2026-2027 post-quantum cryptography readiness: the enterprise crypto-agility roadmap

Summary. The post-quantum transition stopped being theoretical in 2024. On 13 August 2024 NIST published FIPS 203, 204 and 205, the first standardized quantum-resistant algorithms. On 21 September 2026 the CMVP moves every active FIPS 140-2 validation to historical status, so those modules can no longer back new federal procurements. From 1 January 2027 the NSA's CNSA 2.0 requires new national-security acquisitions to support post-quantum algorithms. Browsers are already ahead of most enterprises: by early 2026 about 57.4% of browser-initiated TLS connections carried a hybrid ML-KEM key share, per Cloudflare. The threat model that makes this urgent is "harvest now, decrypt later," where an attacker records encrypted traffic today to decrypt it once a quantum computer exists. With the global average data breach at $4.44 million in 2025 (IBM), long-lived secrets recorded now are a real liability. This guide sets out the standards, the deadlines, and an inventory-first roadmap you can start this quarter.

What "quantum-safe" means now

A cryptanalytically relevant quantum computer (CRQC) would break the public-key cryptography that secures nearly all internet traffic. RSA and elliptic-curve algorithms such as ECDH and ECDSA rely on math problems a large quantum computer could solve efficiently. Symmetric ciphers like AES-256 and hash functions like SHA-384 are far less exposed, so the migration is mainly about replacing public-key exchange and signatures.

NIST spent eight years selecting replacements. Three standards are final, and a fourth is in progress:

ML-KEM is the workhorse for key exchange and is the algorithm already shipping in browsers. ML-DSA is the default for new signatures. SLH-DSA trades larger signatures for security that rests only on hash functions, a useful hedge if lattice assumptions ever weaken. The DigiCert engineering breakdown and the Cloud Security Alliance summary both walk through the parameter sizes, which matter because ML-KEM public keys and ciphertexts run 800 to 1,568 bytes and inflate every handshake.

The deadlines that actually set your timeline

Different mandates hit different organizations, but they cluster tightly in 2026 and 2027. Even if none of them binds you directly, they set vendor roadmaps, so your suppliers will move whether or not you ask.

The NIST FIPS 140-3 transition project confirms the 21 September 2026 date: the CMVP will automatically declare remaining FIPS 140-2 certificates historical. As SafeLogic explains, existing deployments keep working, but a historical module cannot support a new federal sale. If you sell software to government buyers, or you buy from vendors who do, that single date reshapes procurement.

The NSA's CNSA 2.0 advisory sets the national-security schedule: support in new acquisitions from 2027, networking equipment exclusive on CNSA 2.0 by 2030, operating systems, applications and cloud services by 2033, and full coverage by 2035. The CNSA 2.0 algorithms advisory lists the exact suite. Rob Joyce, then Director of NSA Cybersecurity, framed the reason for publishing early in 2022: "This transition to quantum-resistant technology in our most critical systems will require collaboration between government, National Security System owners and operators, and industry."

Harvest now, decrypt later: the clock already started

The uncomfortable part of post-quantum risk is that waiting for a quantum computer is the wrong mental model. Adversaries can record encrypted traffic and stored ciphertext today and decrypt it later, once a CRQC exists. Palo Alto Networks describes this harvest now, decrypt later pattern as the reason confidentiality has a shelf life measured against the arrival of quantum computing, not against today's calendar.

The math is simple. Take any secret whose confidentiality must outlast the mid-2030s: patient records, contracts, source code, biometric templates, long-term financial data, government correspondence. If that data crosses the wire under RSA or ECDH key exchange in 2026, an attacker who captured it can read it the day a CRQC arrives. Estimates of that arrival vary widely across researchers, which is exactly why the NSA advises planning now rather than betting on a date. The cost of getting it wrong is concrete: IBM's 2025 Cost of a Data Breach report put the global average breach at $4.44 million, and the US average at $10.22 million, with a mean time to identify and contain of 241 days.

Where post-quantum cryptography is already live

Enterprises often assume PQC is years away. The public internet says otherwise. Key exchange, the easiest piece to upgrade, has already flipped to hybrid by default across major clients:

• Chrome enabled post-quantum key exchange by default in April 2024, and Firefox followed in November 2024.

• Apple's platforms joined in October 2025.

• By October 2025, more than half of human-initiated traffic reaching Cloudflare used post-quantum key exchange, per Cloudflare's state of the post-quantum internet reporting.

• Major content delivery networks moved hybrid key exchange to default through late 2025 and early 2026, so a large share of public web traffic now negotiates it automatically.

The industry converged on one hybrid construction, X25519MLKEM768, which pairs a classical curve with ML-KEM so a break in either one still leaves the session protected. Cloudflare measured this hybrid key share on roughly 57.4% of browser-initiated connections by early 2026. The practical lesson: your outbound TLS is probably part of that number already, while your internal services, VPNs, code-signing and long-lived data stores are not. That gap is where the work sits.

The migration is inventory-first, not a product purchase

The most common mistake is treating post-quantum readiness as a tool you buy. It starts as discovery. You cannot migrate cryptography you cannot see, and most organizations have no accurate map of where keys, certificates, algorithms and libraries live across code, containers, appliances and third-party services.

Both NIST and CISA put cryptographic inventory first. The NCCoE Migration to PQC project recommends building visibility into code, libraries, applications and their algorithms, then augmenting a software bill of materials with a cryptographic bill of materials (CBOM). NIST IR 8547 sets the direction of travel by targeting deprecation of RSA and ECC by 2030, which turns "we will get to it" into a dated plan. The Quantum Insider's migration timeline analysis and Encryption Consulting's CNSA 2.0 guidance both stress that credible enterprise migrations run for years, so the sequencing matters more than speed.

Crypto-agility is the goal state: the ability to swap algorithms without re-architecting the application. In practice that means centralizing key and certificate management, putting a cryptographic abstraction layer between your code and specific algorithms, automating certificate lifecycles, and supporting hybrid modes during the transition. Get those foundations right and the next algorithm change, whenever FN-DSA or a future standard lands, is a configuration task rather than a rebuild.

A phased roadmap you can start this quarter

1. Inventory. Discover every use of public-key cryptography across code, TLS endpoints, VPNs, PKI, code signing, hardware security modules and vendor integrations. Produce a CBOM and tag each item with a data-confidentiality lifetime.

1. Prioritize by shelf life. Rank systems by how long their data must stay secret and by exposure. Long-lived secrets on public-facing links come first, because harvest-now-decrypt-later hits them hardest.

1. Turn on hybrid key exchange. Enable X25519MLKEM768 where your stack and libraries already support it, starting with external TLS, then internal service mesh and VPN tunnels.

1. Plan signature migration. Signatures are harder because of ecosystem dependencies. Map where ML-DSA, SLH-DSA and stateful hash-based signatures (LMS/XMSS) fit, especially for firmware and code signing.

1. Fix crypto-agility debt. Remove hard-coded algorithms, centralize certificate issuance, and add automated rotation so future swaps are routine.

1. Track FIPS 140-3. Where validated modules are required, confirm your vendors' FIPS 140-3 status ahead of the September 2026 historical transition.

Comparing your three real options

Most enterprises are choosing between three postures, not between vendors. The table makes the trade-offs explicit.

Doing nothing is a decision to let exposure grow while the deadlines close. Hybrid-now is cheap and cuts the biggest risk quickly. The full program is where crypto-agility, compliance and stored-data protection actually get solved.

India-specific considerations

For Indian enterprises and Global Capability Centres, the drivers are the same physics with a local overlay. The Digital Personal Data Protection Act 2023 (DPDP) makes organizations accountable for personal data over its full lifetime, and data harvested under today's key exchange stays sensitive for years. Teams that handle health, financial or identity data with long confidentiality windows should treat post-quantum key exchange as part of that duty of care, described in our DPDP engineering playbook. Cross-border data flows add a second reason to act: traffic that transits public networks is exactly what a harvest-now attacker collects. The good news is that hybrid key exchange is the same switch everywhere, and Indian teams building on AWS, Microsoft Azure or Google Cloud inherit much of the transport-layer work from those providers, leaving internal services, PKI and code signing as the local scope.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, with senior-led, multi-disciplinary engineering teams. We are CMMI Level 5 appraised, MSME registered and ISO 27001:2022 certified, and we work across AWS, Microsoft, Google and Kaspersky stacks. We run cryptographic inventory and crypto-agility assessments that map where your keys, certificates and algorithms live, produce a CBOM, prioritise systems by data-confidentiality lifetime, and stage hybrid TLS and signature migration without breaking production. Our work sits alongside our software supply chain security service, our secure, AI-assisted development practice and our multi-cloud security posture service; we design systems aligned with FIPS 140-3, CNSA 2.0 and DPDP requirements. To scope a readiness assessment, contact us.

FAQ

References

1. NIST, Post-Quantum Cryptography project

1. Cloud Security Alliance, NIST FIPS 203, 204 and 205 finalized

1. DigiCert, An in-depth look at the NIST PQC algorithms

1. NIST, FIPS 140-3 transition effort

1. SafeLogic, What happens on September 21, 2026

1. NSA, Future quantum-resistant algorithm requirements (CNSA 2.0)

1. NSA, CNSA 2.0 algorithms advisory (PDF)

1. Cloudflare, The state of the post-quantum internet

1. Palo Alto Networks, Harvest now, decrypt later

1. NCCoE, Migration to post-quantum cryptography

1. IBM, 2025 Cost of a Data Breach report

1. The Quantum Insider, Post-quantum migration timelines

1. Encryption Consulting, Quantum-proof with CNSA 2.0

_Last updated: 31 July 2026._