Most public conversation about quantum computing is about when. When will a machine exist that can break the RSA and elliptic-curve cryptography that protects nearly everything? Nobody knows, and for the national security community the question has already been settled another way. The migration is mandated, the deadlines are published, and the work has started whether or not the machine arrives on schedule.
That changes what post-quantum cryptography means for cleared professionals. It is not a research topic to follow from a distance. It is a program of work that will run through the mid-2030s, and it needs people.
What the mandates say
In May 2022, National Security Memorandum 10 set the goal of mitigating quantum risk to federal cryptographic systems by 2035. Later that year, NSA published the Commercial National Security Algorithm Suite 2.0, which names the algorithms national security systems will adopt and sets a schedule for getting there. In August 2024, NIST finalized the first post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) as a hash-based alternative.
The CNSA 2.0 schedule is the part worth memorizing. Beginning January 1, 2027, new acquisitions for national security systems must be CNSA 2.0 compliant. Software and firmware signing and traditional networking equipment are expected to use the new algorithms exclusively by 2030. Operating systems, custom applications and legacy equipment follow by 2033. Everything else closes out by 2035.
For anyone working on or around classified networks, those dates define the next several budget cycles.
Why it is harder than swapping a library
On paper, replacing one algorithm with another sounds like a software update. In practice, cryptography is embedded everywhere: in network appliances, in firmware, in hardware security modules, in public key infrastructure, in application code that calls a library someone chose fifteen years ago, in cross-domain solutions, and in fielded devices that cannot be patched remotely. The new algorithms also carry larger keys and signatures than the ones they replace, which affects protocol behavior, bandwidth-constrained links, and anything that assumed a certain packet size.
Before any of that can be addressed, an organization has to know what it has. OMB Memorandum M-23-02 requires federal agencies to inventory their cryptographic systems annually, and that inventory step alone has proven substantial in environments where documentation is incomplete and systems have changed hands across several contracts.
Then comes prioritization. The threat often described as “harvest now, decrypt later” means data encrypted today with vulnerable algorithms can be collected and stored until a quantum computer can read it. Systems handling information that must stay protected for decades move to the front of the line.
The skills the work requires
No single job title owns this. The migration draws on network engineers who understand IPsec, TLS and VPN internals; PKI and certificate lifecycle specialists; firmware and embedded engineers; software developers who can find and refactor cryptographic call sites and build in the agility to change algorithms again later; systems engineers who can carry a change through the Risk Management Framework and keep an authorization to operate intact; and program managers who can sequence all of it across contract boundaries.
The common thread is people who understand how cryptography is actually used inside a system, not only how the math works. That combination is rare, and it is in demand now.
Where the work is happening
Amentum’s Intelligence & Cyber business supports this transition for classified customers today, including crypto modernization and certificate issuance work completed years ahead of the NIST schedule, and sustaining accreditation for high-value systems where every cryptographic change must be documented and approved. The teams doing this work are hiring, and the roles span network, software, systems and security engineering across the intelligence community footprint.
The migration will outlast most contracts and several administrations. For cleared professionals, that makes it one of the more durable career lanes in the market.
Learn more at Amentum.
SPONSORED CONTENT: This content is written on or behalf of our Sponsor.
