[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Fnist-2021-paper-migration-is-hard-and-slow":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Fnist-2021-paper-migration-is-hard-and-slow.md","NIST 2021 Paper Warns Post-Quantum Migration Is Hard and Slow, Urges Discovery Now","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"nist-2021-paper-warns-post-quantum-migration-is-hard-and-slow","NIST 2021 paper warns post-quantum migration is hard and slow",[18,19,20],"p",{},[21,22,23],"strong",{},"28 APRIL 2021, GAITHERSBURG",[18,25,26],{},"NIST published the cybersecurity white paper \"Getting Ready for Post-Quantum Cryptography\" on 28 April 2021, more than three years before it finalized the first standards. The paper made a blunt point: migrating to post-quantum cryptography is hard and slow. It estimated a 5 to 15 year gap between standardizing new algorithms and completing their rollout across an organization's systems.",[18,28,29],{},"The paper used that estimate to argue for starting cryptographic discovery immediately. Discovery means finding where an organization uses cryptography, and that work does not depend on which algorithm eventually replaces the vulnerable one. An organization can map its cryptographic dependencies while the standards are still in draft, so that migration can begin the moment the standards arrive rather than starting from a blank page.",[18,31,32],{},"The paper also pushed organizations toward crypto agility, the ability to swap cryptographic algorithms without re-engineering the systems around them. Teams that build this flexibility find each future transition easier, not just the current one. The combination of early discovery and crypto agility is the foundation the paper recommended laying before any specific algorithm was chosen.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," The 2021 paper set the expectation that migration measures in years, not months, and that framing still holds. The standards it anticipated arrived in 2024, and the 5 to 15 year estimate underpins the federal deadlines that now run to 2030, 2031 and 2035. Organizations that started discovery when the paper urged it are years into the work; those that have not should treat the estimate as a reason to begin now.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Analysis","2021-04-28","A 2021 NIST paper warned post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.",false,"md",[49,52,55],{"q":50,"a":51},"How long does post-quantum migration take?","The 2021 NIST paper estimated a 5 to 15 year implementation gap between standardizing new algorithms and completing their rollout across an organization's systems. That estimate is why NIST urged organizations to begin discovery long before the standards were final.",{"q":53,"a":54},"Why start cryptographic discovery before the standards exist?","Discovery, finding where cryptography is used, is independent of which algorithm replaces it. The 2021 paper argued that organizations could do this slow, foundational work early so that migration could begin as soon as standards arrived rather than starting from zero.",{"q":56,"a":57},"Is a 2021 paper still relevant?","Yes. The standards it anticipated arrived in 2024, and the 5 to 15 year estimate still frames the timelines in later federal deadlines. Organizations that heeded its advice in 2021 are several years into the work the deadlines now require.",[59],"gaithersburg","\u002Fassets\u002Fog-default.png",[62,63],"Cross-Sector","Information Technology",{},"2026-08-12",true,"\u002Fnews\u002Fnist-2021-paper-migration-is-hard-and-slow",[69],{"label":70,"url":71},"W. Barker, W. Polk, and M. Souppaya, \"Getting Ready for Post-Quantum Cryptography,\" NIST Cybersecurity White Paper, Apr. 28, 2021.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fcswp\u002F04282021\u002Ffinal",[73,76],{"label":74,"url":75},"NIST Approves First Three Post-Quantum Standards","\u002Fnews\u002Fnist-approves-first-three-post-quantum-standards",{"label":77,"url":78},"CISA, NSA and NIST Urge Organizations to Start Quantum-Readiness Planning","\u002Fnews\u002Fcisa-nsa-nist-quantum-readiness-factsheet",{"title":5,"description":45},"NIST 2021 Paper: PQ Migration Is Hard and Slow","nist-2021-paper-migration-is-hard-and-slow","news\u002Fnist-2021-paper-migration-is-hard-and-slow",[84,85,86,87,88],"PQC migration","cryptographic discovery","quantum readiness","crypto-agility","for enterprises","A 2021 NIST paper warned that post-quantum migration could take 5 to 15 years to implement and urged organizations to start cryptographic discovery immediately.","4m_mhdhF-70mxgb1Q10-G8MtNj9r2ITbdangGsV-ISE",1792182887533]