NIST has published the final version of NIST IR 8547, “Transition to Post-Quantum Cryptography Standards”, dated October 27, 2026. It supersedes the Initial Public Draft released on November 12, 2024.

The report describes NIST’s approach to moving from quantum-vulnerable algorithms to post-quantum digital signature and key-establishment schemes, and identifies which existing standards IT products and services will need to retire. The report supports implementation of Executive Order 14412 and OMB Memorandum M-26-15, which direct federal agencies to prioritize migrating their most sensitive systems.

IR 8547 names FIPS 203, 204 and 205 as the replacement standards and sets the schedule: quantum-vulnerable RSA, ECDSA, EdDSA and Diffie-Hellman/ECDH are deprecated after 2030 and disallowed after 2035. Separately, EO 14412 requires federal high-value assets and high-impact systems to migrate key establishment by 2030 and digital signatures by December 31, 2031.

For federal CISOs and contractors, the practical payoff is a citable federal roadmap for sequencing cryptographic discovery, inventory, and algorithm replacement. IR 8547 is guidance that supports the directives, not a mandate itself. Organizations holding data with long confidentiality shelf-life should use finalization as the trigger to formalize harvest-now-decrypt-later risk prioritization.

Source: NIST CSRC