PQC Governance Digest: Cut-off 30 October 2026
Author: Brian Couzens | Cut-off date: 30 October 2026 | Signals verified: 1 | Regions scanned: 7
One signal. Seven regions scanned. The single publication that passed the editorial gate this week carries structural weight for every organisation running quantum-vulnerable cryptography.
1. United States: NIST Finalises IR 8547
Source: NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards, NIST Newsroom, 27 October 2026. Report: NIST IR 8547 (final), DOI 10.6028/NIST.IR.8547.
NIST published the final version of Internal Report 8547, Transition to Post-Quantum Cryptography Standards, on 27 October 2026. The report is the federal roadmap for migrating US government systems to the PQC standards finalised in August 2024 (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA).
The material change from the November 2024 initial public draft, now withdrawn: the draft proposed deprecation after 2030 only at the 112-bit security strength for RSA, ECDSA and the finite-field and elliptic-curve key-establishment schemes, with higher strengths running to disallowance after 2035. The final states that NIST "will deprecate all quantum-vulnerable cryptography after 2030", at every security strength, with disallowance after 2035. Organisations that scoped their PQC migration plans against the draft face a wider boundary at 2030.
Federal deadlines and their authorities:
Agencies must support TLS 1.3 no later than 2 January 2030 (EO 14306 and OMB M-26-15, as cited in IR 8547).
PQC key establishment for high-value assets and high-impact systems, excluding National Security Systems, by 31 December 2030 (EO 14412).
PQC digital signatures for the same systems by 31 December 2031 (EO 14412).
Quantum-vulnerable algorithms disallowed under NIST standards after 2035 (IR 8547). This is separate from the 2035 target for completing federal migration set by NSM-10.
IR 8547 recommends ML-KEM-768 as the default parameter set, notes that a FIPS specifying HQC-KEM is under development, and points to SP 800-227 for key-combiner guidance. Hybrid solutions are described as "typically expected to be temporary measures".
Agency PQC migration plans were due to OMB within 120 days of M-26-15's issue on 24 June, which falls on 22 October, five days before IR 8547 was published. Any plan that relied on the draft's deprecation scope needs revisiting. For a detailed comparison of what changed: NIST IR 8547: What Changed Between the Draft and the Final Report.
Strategic Implications
IR 8547 states that it supports implementation of EO 14412 and M-26-15, which makes it the reference text for federal migration planning. Any cryptographic inventory completed before 27 October that scoped only 112-bit algorithms for near-term action should be revisited against the wider deprecation boundary. Under EO 14412, the FAR Council must propose by 19 December 2026 a rule requiring covered contractors to comply with NIST FIPS, including PQC algorithms, by 31 December 2030.
Global Sweep
Null means no qualifying publication was identified in the sources reachable during the window. It is not proof that a body published nothing.
Region | In-window signals | Status |
North America | NIST IR 8547 final (27 October) | 1 signal |
Europe | None. ENISA, BSI, ANSSI, ETSI and EBA checked | Null |
India and South Asia | None. MeitY, CERT-In, RBI, SEBI, IDRBT and DSCI checked | Null |
Asia-Pacific | None. MAS, CSA Singapore, APRA, NISC Japan, JFSA, FSC/FSS Korea, HKMA and BSP checked | Null |
Latin America | None. BCB, CERT.br, Banxico, LACNIC and OAS checked | Null |
Africa and Middle East | None. SAMA, UAE TDRA, CBUAE, Bank of Israel, INCD, SARB, CBK and CBN checked | Null |
Global, Multilateral and Hyperscalers | None. FSB, IMF, OECD, ITU-T, NATO CCDCOE, WEF, Google, Microsoft, AWS, Cloudflare, IBM, Apple, Cisco, Thales, Entrust, DigiCert, PQShield and SandboxAQ checked | Null |
Attempted but unreachable, not counted as checked, and to be re-verified next run: BIS, ACSC, Bank Negara Malaysia, ECB, NCSC UK, OCC, SEC and FFIEC.
Previous Editions
Cut-off 23 October 2026 (5 signals)
Cut-off 16 October 2026 (8 signals)
Cut-off 9 October 2026 (4 signals)
Full archive: SITG-Consulting Blog
If your organisation needs to assess its exposure to the IR 8547 deprecation timeline, SITG-Consulting provides PQC readiness assessments and cryptographic transformation services.
Disclaimer: This digest is published by SITG-Consulting for informational purposes. It does not constitute legal, regulatory or technical advice. Primary sources are cited for publication and policy claims. Regional scan results reflect SITG-Consulting's own research window and accessible sources. Readers should verify applicability to their jurisdiction and circumstances.
Comments