The quantum desk · Harvest-now-decrypt-later
The encryption protecting your files, deals, and designs today will eventually be broken by quantum computers. That is not a fringe prediction. It is the working assumption behind US federal deadlines that are already in force.
The part most companies miss: the theft happens first. Adversaries are capturing encrypted traffic now and archiving it for the day the hardware catches up. If your secrets need to stay secret for years, the clock started without you.
Every date below has already happened or is written into federal rules. No claim on this page needs a crystal ball, which is exactly why the careful people are moving.
The pattern to notice: the standards are finished, the mandates are in force, and the research keeps shortening the runway. In 2019, breaking RSA-2048 was estimated to need about 20 million noisy qubits. By 2025, published research had cut that estimate to under one million, running for about a week. The machines are not there yet. The math for what happens when they arrive is done.
FIPS 203, 204, and 205 standardize quantum-resistant encryption and signatures (ML-KEM, ML-DSA, SLH-DSA). The fix officially exists.
NIST picks HQC as a fallback encryption standard, hedging the main pick. A fourth signature standard is expected in 2026.
A presidential action on advanced cryptographic attacks pushes federal agencies and their suppliers to accelerate migration.
FIPS 140-2 validations moved to historical status. New federal procurement accepts only the newer 140-3 line.
Under NSA's CNSA 2.0, new national security system acquisitions must support post-quantum algorithms, and software signing goes exclusive. This flows down supply chains the same way CMMC did.
NIST's transition plan deprecates today's public-key cryptography by 2030 and disallows it by 2035. Everything using it gets migrated or gets left behind.
January 1, 2027 · CNSA 2.0
On January 1, 2027, new national security system acquisitions must support CNSA 2.0 post-quantum algorithms, under NSA's CNSA 2.0 guidance. It flows down supply chains the same way CMMC did.
Source: NSA, Commercial National Security Algorithm Suite 2.0. (PDF, opens in a new tab)
A copy of your data gets taken today. What happens next depends entirely on which key sealed it. Same file, same thief, two endings.
Security researchers call it the Mosca inequality: if how long your data must stay secret, plus how long migration takes, is longer than the time until a quantum machine arrives, you are already exposed. Set your two numbers. The verdict is arithmetic, not opinion.
Contracts and pricing: 3 to 5 years. Designs and IP: 10 or more. Health, legal, and defense records: decades.
Mid-market reality with vendors and legacy systems: 3 to 5 years. Nobody has done it in one.
For reference: IBM targets fault-tolerant quantum computing in 2029, and Google set 2029 as its own internal migration deadline.
The gray band is your migration. The amber band is how long the last data you encrypt stays sensitive. The green line is Q-Day.
No mid-market company needs a cryptographer on payroll. It needs an inventory, a ranked plan, and hands to execute it. That is deliverable now, with today's standards, and Baran is the rare firm that can also staff the engineers who do the work.
Six questions that locate you against the deadlines above: data shelf life, federal exposure, vendor posture, and who owns cryptography at your company. Scored on the spot. Most companies discover the answer to that last question is nobody.
Start it nowYou cannot migrate what you cannot find. We map every place cryptography lives in your business: certificates, VPNs, email, code signing, backups, and the vendor products underneath them. The output is a cryptographic bill of materials, the document every federal migration framework now assumes you have.
See pricingNot everything migrates at once. We run the shelf-life math on each class of data, rank what is genuinely exposed, and sequence a migration your budget can actually carry, mapped against CNSA 2.0, the NIST transition schedule, and your CMMC obligations where they overlap.
See pricingThe global bottleneck in post-quantum migration is people, not algorithms. Baran runs a talent desk for exactly this reason: when your roadmap needs PKI engineers or a migration lead, the same firm that wrote the plan staffs it. Advisory and execution, one desk.
The talent deskFor principals, family offices, and the professionals who advise them, Baran provisions dedicated private communication channels built on NIST post-quantum standards, with a zero-knowledge architecture: we hold no keys, so there is nothing for anyone to hand over. Quiet by design. Ask when you call.
Ten minutes tells you whether the clock matters for your data. Almost nobody at mid-market has run it. You would be first in your supply chain, which is the point.