Four-Phase Enterprise Post-Quantum Migration To-Do List
NIST IR 8547 proposes deprecating classical RSA-2048 and ECDSA P-256 in 2030 and disallowing them completely in 2035. Because FIPS 140-3 HSM procurement and root CA rollouts take 18 to 36 months, engineering teams should sequence key-exchange protection ahead of signature rotation.
Interactive Readiness Progress
0 of 11 engineering milestones checked (0%)
Phase 1: Cryptographic Discovery & Inventory (Months 1-2)
Phase 2: Public Ingress & SSH Hybrid Key Exchange (Months 2-4)
Phase 3: Internal Service Mesh, VPNs & Crypto-Agility (Months 4-9)
Phase 4: PKI Roots, HSMs & Code Signing Before 2030 Deprecation (Months 9-24)
Reviewed by Callum Reid, Principal Infrastructure & Cryptography Editor
Reviews enterprise PKI, HSM procurement lead times, and hybrid TLS migration plans.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- NIST IR 8547: Transition to Post-Quantum Cryptography Standards (NIST, 2030 Deprecation / 2035 Disallowance)
- OMB Memorandum M-23-02: Migrating to Post-Quantum Cryptography (U.S. Office of Management and Budget, Inventory & Prioritisation Framework)
Receive PQC Migration Deadline Reminders
PQC & Hybrid TLS Readiness BriefingsStore your email for quarterly updates tracking browser root CA support for ML-DSA and NIST IR 8547 finalisation. No emails are sent yet.