On October 27, NIST published IR 8547, a roadmap for moving federal systems away from encryption standards that a future quantum computer could break. The report does not say such a computer exists. It sets a broad federal completion target of 2035, with earlier milestones of 2030 for establishing secure connections and 2031 for digital signatures in specified high-value federal systems.
Those dates apply to federal agencies and specified systems. A private business, nonprofit, or small operator is not automatically bound by the same schedule. Products and vendor services can still connect private organizations to federal contractors, so it is worth knowing whether someone else’s deadline will reach your systems through a dependency.
When a vendor or IT team calls a system “quantum ready,” the label does not show which components were checked or how a replacement was tested. The NIST roadmap makes the first practical step an inventory: finding where cryptography lives in certificates, software libraries, hardware, network protocols, applications, and vendor-managed services.
NIST also identifies “harvest now, decrypt later” risk. Someone could collect encrypted data today and hold it until more capable tools exist. If your organization keeps information that must remain confidential for years, that data may need attention before less sensitive material.
Four questions worth asking
When someone calls a system quantum ready:
- Can you show me where cryptography is used, including vendor-managed components and outside dependencies?
- Which parts are vulnerable, and who owns the upgrade path for each one?
- Does the replacement schedule account for how long our sensitive data must remain confidential?
- What testing followed each replacement to confirm the system still works correctly?
A team that cannot answer has not substantiated the label. Before a purchase or contract renewal, ask for the inventory first.