With quantum coming, NIST readies new software supply chain protection

NIST has finalized three post-quantum cryptography standards—ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) plus SLH-DSA (FIPS 205) for digital signatures—marking a major milestone in preparing for quantum-era threats. The report urges immediate planning and phased adoption to protect software supply chains, emphasizing cryptographic agility, vendor alignment, and multi-year migration to mitigate harvest-now-decrypt-later risks and the anticipated obsolescence of RSA/ECC.