The National Cybersecurity Center of Excellence (NCCoE) at NIST has published a draft of Cybersecurity White Paper (CSWP) 48, which maps the capabilities of its PQC migration project to cybersecurity risk frameworks. This publication is part of an ongoing project to demonstrate practices that support an organization’s migration to Post-Quantum Cryptography (PQC). The public comment period for the draft is open until October 20, 2025.
The project is structured around two workstreams. The Cryptographic Discovery workstream focuses on using inventory tools to help organizations identify where and how cryptography is being used. The Interoperability Testing workstream is designed to support vendors in implementing PQC algorithms and to help standards bodies update standardized protocols to include PQC. The goal of this testing is to identify and resolve compatibility issues in a controlled environment, reducing the time individual organizations spend on their own migration efforts.
The NCCoE is collaborating with a consortium of over 50 organizations from industry and government on this project. These participants include Amazon Web Services (AWS), Cisco Systems, Google, IBM, JPMorgan Chase, Keyfactor, Microsoft, the National Security Agency (NSA), and Palo Alto Networks. This collaborative effort is designed to address the “harvest now, decrypt later” threat, where adversaries collect encrypted data today with the intention of decrypting it in the future with a quantum computer.
In addition to CSWP 48, the NCCoE has also published preliminary drafts of NIST SP 1800-38A, 38B, and 38C, which are practice guides that provide guidance for business decision-makers, program managers, and IT professionals on the PQC migration. The project is intended to make PQC migration a more practical and manageable process for a broad audience of developers, product integrators, and customer organizations.
Read the NCCoE’s project page here and the new draft white paper here. For the FAQ on PQC, see the NIST webpage here.
September 20, 2025
