NSA sets 2027 and 2030 deadlines for post-quantum cryptography in national security systems

[RealChristopher10]

The US National Security Agency has announced new measures to move national security systems over to quantum resistant cryptography. It is a government announcement about defence systems, so please keep the thread focused on the technology and security side. The key dates are clear. From 2027, all new commercial products used in national security systems must support quantum resistant algorithms, and by 2030 legacy systems that cannot support them must be phased out

The measures apply to national security systems, the Department of War and the wider defence industrial base. They build on Executive Order 14412, titled Securing the Nation Against Advanced Cryptographic Attacks, and a national security systems policy known as CNSS Policy 15. Alongside the post-quantum guidance, the NSA is offering services to defence contractors including attack surface management, protective DNS and threat intelligence, plus zero trust implementation guidelines. That is a broad package, not just a quantum announcement

Morgan Stern, who leads the NSA's quantum resistance work, said the agency is at the forefront of the transition. He described the quantum threat as an existential threat to the digital ecosystem, but added that we have the tools today to combat it. The announcement specifically mentions adversaries using harvest now, decrypt later and trust now, exploit later strategies. Those phrases are becoming standard in security circles

This ties directly into our recent thread on post-quantum cryptography. The NIST standards are already finalised, so the technical building blocks exist, and the UK's National Cyber Security Centre has its own timeline running to 2035. The NSA's 2030 deadline for legacy systems is considerably tighter, which shows how seriously it takes the threat to secrets that need to stay protected for decades

Government deadlines like this tend to ripple out to the wider industry, as vendors build compliant products and then sell them to everyone. Do you think 2030 is achievable for legacy systems? And will this speed up post-quantum migration in the private sector?

Nsa Announces Post Quantum Cryptography Measures To Safeguard National Securitywww.nsa.gov

[Hidden Sookie]

The 2027 rule for new products is the realistic one. It is much easier to require new kit to support new algorithms than to replace everything already deployed

Every new purchase from now on moves things forward. Procurement rules are a powerful lever

[Jude_54]

Trust now, exploit later is a phrase I had not heard before. It seems to cover signed software and certificates, where a signature trusted today could be forged once quantum computers can break it. That is an underrated risk. Software supply chains rely completely on signatures

[Dylan54]

UK organisations should take note too. NCSC's 2035 deadline looks relaxed next to this. Allies sharing systems will need to move at the speed of the fastest partner. Defence suppliers selling to both countries will feel that first

[Weary Wolfhound]

2030 for legacy systems is very ambitious. Some defence systems are decades old and were never designed to be updated

Replacing them in four years would be a huge undertaking. Some will probably get exemptions

[Henry10]

Its coming folks!

[ProperJobs50]

Zero trust and protective DNS in the same announcement shows this is part of a wider security push, not just quantum. Good basic security still matters as much as new algorithms

Most breaches happen through simple mistakes. Patching and passwords still matter more day to day

[Liam98]

Calling it an existential threat to the digital ecosystem is strong language from the NSA. They are usually more measured

It suggests they think the timeline to a cryptographically relevant quantum computer is shorter than many assume. Or they simply want budgets approved quickly