Post-Quantum Cryptography After NIST: The Crypto-Agility Timeline CISOs Should Be Working To

NIST published the first three finalised post-quantum cryptography standards in August 2024, covering ML-KEM for key encapsulation, ML-DSA for digital signatures, and SLH-DSA as a stateless hash-based signature alternative. Two years on, the CISO conversation has moved from the abstract question of whether quantum computing is real enough to worry about, to the concrete question of what a defensible migration timeline looks like for a US enterprise with a normal mix of vendor systems, in-house applications, and network infrastructure. The answer that has emerged is more disciplined than the initial commentary suggested, and it is worth naming precisely because the quiet organizations are already six to twelve months ahead of the loud ones.

The working assumption inside serious security programs is that the harvest-now-decrypt-later threat is the operative risk, regardless of when a cryptographically relevant quantum computer actually arrives. Any data that must remain confidential for a decade or more, and that traverses networks today using classical asymmetric cryptography, is already at risk in the sense that a well-resourced adversary can be capturing it now and holding it for later decryption. That framing has moved post-quantum migration from a theoretical roadmap item to a governance question that boards in banking, defense-adjacent industry, and healthcare are actively asking about.

The first concrete step the leading programs have taken is a cryptographic inventory. The purpose is not to migrate anything yet. It is to be able to answer three questions honestly: where in the estate is asymmetric cryptography actually used, which of those uses handle data with long confidentiality requirements, and which of those systems are under the organization's own control versus dependent on a third-party vendor's timeline. That inventory is unglamorous work, it takes several months for a large enterprise, and it is the precondition for any credible migration plan. Organizations that have skipped it and gone directly to pilot deployments of the NIST standards have generally had to backtrack once they discovered that critical systems in their supply chain were not going to be ready for a hybrid mode.

The second step is the crypto-agility posture. The lesson from previous algorithm transitions is that hardcoded cryptographic choices scattered across an application portfolio are the actual constraint on migration speed. The programs that are moving fastest in 2026 are the ones that spent the last eighteen months refactoring toward abstraction layers that make the underlying algorithm swappable, so that when they are ready to move production traffic to ML-KEM or ML-DSA, the code change is a configuration change rather than a rewrite. That refactoring work is what should be under way now, regardless of any specific deployment timeline for the post-quantum algorithms themselves.

The third step is the vendor question. The specific vendors that ship the cryptographic libraries, the TLS terminators, the hardware security modules, and the key management systems have variable readiness for the NIST standards, and the CISO's ability to accelerate any individual vendor is limited. What has worked in the programs we see is contractual: renewal cycles for cryptographic infrastructure now include specific commitments on post-quantum support timelines, and those commitments are being enforced. Vendors that cannot commit are being flagged in the risk register, not silently accepted.

The fourth step, which the most sophisticated programs have started, is targeted deployment of hybrid classical-plus-post-quantum modes in the specific traffic paths that carry the longest-lived confidential data. This is not a general migration. It is a scoped rollout to the specific channels where harvest-now-decrypt-later matters most, running in a mode that combines the classical algorithm with the post-quantum algorithm so that the traffic is protected as long as either one holds. That approach limits blast radius while producing real operational learning.

For a CISO reporting to a board in 2026, the working timeline that is being defended in audit committees looks something like this: cryptographic inventory complete in the current fiscal year, crypto-agility refactoring substantially in place within the next eighteen months, vendor commitments captured in renewal contracts as they come up, and hybrid deployment on high-value traffic paths starting now and expanding as vendor readiness allows. The organizations working to that timeline are not panicking, and they are not waiting. The organizations that are still treating post-quantum as an awareness topic will find themselves in a much less comfortable position when the harvest-now-decrypt-later question becomes a shareholder-letter question rather than a security-team question.