NIST issues guidance for federal agencies to prioritize post-quantum cryptography adoption

What happened

• The guidance details a risk‑based approach for selecting systems that require immediate post‑quantum cryptography upgrades.
• It recommends a phased implementation plan that starts with data‑at‑rest and high‑value communications.
• Agencies must document their prioritization criteria and report progress to the Office of Management and Budget.
• The document aligns with existing NIST CSF practices and references upcoming NIST SP 800‑208 standards.

Why it matters

Federal IT teams will need to inventory sensitive assets, map them to the recommended prioritization matrix, and allocate resources for PQC testing before 2031.

Business impact

Early adoption reduces the risk of costly retrofits later and ensures compliance with the statutory quantum‑resilience deadline, but may require additional budgeting and staff training.

What to check

1. 1

   inventory critical systemsHigh priority

   Create a catalog of all federal systems handling classified or high‑value data to identify PQC priorities.

2. 2

   apply NIST risk matrixMedium priority

   Use the guidance’s risk‑based matrix to rank systems for immediate PQC implementation.

3. 3

   report progress to OMBMedium priority

   Establish quarterly reporting on PQC adoption status as required by the guidance.