Two Signals From Last Week That Should Be on Every CISO’s Radar
Two things happened last week that every CISO should know about.
NIST finalised its roadmap for retiring classical encryption. The deadlines are now binding, backed by executive order, and more aggressive than the draft.
And PostgreSQL, one of the world’s most widely deployed databases, shipped production support for post-quantum encryption. The infrastructure is moving. The question is whether your organisation knows where it stands.
NIST Finalises the Clock on Classical Encryption
On October 27, NIST published NIST IR 8547: Transition to Post-Quantum Cryptography Standards. This is the US government’s formal plan for retiring quantum-vulnerable encryption, and the final version is harder than the draft.
The bottom line: every quantum-vulnerable public-key algorithm will be deprecated after 2030 and disallowed after 2035. Federal high-value assets and high-impact systems face binding deadlines under Executive Order 14412 and OMB Memorandum M-26–15. The hard deadlines: post-quantum key establishment by December 31, 2030, and digital signatures by December 31, 2031.
What Changed From the Draft
The most significant shift is scope. The November 2024 draft only deprecated 112-bit parameter sets (RSA-2048, P-224) after 2030. Stronger parameters like P-256, RSA-3072, and Ed25519 had no deprecation step before their 2035 disallowance.
Now, every classical public-key algorithm at every key size is deprecated after 2030. From January 1, 2031, any organisation still running classical-only encryption will need a documented risk decision for every instance it keeps. Hybrid key exchange (combining classical and post-quantum algorithms) now has a confirmed path to FIPS 140 validation, even after 2035. And CISA must publish Cryptographic Bill of Materials (CBOM) guidance by early 2027.
Most Organisations Haven’t Started
A GAO report released this month found that none of 24 federal agencies had fully completed the preparatory steps. Only one had built a prioritised cryptographic inventory. The deadline for those inventories was May 2023.
Most organisations are still behind on step one: knowing what cryptography they actually use.
PostgreSQL and AWS Ship Post-Quantum Encryption Support
While NIST was setting deadlines, the infrastructure was already moving.
PostgreSQL 18 now supports post-quantum hybrid key exchange when built against current versions of OpenSSL. A single configuration change enables quantum-safe TLS on database connections.
Amazon has followed suit. RDS for PostgreSQL added post-quantum TLS support in September, and Aurora PostgreSQL-Compatible Edition followed on October 29.
The Harder Problem
This is good news. But it exposes a harder problem.
A post-quantum handshake on one database connection does not mean end-to-end coverage. Replication links, backups, connection poolers, and cloud-managed endpoints each carry their own TLS configuration. Your primary connection could be quantum-safe while every backup and replica runs classical-only.
Get ExeQuantum’s stories in your inbox
Join Medium for free to get updates from this writer.
Knowing that PostgreSQL can support PQC is not the same as knowing that it is, across every hop in your data path.
The Takeaway
Both signals point in the same direction.
NIST has set the regulatory trigger. The compliance clock is real, binding, and backed by executive order. Organisations that have not started a cryptographic inventory are not early. They are behind.
At the same time, the technology is ready. PQC-capable TLS is shipping in production databases and managed cloud services today. What most organisations lack is not the tools to migrate. It is visibility: a complete, auditable picture of what cryptography they use, where, and whether it is quantum-vulnerable.
That is the gap a Cryptographic Bill of Materials (CBOM) fills. Discovery is the foundation of every migration plan. Organisations that wait for CISA’s CBOM guidance before starting will find themselves years behind the deadline.
Key Dates
August 2024: NIST publishes FIPS 203, 204, 205 (ML-KEM, ML-DSA, SLH-DSA).
April 2025: OpenSSL 3.5 ships with ML-KEM and hybrid PQC as the default.
June 2026: Executive Order 14412 sets federal PQC migration deadlines.
September 2026: Amazon RDS for PostgreSQL enables PQC TLS.
October 2026: NIST IR 8547 finalised; Aurora PostgreSQL enables PQC TLS.
Q1 2027: CISA CBOM guidance expected.
December 31, 2030: Federal deadline for PQC key establishment on priority systems.
January 1, 2031: All classical public-key algorithms deprecated.
December 31, 2031: Federal deadline for PQC digital signatures on priority systems.
After 2035: Classical public-key algorithms disallowed entirely.
Where to Start
The pattern across every regulatory framework is the same: start with discovery. You cannot migrate what you have not mapped.
ExeQuantum’s CipherScout produces a complete cryptographic inventory across your infrastructure and delivers it as a standards-compliant CBOM. Whether you are responding to NIST IR 8547, preparing for regional compliance deadlines, or building a board-ready risk assessment, it starts with knowing what you have.
If you want to see where your organisation stands, request a demo or try the sandbox.
ExeQuantum is an ISO 27001-certified, AUKUS-authorised post-quantum cryptography company. We provide sovereign, standards-aligned encryption from discovery to full migration.
