Your Chief AI Officer · Wednesday, October 28, 2026 · Act today
NIST publishes timelines for moving to post-quantum cryptography
Regulatory1 sourceFor patients
NIST released a report describing timelines and migration activities for federal agencies moving to post-quantum cryptography standards. NIST says it can serve as a resource for technology providers and organizations building quantum-readiness road maps.
On October 27, 2026, NIST released a finalized report, Transition to Post-Quantum Cryptography Standards (NISTIR 8547). It is the agency's high-level road map for moving off quantum-vulnerable algorithms and onto the quantum-resistant standards NIST published in August 2024. The report identifies which existing NIST cryptographic standards are vulnerable, sets out how they will be phased out, and describes timelines and migration activities for federal agencies. NIST says it can also serve as a key resource for technology providers and organizations building quantum-readiness road maps.
The dates are the news. According to NIST, National Security Memorandum 10 set 2035 as the primary target for completing migration across federal systems, and Executive Order 14412 accelerated that, requiring federal high-value assets and high-impact systems to migrate by 2030 for key establishment and 2031 for digital signatures. These apply to federal systems, but NIST notes that many organizations that work with the federal government will be affected as well.
For health organizations, the reason to act now is what NIST calls the "harvest now, decrypt later" threat: adversaries collect encrypted data today and wait for quantum capability to read it. NIST suggests prioritizing the key establishment standard, FIPS 203, for data that is particularly sensitive or must stay secure for a long time. Patient records and research data are the kind of long-lived, sensitive information that description fits.
What the evidence shows and does not: this is primary guidance from a federal standards agency, and it describes federal timelines, not private-sector mandates. NIST mathematician Dustin Moody, who heads the PQC standardization project, says there is not one strategy that fits all use cases. The report stresses that an organization's entire cryptographic supply chain matters, not only its own components. It also accommodates a hybrid approach that combines conventional encryption with PQC, which NIST describes as more conservative for security but more demanding of computing resources. NIST's National Cybersecurity Center of Excellence runs a companion project on practical tools and blueprints.
The move: ask your EHR, cloud and medical device vendors for their post-quantum migration road maps, and add the question to new contracts. Pair that with an internal inventory of where cryptography protects your most sensitive, longest-lived data. A planned migration protects patient trust and spares IT and security teams a rushed one later.
Do this week. Ask your EHR, cloud and medical device vendors for their post-quantum migration road maps and add the question to new contracts.
Run this
The prompt to act on this item, for your own model.
Paste it into Claude, ChatGPT or Copilot and fill the bracketed slots with your own numbers. The output is a draft for your team to check, built only from the sources on this page. Never paste patient data. How these prompts are written.
You are a security and technology advisor to the CISO and CIO of [your organization], a [type of health organization]. Context: On October 27, 2026, NIST released a finalized report, Transition to Post-Quantum Cryptography Standards (NISTIR 8547). It is NIST's high-level road map for moving off quantum-vulnerable algorithms and onto the quantum-resistant standards NIST published in August 2024. According to NIST, National Security Memorandum 10 set 2035 as the primary target for completing migration across federal systems. Executive Order 14412 requires federal high-value assets and high-impact systems to migrate by 2030 for key establishment and 2031 for digital signatures. These are federal timelines, not private-sector mandates, though NIST notes that many organizations working with the federal government will be affected. NIST describes the "harvest now, decrypt later" threat and suggests prioritizing the key establishment standard, FIPS 203, for data that is particularly sensitive or must stay secure for a long time. The report stresses that the entire cryptographic supply chain matters. It also accommodates a hybrid approach, which NIST calls more conservative for security but more demanding of computing resources. Task: Draft the questions we will send our vendors asking for their post-quantum migration road maps, and draft language that adds the question to new contracts. Output: A vendor question list for the executive team with these sections: EHR, cloud, medical devices, contract clause for new agreements, and internal follow-up (where our own cryptography protects our most sensitive, longest-lived data). Keep it to one page. Fill in: [your EHR vendor], [your cloud providers], [your main medical device vendors], [contracts due for signing or renewal this year], [whether you hold federal contracts or grants]. Guardrails: Use only the facts above and the slots I fill. Cite the source by name: NIST News, NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards. Flag anything uncertain or that legal, procurement or vendors must verify. Include no patient data. Nothing here is medical or legal advice. Label the result a draft for the team to check.
- The claim.
- NIST says the report can guide organizations developing quantum-readiness road maps.
- The evidence.
- This is primary guidance from NIST, a federal standards agency; it describes federal timelines rather than private-sector mandates.
By seat
For the Chief AI Officer. Flag long-lived patient and research data as the category most exposed to future decryption.
For the CISO and security. Begin a cryptographic inventory of where encryption protects patient data at rest and in transit.
Checked before publishing. A primary source: a peer-reviewed journal or a regulator.
Sources
Drafted by Lumen from the sources above, scored by a second pass on six criteria, then checked by rule against those sources (every figure, two independent outlets or a primary source) and published only when it passes. A person can pull any item, and corrections are published here. Apolitical, always. Nothing here is medical advice. How Your Chief AI Officer is made.