📅 September 21, 2026 — NIST’s CMVP moves every active FIPS 140-2 certificate to the Historical List. It doesn’t mean your crypto module is broken. It means federal agencies can no longer cite it to justify a new procurement. If your product’s federal sales story rests on FIPS 140-2 alone, that story stops working in about seven weeks… from a compliance standpoint, the clock effectively starts now.
📅 January 1, 2027 — NSA’s CNSA 2.0 becomes mandatory for every new National Security System acquisition. ML-KEM-1024 for key establishment, ML-DSA-87 for signatures. A system delivered the day after without them is non-compliant on arrival, full stop.
Two different triggers, two different buyer sets — but the same underlying problem: most organizations don’t actually know where classical cryptography is still running in their environment. You can’t migrate what you haven’t found.
That’s the discovery problem before it’s a migration problem. Cert inventories are usually incomplete, key material sprawls across systems nobody remembers to check, and “we’ll deal with it before the deadline” turns into a scramble the week before.
At Qubit Guard, we built our PQC discovery and migration tooling for exactly this gap — FIPS 140-3 compliant from the ground up, so the fix and the compliance story move together instead of one lagging the other.
If Sep 2026 or Jan 2027 is on your radar (or should be), now’s the time to run the inventory — not after the deadline moves the goalposts on you.
#PostQuantumCryptography #CNSA2 #FIPS140 #CyberSecurity #NSS