Algorithm | Primary purpose |
|---|---|---|
| FIPS 203 | ML-KEM | Establishing a shared secret |
| FIPS 204 | ML-DSA | Digital signatures |
| FIPS 205 | SLH-DSA | Digital signatures using a stateless hash-based approach |
A key-encapsulation mechanism is not the same as an encryption app. It is a building block that helps two parties agree on secret key material. A digital signature helps verify authenticity and detect changes. Organizations need both functions, but not necessarily in the same deployment sequence.
The hard part is finding the cryptography you already use
Most companies cannot answer, from memory, which algorithms appear in every mobile app, payment gateway, certificate, database connection, backup system and third-party device. That inventory gap is often a bigger initial obstacle than the choice of algorithm.
Start with a cryptographic asset inventory. Record the system, business owner, data sensitivity, expected confidentiality lifetime, cryptographic library, certificate dependencies and vendor upgrade path. Add a field for whether the component can be updated without replacing hardware.
For example, a short-lived promotional page and a long-retention medical archive may deserve different migration priorities. The archive's data could remain sensitive long after its current cryptographic controls were selected.
Prioritize by exposure, not by headlines
A sensible sequence is:
- Identify sensitive information that must remain confidential for many years.
- Find externally exposed systems and dependencies that are difficult to upgrade.
- Ask vendors about standards support and interoperability testing.
- Test candidate changes in a staging environment, including performance and message-size effects.
- Roll out gradually with monitoring and rollback procedures.
NIST's migration resources emphasize planning and discovery. Organizations should not replace mature, reviewed libraries with an improvised “quantum-safe” implementation written from a blog tutorial.
Beware three common mistakes
Mistake one: treating quantum-resistant as invulnerable. An algorithm can address a class of mathematical attacks while a system remains vulnerable to stolen credentials, weak access controls, malicious updates or poor implementation.
Mistake two: replacing every component at once. A rushed migration can break interoperability between clients, servers and hardware devices. Testing should include old devices, certificate chains and disaster recovery.
Mistake three: confusing a draft roadmap with a final standard. NIST's published materials include final FIPS standards and separate draft migration guidance. Track document status as well as the date.
A one-week starter plan
Day one: name an owner. Day two: identify the ten systems holding the longest-lived sensitive data. Days three and four: contact the relevant vendors and inspect cryptographic dependencies. Day five: write a risk-ranked migration backlog.
The deliverable is not a declaration that the company is “quantum-proof.” It is an auditable plan that can evolve as standards, software support and threat assessments change.
FAQ
Should every company deploy PQC immediately?
Every organization can begin discovery and risk assessment now. Deployment urgency depends on data lifetime, exposure, regulations, dependencies and tested product support.
Will PQC stop phishing or ransomware?
No. It addresses specific cryptographic threats and does not replace ordinary security controls.
Sources and further reading
- NIST, approval of FIPS 203/204/205, 13 August 2024
- NIST NCCoE, migration to post-quantum cryptography
Editorial notes
Visual: Post-quantum migration priorities. Original diagram showing inventory, data lifetime, vendor testing and staged deployment.
Verification note: Facts were checked against the linked primary or specialist sources on 13 October 2026. Forecasts are labeled as forecasts, illustrative calculations as hypothetical, and the article does not constitute personalized legal, medical, or investment advice.