On July 5, 2022, the Cybersecurity and Infrastructure Security Agency (“CISA”) and the National Institute of Standards and Technology (“NIST”) strongly recommended that organizations begin preparing to transition to a post-quantum cryptographic standard.  “The term ‘post-quantum cryptography’ is often referred to as ‘quantum-resistant cryptography’ and includes, ‘cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by” a CRQC (cryptanalytically relevant quantum computer) or a classical computer.  NIST “has announced that a new post-quantum cryptographic standard will replace current public-key cryptography, which is vulnerable to quantum-based attacks.”  NIST does not intend to publish the new post-quantum cryptographic standard for commercial products until 2024 but urges companies to begin preparing now by following the Post-Quantum Cryptography Roadmap. 

CISA and NIST strongly recommend that organizations:

Inventory Systems – inventory “systems for applications that use public-key cryptography.”

Test the Post-Quantum Cryptographic Standard – test the new cryptographic standard in a lab environment.  However, CISA and NIST advise that “organizations should wait until the official release to implement the new standard in a production environment.”

Establish a Transition Plan – establish a plan to transition to the new cryptographic standard, which includes:

• Conducting an interdependence analysis to “reveal issues that may impact the order of systems transition;”

• “Decommissioning old technology that will become unsupported upon publication of the new standard;” and

• “Ensuring validation and testing of products that incorporate the new standard.”

Establish Acquisition Policies – establish acquisition policies, including:

• “Setting new service levels for the transition,” and

• “Surveying vendors to determine possible integration into” an organization’s post-quantum cryptographic roadmap and “to identify needed foundational technologies.”

Alert Information Technology – alert your information technology departments and vendors about the transition to the post-quantum cryptographic standard. 

Educate Your Workforce – educate your “organization’s workforce about the upcoming transition” and provide applicable training.

Looking Forward.  CISA and NIST’s recommendation follows the publication of the National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems in May of 2022 and is consistent with the statement of Secretary Alejandro Mayorkas, Secretary of Homeland Security, in March 2021 that the transition to post-quantum cryptographic standards is a priority of the Department of Homeland Security.  Organizations and companies should expect further developments regarding the post-quantum cybersecurity standard in the coming months.