NIST IR 8547 transition timeline: 2030 and 2035 explained

NIST's transition report proposes the dates most organisations now plan around. As of September 2026 it remains an initial public draft, which affects how you should cite it.

Status of the document

NIST IR 8547, Transition to Post-Quantum Cryptography Standards, was released as an initial public draft (ipd) on 12 November 2024. The public comment period closed on 10 January 2025, and NIST has published the comments it received ^[1]. When we checked NIST's publication pages in September 2026, the ipd was still the current version and no final version had been published ^[1]. Cite it as a draft, and check the CSRC page before relying on exact wording.

Deprecated and disallowed

The report uses NIST's standard transition terms. In SP 800-131A, "deprecated" means the algorithm and key length may be used but the user must accept some security risk; "disallowed" means it is no longer allowed for the stated purpose ^[2].

Digital signatures

Source: NIST IR 8547 ipd, Table 2 ^[3].

Key establishment

Source: NIST IR 8547 ipd, Table 4 ^[3]. In practice, 112-bit security corresponds to parameters such as RSA-2048 ^[2], so a large share of today's deployed RSA falls into the 2030 category.

What is not affected

NIST says its symmetric standards are less vulnerable to quantum attack and that it does not expect to need to transition away from them; AES-128, AES-192 and AES-256 remain acceptable ^[3]. Hash functions are treated similarly. A QBOM should therefore mark symmetric-only uses as "not applicable" for migration, so they do not inflate the backlog.

Hybrid schemes and the 2035 goal

The report acknowledges hybrid solutions as temporary measures during the transition, noting that they add complexity to implementations and architectures, which can increase security risks and costs ^[3]. It ties the overall timeline to the U.S. goal, set in National Security Memorandum 10, of mitigating as much quantum risk as feasible by 2035 ^[3]. NSM-10 was signed on 4 May 2022 and directs agencies to migrate vulnerable cryptographic systems to quantum-resistant cryptography ^[4].

Turning the draft into QBOM policy

1. Flag every RSA, ECDSA, DH and ECDH asset as quantum-vulnerable, with its security strength.
2. Set a policy due date of 2030 for 112-bit assets and 2035 for stronger ones, or earlier dates where a stricter framework applies (see post-quantum compliance timelines).
3. Record the target standard for each asset, for example ML-KEM or ML-DSA (see NIST PQC standards).
4. Re-check the policy when NIST publishes a final version.

Common mistakes

• Treating 2035 as the start date. The 2030 deprecation affects 112-bit parameters, which are common in deployed RSA and elliptic-curve systems. Plan for 2030 first.
• Ignoring vendor-controlled cryptography. Appliances, HSMs and SaaS services count too; ask suppliers for their CBOM and roadmap (see PQC procurement requirements).
• Counting symmetric uses. Including AES in the backlog makes the programme look larger than it is and hides the real work.

How IntelliXBOM helps

IntelliXBOM maps cryptographic inventory to framework controls, so assets can be reported against the IR 8547 draft dates, and produces timestamped evidence of the state at each review. Version history and diffs show which quantum-vulnerable assets have been replaced between reviews. This article summarises public guidance and is not legal advice; confirm current requirements with NIST and your regulator.