Post-Quantum Cryptographic Standards and Migration Obligations: A Review of Status, Cryptanalysis, and Policy

Abstract Quantum computing threatens the public-key cryptography on which contemporary digital infrastructure depends, and the practical question has shifted from whether that threat will materialise to how quickly organisations are obliged to respond. Two developments drove this shift: the United States National Institute of Standards and Technology published its first post-quantum cryptographic standards in August 2024, and in June 2026 an executive order attached binding dates to their adoption across federal systems and federal contractors. This review examines those developments through targeted retrieval of primary standards and policy documents, together with peer-reviewed cryptanalytic and resource-estimation literature, with bibliographic details verified against publisher records. Three principal findings emerge. First, the standardised portfolio is smaller than commonly reported: three Federal Information Processing Standards are published, a fourth remains in development, and a fifth algorithm has been selected but not yet standardised, a distinction that matters because procurement obligations attach only to published standards. Second, two candidates that reached advanced evaluation were defeated by classical rather than quantum cryptanalysis, one within a weekend on consumer hardware. Third, published estimates of the quantum resources required to break widely deployed key sizes have moved by more than an order of magnitude in a single dimension within six years, exchanging machine size for running time. The review concludes that cryptographic agility, not the selection of any particular algorithm, is the durable objective, and that migration should be prioritised by the confidentiality lifetime of data rather than by forecasts of adversary capability. Keywords: Standardization; Keywords: post-quantum cryptography; cryptographic migration; cryptographic agility; critical infrastructure