NIST finalized IR 8547 on October 27 with its transition roadmap. For U.S. federal high-value and high-impact systems, the June 2026 order sets December 31, 2030 for PQC key establishment and December 31, 2031 for digital signatures; OMB directs agencies to prioritize as much mitigation as feasible by the end of 2030. NIST's broader transition plan phases out quantum-vulnerable algorithms by 2035. These are federal policy timelines, not universal deadlines for every organization.
The operating signal
NIST's NCCoE migration project has two workstreams: Cryptographic Discovery and Interoperability testing. The discovery workstream demonstrates inventory tools that help organizations learn where and how cryptography is used and use that visibility to support risk management and migration prioritization.
NIST's project demonstrates cryptographic discovery and inventory capabilities so organizations can identify where cryptography protects important data and systems and prioritize migration decisions. The six-field format below is Assemble Teams' compact operating translation of that need—not a NIST-required schema.
NIST's finalized post-quantum standards are ready for implementation, while its migration work emphasizes that products, protocols and services must also become interoperable. That means organizations can be “standards aware” and still be operationally unready.
A six-field starter inventory
Where is the cryptography?
Name the application, device, service, workload, data flow or external dependency.
What job is the cryptography doing?
TLS, SSH, VPN, code signing, certificate authentication, email encryption or another use.
What is actually in use?
Record the algorithm family, certificate chain and lifecycle metadata without storing secret key material in the inventory.
Who can authorize the change?
Assign the system owner, security owner and vendor/contact needed to execute migration.
What fails if this remains vulnerable?
Capture confidentiality lifetime, operational consequence, external exposure and dependency criticality.
What must change before this can migrate?
Vendor release, protocol support, hardware refresh, certificate infrastructure, interoperability testing or another prerequisite.
What this changes
Assemble Teams analysis: the useful unit for PQC planning is not “number of systems.” It is cryptographic dependency with consequence and an executable migration path. That is what turns inventory into prioritization.
What the evidence does not prove
This six-field inventory is Assemble Teams' compact starter format, not a NIST certification checklist. Organizations with regulated, safety-critical or highly complex environments will need deeper asset, protocol, vendor, key-management and testing data. NIST's materials should remain the authoritative source for its standards and migration guidance.
Start with ten critical systems.
Do not wait for a perfect enterprise inventory. Select ten high-consequence systems, document the six fields, then use the gaps to define discovery tooling and vendor questions.
Browse Communications & Cyber missions →Additional primary sources: NIST Post-Quantum Cryptography and NCCoE Migration to PQC project.