Post-Quantum Cryptography Migration Playbook

On October 27, 2026, NIST published the final version of IR 8547, and it changed the plan most organizations were working from.

The final text deprecates all quantum-vulnerable public-key algorithms after 2030, at every strength, and disallows them after 2035. This is not another explainer about how quantum computers work. It is a migration playbook built as a sequence you can run: inventory first, hybrid deployment second, theory only where it earns its place. For CIOs, CISOs, architects, and any supplier whose customers have started asking post-quantum questions.

Inside:

- The 2030 and 2035 clock, stated precisely, and how the deadlines reach your organization

- Harvest now, decrypt later, and a data-lifetime triage method you can score flow by flow

- The cryptographic inventory: how to build a CBOM and find public-key crypto where it actually hides

- The standards in practical terms: ML-KEM, ML-DSA, SLH-DSA, and stateful LMS and XMSS

- Hybrid key establishment, crypto-agility architecture, vendor questions, and a phased roadmap with exit criteria

The deadlines are set. Run the migration in order, starting now.