Three PQC deadlines hit CISOs’ desks this year. One already passed quietly. One just got paused. The third isn’t moving — and it’s the one with real teeth.
- FIPS 140-2 → Historical (Sept 21, 2026): NIST’s CMVP moved every FIPS 140-2 validated module certificate to Historical status. While deployed modules still run, CMVP guidance explicitly warns agencies against relying on them for new procurements. Most security teams haven’t audited which systems still lean on legacy modules.
2. CMMC 2.0 Phase 2 — Paused, Not Canceled: The Department of War suspended Phase 2 on July 13 citing cost and capacity. But make no mistake: NIST SP 800-171 Rev 2, DFARS 252.204-7012, and SPRS affirmations remain fully in force. This is a pause on the assessment mechanism, not a free pass.
3. CNSA 2.0’s Jan 1, 2027 Procurement Gate — Unaffected: Every new National Security System acquisition must support ML-KEM-1024 (FIPS 203) for key establishment and ML-DSA-87 (FIPS 204) for signatures. This track runs through the NSA, completely separate from DoW’s CMMC reform, and nothing in that pause touches it.
The Bottom Line:
The CMMC pause is not a signal that the post-quantum clock stopped. One deadline passed, one is in limbo, and the one with zero tolerance for ambiguity is roughly 12 weeks out.
If you can’t point to exactly which systems still depend on Historical FIPS 140-2 modules versus which are ML-KEM/ML-DSA-ready, that’s the gap to close in Q4.
At Qubit Guard, this is the exact question our CBOM discovery engine, QuantVision, is built to answer — mapping what’s actually running against FIPS 140-3/203/204/205 and CNSA 2.0 before a procurement deadline forces it for you.
How is your organization tracking which of these three compliance tracks actually governs your deployed systems?
#PostQuantumCryptography #PQC