How Businesses Can Prepare for Post-Quantum Encryption

Businesses can prepare for post-quantum encryption in four moves: list where they use public-key cryptography, protect long-lived data first, turn on hybrid post-quantum key exchange where their vendors already support it, and write post-quantum support into every new contract. The deadlines are no longer vague. Under NIST’s final transition report, published on October 27, 2026, RSA and elliptic-curve algorithms are deprecated after 2030 and disallowed after 2035. A June 2026 executive order gives high-value federal systems until December 31, 2030, to switch their key exchange.

That leaves most firms about nine years to replace cryptography that sits in almost every login, VPN, website and signed software update they run, which sounds long until you count the vendors, devices and certificates involved. The work is mostly inventory and procurement rather than math, and it can start this quarter.

The Post-Quantum Standards Your Vendors Will Use

NIST finished the first three post-quantum standards on August 13, 2024. Each replaces a job that RSA or elliptic curves do today.

NIST picked HQC as a backup to ML-KEM because it rests on different math. If someone finds a flaw in the lattice problems behind ML-KEM, HQC gives the world a second option. Most businesses will never choose between them directly, because they will buy products that support ML-KEM now and can add HQC later.

What Changed in NIST’s Final Transition Report

The final NIST IR 8547 tightened the 2024 draft in one way that affects almost everyone. The draft deprecated only the weakest key sizes after 2030. The final version deprecates all quantum-vulnerable public-key algorithms after 2030, so RSA-3072, P-256 ECDSA and Ed25519 are on the same clock. Deprecated means you may still use them if you accept the risk. Disallowed, after 2035, means they no longer meet NIST standards.

The final text also settles three practical points for buyers. First, ML-KEM-768 is named the recommended default. Hybrid key exchange, such as ML-KEM combined with classic ECDH, can be FIPS 140 validated if at least one part is NIST-approved. And the lightweight Ascon cipher was added to approved symmetric tools.

Deadlines from the White House and NSA

Private companies are not bound by federal rules unless they sell to the government. Many do, and many more sell to companies that do, so these dates flow down the supply chain.

CNSA 2.0 is stricter than NIST in two ways. It requires the highest security level of each algorithm, ML-KEM-1024 and ML-DSA-87, plus AES-256 and SHA-384 or SHA-512. And it sets dates by product type, summarized below.

If you sell networking hardware to defense customers, the 2026 milestone is already here, and if you sell software, signed updates are the first job.

How a Quantum Computer Would Break Today’s Encryption

Public-key cryptography rests on math problems that are easy to set up and very hard to reverse. RSA relies on the difficulty of splitting a huge number into its two prime factors, and elliptic-curve systems rely on a related problem called the discrete logarithm. A normal computer would need an impractically long time to solve either one at today’s key sizes, which is why the internet trusts them.

A large, error-corrected quantum computer changes that picture because of a method published by Peter Shor in 1994. Shor’s algorithm solves both factoring and discrete logarithms efficiently, so making RSA keys longer only buys a little time. The new NIST algorithms avoid this trap by building on different problems, such as finding short vectors in high-dimensional lattices or the security of hash functions, which no known quantum method solves quickly.

Symmetric encryption is in a much better position. The best known quantum attack on a cipher like AES, Grover’s algorithm, roughly halves the effective key strength, so a 256-bit key still leaves a very large margin. That is why the migration effort focuses on key exchange and signatures, and why your encrypted disks and databases can usually keep their AES keys while the handshakes around them change.

The deadlines exist even though today’s cloud quantum computers are small and noisy, because replacing cryptography across a whole economy takes a decade or more, and because recorded traffic cannot be re-encrypted after the fact.

Why Data Stolen Today Is Already at Risk

The threat is often called “harvest now, decrypt later,” and it works like this: an attacker records encrypted traffic today and stores it, and years from now a large enough quantum computer could break the key exchange that protected it, and the old data opens up. Signatures are a different risk. A forged signature only matters once a quantum computer exists, so signature migration can follow encryption by a year or two, which is exactly the gap the executive order allows.

A Worked Example with Mosca’s Rule

Security researcher Michele Mosca proposed a simple test. Let x be how many years your data must stay secret. Let y be how many years your migration will take. Let z be how many years remain before quantum attacks are practical. If x + y is greater than z, you are already late.

Nobody knows z, so for planning we used NIST’s own 2035 cutoff, which leaves nine years from 2026. We assumed a five-year migration, a figure each firm should replace with its own, and the data lifetimes are our examples rather than legal retention rules.

The point of the table is ranking, not precision. Any data that must stay private past the mid-2030s should move to post-quantum key exchange first, which in practice means the connections that carry it: VPN tunnels, file transfers, backups and links between offices and cloud services.

What Post-Quantum Algorithms Cost in Bytes

Post-quantum keys and signatures are much larger than the ones they replace. That is the main engineering cost, and it explains why some devices will take longer to upgrade.

We added up a typical key exchange. With classic X25519, the two sides swap 32-byte keys, or 64 bytes in total. With ML-KEM-768, one side sends a 1,184-byte public key and the other returns a 1,088-byte ciphertext, for 2,272 bytes. A hybrid exchange sends both, so the extra cost is a little over 2 KB per new connection. For a web server that is small, but for a sensor on a low-power radio link it can be the difference between one packet and several.

Signatures grow even more. An ECDSA P-256 signature is 64 bytes. ML-DSA-65 is 3,309 bytes, and a certificate chain carries several signatures plus public keys. That is why certificate authorities, smart cards and firmware signing are the slowest parts of the move, and why NIST is still finishing FN-DSA, which aims for smaller signatures.

A Post-Quantum Readiness Plan for 2026 to 2035

We turned the deadlines above into a plan a mid-size company can follow. Treat the years as targets, and pull them in if you sell to the federal government.

2026 to 2027: Find and Rank

1. Build a cryptographic inventory: list where your systems use RSA, ECDH, ECDSA or Ed25519, including VPNs, TLS on websites and APIs, SSH, code signing, email encryption, databases and backups. CISA’s coming guidance on a cryptographic bill of materials will give this list a standard shape.
2. Rank by data lifetime: use a Mosca-style table like the one above.
3. Ask every vendor for a roadmap: request dates for ML-KEM and ML-DSA support, and whether upgrades come at no extra cost.
4. Update procurement terms: require post-quantum support or a dated roadmap in new contracts.

2027 to 2030: Switch Key Exchange

1. Turn on hybrid TLS: many web stacks now support X25519MLKEM768, the hybrid that combines classic and post-quantum key exchange. Cloudflare says that in June 2026 over two-thirds of browser traffic to its network was already protected this way.
2. Upgrade VPNs and file transfers: these carry the long-lived data that harvest-now attacks target.
3. Test bigger handshakes: check load balancers, firewalls and older devices that may choke on larger messages.

2030 to 2035: Replace Signatures and Retire the Old

1. Move certificates and code signing to ML-DSA or hash-based schemes: start with internal PKI, where you control both ends.
2. Replace hardware that cannot upgrade: smart cards, HSMs and embedded devices with no post-quantum path.
3. Switch off RSA and elliptic-curve options: by 2035, they no longer meet NIST standards.

Where Post-Quantum Protection Is Already Available

A business does not have to wait for 2030 to start using these algorithms, because a good share of the supply chain already ships them. The examples below come from vendors’ own documents.

On the web, more than two-thirds of browser traffic reaching Cloudflare’s network used post-quantum key agreement in June 2026, by the company’s own count. If your site sits behind a large content delivery network, visitors with current browsers may already be protected on that first hop, even before you change your own servers.

In key storage, Thales Luna hardware security modules run ML-KEM and ML-DSA in firmware, along with the hash-based HSS signature scheme. In certificates, DigiCert’s private CA issues ML-DSA and SLH-DSA certificates and supporting ML-KEM keys, though not yet through its public CAs. In chips, SEALSQ announced its QS7001 secure chip with ML-KEM and ML-DSA built into the silicon in October 2025.

These products tell you something useful for planning. Private systems you control, such as internal certificates, VPNs and device fleets, can move first. Public systems that depend on browsers and public certificate authorities will move when the wider ecosystem does.

Questions to Put to Every Technology Vendor

Most of your post-quantum work will happen inside products you buy, so the vendor conversation matters more than any in-house code. These questions turn a vague promise into a date.

• Which NIST algorithms do you support today, and in which products? Ask for ML-KEM and ML-DSA by name, with parameter sets.
• Is the implementation validated? Ask about CAVP algorithm validation and FIPS 140-3 module status if you are regulated.
• Do you support hybrid mode? For key exchange, hybrid lets you keep classic protection while adding post-quantum protection.
• Can the algorithm be swapped without new hardware? This is crypto agility, and it decides whether HQC or FN-DSA can be added later.
• What will the upgrade cost? Some vendors include it in maintenance; others charge.
• When will RSA and ECC be switched off? The answer should line up with the 2030 and 2035 dates.

Our profile of post-quantum cryptography companies lists the chipmakers, HSM vendors, certificate authorities and discovery tools that answer these questions in their own product pages. Identity systems need the same questions, because passkeys and single sign-on rest on elliptic-curve signatures, a point we raise in our guide to passwordless authentication software.

Mistakes That Slow a Post-Quantum Migration

The first mistake is waiting for a quantum computer to appear in the news, since the data at risk is the data being recorded now and the federal dates are fixed regardless of lab progress.

The second is treating this as a one-off project. New algorithms will keep arriving: HQC as a backup, FN-DSA for small signatures, and more signature schemes still under study. A company that can swap algorithms through configuration will spend far less over the next decade than one that hard-codes them.

The third is forgetting the basics. Post-quantum encryption does nothing for a stolen password or a clicked phishing link. Keep the rest of your program in shape with our small business cybersecurity checklist, and teach staff to spot the lures in our phishing email examples.

The last is assuming symmetric encryption is broken too. AES-256 and SHA-384 remain in NSA’s CNSA 2.0 suite, so the urgent work is on public-key algorithms rather than on your encrypted disks.

Curious how today’s quantum machines actually work? You can run small programs on real hardware yourself, and our guide to accessing quantum computers through the cloud shows what that costs.

Short Answers on Quantum-Safe Encryption

When Do Businesses Need to Be Quantum-Safe?

NIST deprecates RSA and elliptic-curve algorithms after 2030 and disallows them after 2035. Federal high-value systems must use post-quantum key exchange by December 31, 2030.

Is AES Safe from Quantum Computers?

AES-256 remains in NSA’s CNSA 2.0 suite. The algorithms at risk are public-key ones such as RSA, ECDH and ECDSA.

What Is ML-KEM?

ML-KEM is the NIST-standard post-quantum method for agreeing on an encryption key, published as FIPS 203 in August 2024. ML-KEM-768 is NIST’s recommended default.

Do Small Businesses Need to Do Anything Now?

Yes, but mostly through vendors. Ask your VPN, cloud, website and software providers for their post-quantum dates, and favor products that already support hybrid key exchange.

NIST Standards, Federal Orders and Vendor Notes Behind This Plan

• NIST: FIPS 203 (ML-KEM)
• NIST: FIPS 204 (ML-DSA)
• NIST: FIPS 205 (SLH-DSA)
• NIST: HQC Selected as Fifth Post-Quantum Algorithm (March 2025)
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards (Final)
• Cloud Security Alliance: Research Note on Final NIST IR 8547
• The White House: Executive Order 14412 (June 22, 2026)
• NSA: CNSA 2.0 Algorithms Advisory
• PostQuantum.com: CNSA 2.0 Complete Guide
• Cloudflare Blog: Post-Quantum Update (June 2026)
• Thales: Luna HSMs Post-Quantum Readiness Solution Brief
• DigiCert: Post-Quantum Cryptography in Private CA
• SEALSQ: QS7001 Secure Chip Announcement