What happened
NIST published a migration report on Tuesday covering how and when organizations should abandon public key cryptography that a future quantum computer could break. The document is written for federal agencies, but it reads as the closest available playbook for everyone else, and its central message is that the first phase will be deliberately untidy.
Rather than a single cutover, NIST expects a hybrid period. Early deployments will either pair a classical algorithm with a quantum resistant one, or combine two post quantum algorithms built on different mathematics. The stated purpose is interoperability: quantum vulnerable and quantum resistant algorithms will be fielded and used alongside each other in many applications and systems during the transition. Hybrid designs also limit the blast radius of a flaw in any single algorithm, since the system stays protected while one component holds.
The clock is already running. The Office of Management and Budget directed agencies in June to migrate as much quantum risk as feasible by the end of 2030. NIST will deprecate all quantum vulnerable digital signature algorithms after 2030 and disallow their use under its standards after 2035. Its authors note that moving from standardization to full integration historically takes 10 to 20 years, which leaves very little slack against those dates.
NIST narrows the immediate urgency to four use cases: code signing in software development, asymmetric key sign in, data moving over public networks through TLS or VPNs, and email and document signing and encryption. User to machine authentication can wait, because a login session today is not decrypted later. Data in transit cannot wait, because of harvest now, decrypt later collection.
Why this is a GRC story
A crypto inventory is now an audit artefact. You cannot schedule a migration you cannot scope. Every certificate, signing key and legacy tunnel that terminates business data needs an owner and a date, and the honest starting point is that most inventories are thinner than the questionnaire suggests.
Hybrid adds risk while it removes risk. NIST is explicit that hybrid solutions raise implementation and architectural complexity, which increases security risk and cost during the transition, and that they are usually temporary measures leading to a second migration. So the roadmap has two phases, not one, and the budget and exception records should show that.
Deprecated is a decision, not a reprieve. NIST leaves risky algorithms usable in a deprecated state where data owners weigh their own exposure. That is a risk acceptance, which means a named approver, a rationale and a review date in the register rather than silence in an asset sheet.
What to watch
Whether regulators outside the United States adopt the 2030 and 2035 markers, since procurement clauses tend to follow NIST faster than legislation does. Also worth tracking is the second key encapsulation mechanism NIST selected as an alternative in 2025, which is still working through formal approval and will affect which hybrid pairings are considered standard. Vendors will start advertising quantum readiness well before they can document it, so the test is a signed inventory and a migration schedule, not a slide.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.