If you needed one season to mark the moment post-quantum security stopped being a research topic and became an operational deadline, this was it. Three federal dates now sit within seven months of each other, all pointing the same way.
June 2026: the White House escalates
A presidential action on securing the nation against advanced cryptographic attacks directed federal agencies, and by extension their suppliers, to accelerate the move to quantum-resistant cryptography. Executive actions are how the federal government tells its supply chain that the polite phase is over.
September 21, 2026: the certificate cutoff
Cryptographic modules validated under the old FIPS 140-2 standard move to historical status. For new federal procurement, only the newer 140-3 validation line counts. Vendors have known this date for years, which is why product lines everywhere are being re-validated and, while they are at it, rebuilt for post-quantum algorithms. When your vendors upgrade, you inherit the change whether you planned for it or not.
January 1, 2027: the procurement wall
Under the NSA's CNSA 2.0 timeline, new national security system acquisitions must support quantum-resistant algorithms, and software and firmware signing moves to post-quantum exclusively. The full transition runs to 2033, with the old algorithms deprecated across federal use by 2030 and disallowed by 2035 under NIST's transition plan. Procurement rules are how standards become market forces: sell to the government, or to anyone who does, and the requirement finds you.
The pattern worth noticing: none of these dates depends on when a quantum computer arrives. The government stopped indexing its planning to the machine and started indexing it to the migration time. That is the correct way to reason about it, and it works just as well for a mid-market company as for an agency.
Meanwhile, the hardware keeps moving
IBM holds to a 2029 target for fault-tolerant quantum computing and reported record systems through 2025 and 2026. Google set 2029 as its own internal deadline for migrating its cryptography. Research published over the past year kept cutting the estimated cost of breaking RSA-2048, from about 20 million noisy qubits in the 2019 literature to under one million today. Estimates will keep moving. Deadlines will not move with them.
What we are telling clients
- Name an owner. Most companies cannot answer "who owns cryptography here." That answer costs nothing to fix and unblocks everything else.
- Ask your vendors in writing. One email to your top ten software and infrastructure vendors: what is your post-quantum plan and date. Their answers are your real exposure map.
- Start the inventory. You cannot migrate what you cannot find. Certificates, VPNs, email, backups, code signing. This is weeks of work, not years, and it is the prerequisite for everything.