CNSA 2.0 and January 1, 2027: What Contractors Must Know

CNSA 2.0 is the NSA’s set of quantum resistant cryptographic algorithms for National Security Systems, and its first hard enforcement date lands on January 1, 2027. From that day, under CNSSP 15 and NSA’s CNSA 2.0 guidance, new acquisitions for National Security Systems are expected to be CNSA 2.0 compliant unless NSA notes otherwise. Equipment that cannot support CNSA 2.0 has to be phased out by December 31, 2030, the algorithms become mandatory by December 31, 2031, and NSA intends for every National Security System to be quantum resistant by 2035.

That is the headline. Here is what the headline leaves out. January 1 applies to National Security Systems, which most contractor laptops are not, and plenty of companies are going to overreact to it while ignoring the rules that will actually reach them. 2026 piled three new federal actions on top of the NSA timeline, and one of them is aimed squarely at every company holding a federal contract.

January 1, 2027 gets the headlines. December 31, 2030 is the date most federal contractors should circle.

Preparing for the Security+ exam? Compare class dates and formats for our Security+ boot camp.

What Is CNSA 2.0?

CNSA stands for Commercial National Security Algorithm Suite. Version 1.0 was built on RSA, elliptic curve cryptography, and Diffie Hellman, all of which a large enough quantum computer could break. The 2.0 release swaps the public key pieces for algorithms NIST standardized in August 2024 and keeps the symmetric pieces at their strongest settings. According to NSA’s CNSA 2.0 FAQ, every algorithm in the suite is approved for all classification levels.

If you passed a cryptography section on any security exam before 2024, the middle two rows are the new part. ML-KEM replaces the key exchange you know from Diffie Hellman and ECDH, and ML-DSA replaces RSA and ECDSA signatures. NIST published both as final standards, FIPS 203 and FIPS 204, on August 13, 2024, alongside FIPS 205 for the hash based SLH-DSA signature scheme.

What Happens on January 1, 2027?

NSA’s FAQ is direct about it. CNSSP 15 requires all new acquisitions for National Security Systems to be CNSA 2.0 compliant by January 1, 2027, and NSA expects new deployments from that date to comply. The policy was updated in 2025, and NSA said it would not enforce transition requirements before December 31, 2025, which makes January 2027 the first date with teeth.

National Security Systems are the classified networks, intelligence systems, weapons and military command and control systems, and anything else that falls under the NSS definition in federal law. Contractors who build, operate, or sell into those systems are covered through the acquisition. A defense contractor whose only federal footprint is an unclassified business network handling CUI is not an NSS operator, and January 1 does not flip a switch on that network.

NSA also published a timeline by product category. Each one has a date to support and prefer CNSA 2.0 and a later date to use it exclusively.

Look at the networking row before anything else. VPNs and routers were supposed to support and prefer CNSA 2.0 this year, and they have the shortest runway to exclusive use. If your network refresh cycle runs five to seven years, equipment you buy in 2027 will still be in the rack when exclusive use kicks in.

NSA will not require hybrid products that combine classical and quantum resistant algorithms, and it does not approve CNSA 2.0 algorithms that lack FIPS validation, even inside a hybrid mode. That matters when a vendor pitches you a hybrid product as the compliant option. It may be a fine product, but for NSS work the box you have to check is FIPS validated CNSA 2.0.

What Post Quantum Rules Came Out in 2026?

Here is where the January date stops being the whole story. Four actions landed between January and June.

The executive order is the one I would put in front of a contracts team. Count 180 days from June 22 and the proposed FAR rule is due around December 19, 2026. As of this writing nothing has appeared in the Federal Register, so the exact clause language is still unknown. The direction is not. If you sell to the federal government, compliance with the post quantum FIPS standards is headed into your contract by the end of 2030, with or without any NSS work.

The DoW strategy deserves a second look too. The line about updating CMMC to include PQC requirements is one sentence in the document, and it is the sentence that will reach the defense industrial base. We covered the current framework in CMMC Explained: What Defense Contractors Need to Know, and PQC is not in any assessment objective yet. Nobody should claim to know when it will be.

Why the Deadline Is Years Before Anyone Has a Quantum Computer

People raise this objection constantly, and it is a fair one. No quantum computer today can break RSA 2048. So why is the government setting dates in 2027 and 2030?

Blame a threat the federal documents call harvest now, decrypt later. NIST describes it in its draft transition guidance, NIST IR 8547, as adversaries collecting encrypted data today so they can decrypt it once the technology matures. Anything that needs to stay secret for ten or twenty years is already exposed if someone is recording the traffic now. Program details for a weapons system, personnel records, and long lived intellectual property all fit that description. The same NIST draft proposes deprecating 112 bit RSA and elliptic curve algorithms after 2030 and disallowing quantum vulnerable public key algorithms entirely after 2035, though as of October 2026 it remains an initial public draft rather than a final publication.

The other reason is plain arithmetic about how long migrations take. Swapping cryptography touches certificates, hardware security modules, VPN concentrators, firmware signing pipelines, code that hard coded an algorithm a decade ago, and every vendor in your supply chain. The SHA-1 retirement dragged on for years in a lot of large organizations, and that was a hash function swap with a known replacement and almost no hardware dependency. Post quantum migration is bigger in every direction, with larger keys and signatures that some older devices and protocols were never sized to carry. A 2030 deadline that sounds comfortably far away is roughly one hardware refresh cycle for a lot of networks. In Fortune 500 IT shops and defense contractors, a lot of 2030 budget gets spent in 2027. From the training side, the pattern is predictable. The people who will run a migration need months to get comfortable with new algorithms, and that runway disappears once a contract clause shows up with a date in it.

Is the Industry Already Moving?

Faster than most compliance teams realize. Cloudflare reported in June 2026 that more than two thirds of browser traffic to its network was already protected with post quantum key agreement. Apple turned on hybrid post quantum TLS by default in iOS 26 and macOS Tahoe 26. Google publicly set 2029 as its own migration target. Chrome has negotiated ML-KEM hybrid key exchange by default since late 2024.

So the browser on your desk is probably already doing post quantum key exchange with some sites. The VPN appliance in your server room, the HSM signing your firmware, and the custom app your team wrote in 2015 almost certainly are not, which tracks closely with NSA’s timeline table.

What Should Contractors Do Before January 2027?

The work is the same whether you run NSS or just hold federal contracts, and only the speed changes.

Build a cryptographic inventory. You cannot migrate what you have not found. Federal agencies have owed OMB an annual inventory since M-23-02 in 2022, and M-26-15 now asks for a continuously updated one that feeds a cryptographic bill of materials. CISA owes guidance on what a CBOM has to contain by roughly March 2027. Start with certificates, VPNs, TLS endpoints, code signing, and anything that stores data meant to stay secret for years.

Ask your vendors for a CNSA 2.0 roadmap in writing. For NSS work, you want FIPS validated ML-KEM and ML-DSA with dates attached. On the commercial side, ask which of their products already support the NIST standards and which are still in transition. CISA’s category list is a reasonable script for that conversation.

Get to TLS 1.3 now. OMB and the earlier executive orders set January 2, 2030 as the deadline for TLS 1.3 or a successor, and post quantum key exchange in TLS rides on 1.3. If parts of your environment still negotiate TLS 1.2, that is your first project.

Shorten your certificate cycles anyway. Public TLS certificates are already on a path to 47 day lifetimes, which we explained in the 47 day certificate rule. Automated certificate management is a prerequisite for swapping algorithms at scale, so the same tooling pays for both changes.

Train the people who will do the work. Most security staff learned public key cryptography on RSA and ECC. ML-KEM and ML-DSA behave differently, with much larger public keys and signatures, and that size difference breaks assumptions in protocols, certificates, and constrained devices.

Which Certification Exams Cover Post Quantum Cryptography?

Fewer than you would guess. CompTIA SecurityX (CAS-005) is the clearest. Objective 3.6 on advanced cryptographic concepts lists post quantum cryptography by name, including how it compares with Diffie Hellman and ECC and where implementations are emerging. Security+ does not cover it in the current SY0-701 objectives or in the SY0-801 objectives for the version that launches November 17, 2026. The CISSP outline effective April 2024 lists quantum among cryptographic methods in Domain 3 without using the term post quantum. On the cloud side, AWS added post quantum cryptography with KMS, using ML-DSA and ML-KEM, to the new Solutions Architect Professional exam, SAP-C03, which arrives the same day as the new Security+.

For defense contractor staff working under DoD 8140, that mismatch is worth noticing. The baseline certification most people hold for 8140 compliance does not test the cryptography their employer now has to plan around. Our breakdown of what makes a certification DoD 8140 approved covers how those qualification decisions get made.

Frequently Asked Questions About CNSA 2.0 and Post Quantum Cryptography

What is CNSA 2.0?

CNSA 2.0 is the NSA’s Commercial National Security Algorithm Suite 2.0, the set of quantum resistant algorithms required for National Security Systems. It uses AES-256, ML-KEM-1024, ML-DSA-87, SHA-384 or SHA-512, and LMS or XMSS for software and firmware signing.

What happens on January 1, 2027 under CNSA 2.0?

Starting January 1, 2027, new acquisitions for National Security Systems are required to be CNSA 2.0 compliant under CNSSP 15, unless NSA notes otherwise, and NSA expects new deployments to comply from that date.

Does the January 2027 CNSA 2.0 deadline apply to all federal contractors?

No. It applies to National Security Systems and the products and services acquired for them. Most contractors are reached through other actions, mainly the FAR rule Executive Order 14412 directed, which targets FIPS compliance including post quantum standards by December 31, 2030.

When must CNSA 2.0 be fully in place?

NSA says equipment that cannot support CNSA 2.0 must be phased out by December 31, 2030, CNSA 2.0 algorithms are mandated by December 31, 2031, and all National Security Systems should be quantum resistant by 2035.

What are ML-KEM and ML-DSA?

ML-KEM is the NIST standard for quantum resistant key establishment, published as FIPS 203, and ML-DSA is the NIST standard for quantum resistant digital signatures, published as FIPS 204. Both became final on August 13, 2024.

What does harvest now, decrypt later mean?

It describes adversaries collecting encrypted data today and storing it until a quantum computer can decrypt it. Data that must stay confidential for many years is at risk now, which is why migration deadlines arrive before practical quantum computers exist.

Is post quantum cryptography on the Security+ exam?

No. Neither Security+ SY0-701 nor the SY0-801 version launching November 17, 2026 lists post quantum cryptography in its objectives. CompTIA SecurityX (CAS-005) covers it under objective 3.6.