NIST has already crossed the standards threshold. FIPS 203, 204, and 205 are finalized, and NIST now tells organizations to begin migrating to quantum-resistant cryptography. The difficult work is no longer choosing whether post-quantum algorithms exist. It is finding every place today’s public-key cryptography is embedded, understanding what depends on it, and changing those systems without breaking the services they protect.
The standards are ready. The estate is not.
NIST finalized FIPS 203 for ML-KEM key establishment, FIPS 204 for ML-DSA digital signatures, and FIPS 205 for SLH-DSA digital signatures. NIST’s current PQC guidance says organizations should begin applying the standards now.
That sounds like an algorithm transition. NCCoE’s migration work makes clear that it is an infrastructure transition. Public-key cryptography can sit inside applications, certificates, identity systems, software libraries, hardware, firmware, network protocols, code-signing processes, vendor products, and services that an organization does not directly control.
Migration starts with cryptographic visibility
NCCoE organizes the problem around cryptographic discovery and inventory, plus interoperability and benchmarking. The first workstream asks where vulnerable cryptography is used; the second asks whether replacement implementations work together in real protocols and products.
A migration plan built without that inventory can miss the most consequential dependencies: a certificate chain used by machines, a supplier appliance with fixed cryptographic support, an embedded device that cannot be patched easily, or a signing workflow shared across multiple business systems. NCCoE’s June 2026 FAQ explicitly frames cryptographic visibility and risk management as a first migration phase and treats interoperability as a separate execution problem.
“Replace RSA or ECC with a PQC algorithm.”
This is necessary at the cryptographic primitive layer, and the NIST standards define the new building blocks.
“Map every dependency that uses the old primitives.”
Applications, protocols, devices, certificate systems, suppliers, and operational processes have to change together or in a deliberately staged sequence.
Crypto agility is the durable capability
NIST’s updated 2026 crypto-agility guidance defines the broader objective as the ability to replace and adapt cryptographic algorithms across protocols, applications, software, hardware, firmware, and infrastructure while preserving security and ongoing operations. That matters beyond the quantum transition. Organizations that can identify where cryptography lives, change it deliberately, and test interoperability are better positioned for the next algorithm transition too.
CSWP 39upd1, published June 29, 2026, surveys operational mechanisms, trade-offs, and practices for changing cryptography without disrupting running systems.
The mission team is broader than security engineering
A credible PQC program needs cryptographers and security engineers, but also PKI owners, application teams, network engineers, hardware and firmware specialists, identity architects, procurement, vendor-management, risk, compliance, testing, and business owners who understand which services cannot tolerate disruption. Some of those capabilities will live inside the organization; others will sit with vendors or specialized external experts.
You cannot migrate cryptography you cannot see.
The headline risk is a future quantum computer. The operational risk today is incomplete knowledge of where vulnerable cryptography lives and who owns each dependency. A technically correct algorithm choice can still fail as a program if inventories are incomplete, suppliers are not ready, protocols do not interoperate, or changes cannot be rolled through production safely.