NSA Announces Post-Quantum Cryptography Measures for National Security Systems

NSA Pushes Quantum-Resistant Cryptography Across National Security Systems

The U.S. National Security Agency has announced new initiatives aimed at protecting National Security Systems (NSS) against emerging threats from quantum computing.

The announcement centers on expanding the use of post-quantum cryptography (PQC) and providing resources to support a large-scale transition to quantum-resistant algorithms.

NSA said the effort aligns with Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," and is intended to strengthen the cybersecurity posture of the Department of War (DOW) and the Defense Industrial Base (DIB).

The agency is also developing post-quantum cryptography resources to guide organizations through the transition.

The announcement comes as governments and organizations prepare for the possibility that future quantum computers could undermine some cryptographic protections used by today's systems.

What the NSA Announced

The NSA said that starting in 2027, all new commercial National Security Systems must be capable of supporting quantum-resistant algorithms.

The agency also said legacy systems that cannot support quantum-resilient algorithms are to be phased out by 2030.

These requirements are identified in the announcement as being mandated by Committee on National Security Systems Policy 15.

The policy direction places compatibility with quantum-resistant cryptography directly into the lifecycle of national security systems.

For new systems, the requirement begins in 2027.

For legacy systems that cannot support quantum-resilient algorithms, the transition extends through 2030.

The announcement does not provide additional technical specifications about which individual algorithms will be required for every system or how each legacy system will be transitioned.

The company did not provide specific information about this area.

Why Post-Quantum Cryptography Matters

Quantum computing creates a long-term challenge for existing cryptographic systems.

NSA says adversaries are already employing "harvest now, decrypt later" strategies.

Under this approach, encrypted information can be collected today with the expectation that future quantum computing capabilities could make it possible to decrypt that information later.

The agency also highlights another concern it calls "trust now, exploit later."

This relates to the need to protect current architectures against future quantum-enabled attacks rather than waiting until sufficiently capable quantum computing becomes available.

The NSA's position is that organizations need to begin the transition to quantum-resistant algorithms before such capabilities become available at scale.

This makes post-quantum cryptography a migration and preparedness issue rather than simply a future research topic.

Three Security Areas NSA Highlights

The NSA says adopting quantum-resistant algorithms can help organizations address three key security objectives.

1. Protect Sensitive Data

Quantum-resistant cryptography is intended to help ensure that encrypted information remains protected even if an adversary intercepts it today.

This is particularly relevant to information that needs to remain confidential for extended periods.

2. Secure Authentication

The NSA also identifies authentication as an important area of protection.

Quantum-resistant algorithms can help maintain the integrity of authentication systems, protecting user identities and reducing the risk of unauthorized access.

3. Safeguard Critical Systems

The third area involves systems supporting national security personnel and operations.

The objective is to maintain cryptographic protection for systems that support national security activities as the threat environment evolves.

NSA Says the Transition Requires Industry and Academia

The NSA says it is working with academia and industry on the transition to quantum-resistant cryptography.

According to the agency, those efforts include:

• Developing standards

• Developing guidelines

• Educating stakeholders

• Integrating advanced algorithms

• Strengthening digital defenses

Morgan Stern, NSA's Effort Lead for Quantum Resistance, said the agency is working with academia and industry to support the transition and strengthen digital defenses.

The announcement frames the transition as a broad effort involving stakeholders across the national security ecosystem rather than an isolated technology deployment.

NSA also says it is continuing to develop resources for the Department of War, National Security Systems, and the Defense Industrial Base.

The "Weakest Link" Problem

The NSA also emphasized the importance of consistency across connected systems.

Stern described the quantum threat as an existential threat to the digital ecosystem and said the community has tools available today to address it.

He also emphasized that the overall security of a network depends on its weakest link.

That point is particularly relevant to cryptographic migration.

Replacing cryptographic mechanisms in one part of an environment does not necessarily address systems that remain dependent on legacy cryptography.

The NSA's announcement does not provide a detailed migration methodology for individual organizations, so the specific implementation path will depend on the applicable system and organizational requirements.

Additional details were not disclosed in the announcement.

NSA's Post-Quantum Cryptography Resources

The NSA said it is continuing to develop resources to help stakeholders transition to quantum-resistant cryptography.

The agency's current cybersecurity resources highlighted in the announcement include its Post-Quantum Cryptography Resource Hub, along with resources for the Defense Industrial Base and Zero Trust implementation.

Post-Quantum Cryptography Resource Hub

The NSA's resource hub is intended to provide guidance for stakeholders preparing for the transition to quantum-resistant algorithms.

DIB Cybersecurity Services

NSA's Cybersecurity Collaboration Center provides services for the Defense Industrial Base.

The announcement specifically identifies resources including:

• Attack surface management

• Protective DNS

• DIB-specific NSA threat intelligence

Zero Trust Implementation Guidelines

NSA also points stakeholders toward its Zero Trust Implementation Guidelines.

The agency describes these as consumable, interactive cybersecurity resources intended for users across enterprise levels.

What Changes for National Security Systems?

The NSA announcement establishes a clear direction for cryptographic modernization.

For new commercial NSS, quantum-resistant algorithm support becomes a requirement starting in 2027.

For legacy systems that cannot support quantum-resilient algorithms, the stated deadline is 2030 for phase-out.

That means quantum-resistant cryptography becomes part of both new-system design and legacy-system planning.

For organizations operating in or supporting the national security ecosystem, the announcement signals that cryptographic modernization needs to be considered as part of broader system lifecycle management.

The NSA has not provided a complete implementation roadmap for every system category in this announcement.

Additional details were not disclosed in the announcement.

The Broader Shift Toward Post-Quantum Security

The NSA announcement reflects a broader industry and government shift toward preparing cryptographic infrastructure for a future in which quantum computing could threaten some existing cryptographic protections.

The important point is that the transition is being treated as a long-term infrastructure change rather than something organizations can necessarily address at the moment quantum systems become capable of breaking existing protections.

The "harvest now, decrypt later" concern is particularly relevant to data with long confidentiality requirements.

For organizations, the practical implication is that cryptographic dependencies, system compatibility, authentication mechanisms, and legacy infrastructure may need to be considered as part of long-term security planning.

This is an analytical implication of the NSA's announcement, not an additional requirement announced by the agency.

What the NSA Announcement Does Not Specify

The October 1 announcement establishes the transition direction and key deadlines, but it does not provide all implementation details.

The press release does not specify:

• A complete list of required algorithms for every NSS

• Individual migration plans for legacy systems

• System-by-system transition deadlines

• Detailed technical implementation requirements

• Specific cryptographic key sizes

• A complete inventory of affected systems

• A detailed assessment of current quantum computing capabilities

Additional details were not disclosed in the announcement.

Organizations should therefore distinguish between the requirements explicitly stated in the press release and technical guidance that may be provided through NSA's continuing post-quantum cryptography resources.

Conclusion

The National Security Agency has announced new measures to accelerate the transition toward quantum-resistant cryptography across National Security Systems.

The announcement sets two significant milestones:

2027: New commercial National Security Systems must be capable of supporting quantum-resistant algorithms.

2030: Legacy systems that cannot support quantum-resilient algorithms are to be phased out.

NSA says the effort is designed to address emerging quantum computing threats, including "harvest now, decrypt later" and "trust now, exploit later" scenarios.

The agency is also continuing to develop resources for the Department of War, National Security Systems, and the Defense Industrial Base, while pointing stakeholders toward post-quantum cryptography, DIB cybersecurity, and Zero Trust resources.

The broader message is straightforward: quantum-resistant cryptography is moving from long-term preparation toward an explicit system modernization requirement within the national security environment.

For organizations affected by the announcement, the transition will involve more than selecting new cryptographic algorithms. It will also require understanding where existing systems depend on cryptographic mechanisms that may not support the coming transition.

NSA's announcement provides the policy direction and deadlines, while additional implementation details are expected through the agency's continuing resources.