Start with an inventory of where you use public key cryptography, then plan to move to the post quantum standards NIST has published. No one can say when a quantum computer will break RSA or elliptic curve encryption, so this is a migration project with a long lead time, not an emergency.
What do we know and what don't we know?
We do not know the date. This post does not predict one. What we can cite is what standards bodies have done.
NIST published FIPS 203, 204 and 205 on 13 August 2024. They specify algorithms derived from CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+. NIST selected HQC for standardization on 11 March 2025, and FIPS 206, which will specify FALCON, was still in development on the page we fetched.
NIST says organizations should begin applying these standards now. Its project page states that NIST will deprecate and ultimately remove quantum vulnerable algorithms from its standards by 2035, and that high risk systems are expected to transition much earlier. The timeline comes from NIST IR 8547, an initial public draft from November 2024. Treat dates in a draft as subject to change.
Why plan now if the threat is uncertain?
Two reasons that do not require a prediction. First, migration is slow. Products, services and protocols need updates, and your suppliers must ship them. Second, data with a long secrecy life, such as health records or long term contracts, could be recorded today and decrypted later if a capable machine appears. That risk, often called harvest now, decrypt later, depends on how long your data must stay secret. We did not find that phrase on the NIST page we fetched, so treat it as a common industry description rather than a NIST statement.
What does government guidance say to do?
CISA's quantum page says organizations must begin preparing now. It describes federal agencies being required to maintain an inventory of IT vulnerable to quantum decryption, and says CISA maintains a list of product categories that support or plan to support post quantum standard algorithms. It points to work with NIST's NCCoE on discovery tools and on migration guidance, including for operational technology.
What does a good inventory contain?
For each system: where it uses public key cryptography (TLS, code signing, VPNs, SSH, certificates, JWTs, firmware signing, hardware tokens), which algorithms and key sizes, who owns it, how long the protected data must stay secret, and whether the vendor has a post quantum plan. Code and dependencies matter too. Libraries embed algorithms, and an SBOM helps you find which ones ship in which product.
What to do
- Appoint an owner for cryptographic inventory and agree a scope.
- Scan code, dependencies, certificates and configs for algorithm use, and record unknowns.
- Rank systems by how long their data must stay secret and how hard they are to change.
- Ask each critical vendor for a written post quantum plan and dates.
- Make algorithms configurable in new designs, so a swap is a config change, not a rewrite.
- Test the NIST standardized algorithms in a non production environment for size and performance effects.
- Re-read NIST and CISA pages each quarter, since drafts change.
Safeguard can help you inventory dependencies and generate SBOMs to see which libraries carry cryptography; it does not replace a cryptographic discovery program.
Quick check
Is there a date by which RSA will be broken?
No credible source can give one. NIST's removal target of 2035 is a policy date for its own standards, not a prediction of an attack.
Should I wait for FIPS 206 before starting?
No. Inventory, vendor questions and crypto agility do not depend on it.
Sources
- NIST: Post-quantum cryptography standardization
- NIST: Post-quantum cryptography project
- NIST IR 8547 initial public draft
- CISA: Quantum
Last reviewed: 18 October 2026.
