The Most Dangerous Green Check Mark in National Security
On Oct. 1, the National Security Agency sharpened America’s post-quantum deadline. Beginning in 2027, new commercial National Security Systems must be capable of supporting quantum-resistant algorithms, and legacy systems that cannot do so are to be phased out by 2030.
TL;DR
- New commercial National Security Systems must support quantum-resistant algorithms by 2027, with legacy systems phased out by 2030.
- Evidence used to approve cryptographic configurations has an 'assurance half-life' and becomes stale when assumptions change.
- Executive Order 14412 and OMB directives push for dynamic cryptographic inventories and monitoring.
- A system's migration status must be distinct from its assurance status; 'migrated' does not automatically mean 'secure'.
- Practical rules include labeling test results with scope, defining events that shorten evidence lifetime, separating migration and assurance status on dashboards, and treating recovery as a new assurance decision.