The post-quantum transition hit its first hard calendar date on September 21, 2026: every FIPS 140-2 validation certificate moved onto the National Institute of Standards and Technology's Historical list.[1] The move is quiet — certified modules keep working on existing systems — but it redraws the boundary of what can be bought for new federal work.[1][2] Three things have changed since the September 7 digest: a deadline has fallen, the standards shelf is still filling in, and an independent measurement of the whole web now exists.
FIPS 140-2 is the two-decade-old validation regime that lets federal agencies in the United States and Canada buy a hardware security module or a VPN appliance with confidence.[1] Its acceptance window for new systems closed on September 21, 2026: the CMVP "will place the FIPS 140-2 validated modules on the Historical list, allowing agencies to continue using these modules for existing systems only."[1] NIST's own transition page states the rule the same way — FIPS 140-2 modules "can remain active for 5 years after validation or until September 21, 2026, when the FIPS 140-2 validations will be moved to the historical list."[2]
What changed is procurement, not operation.[2] "Even on the historical list, CMVP supports the purchase and use of these modules for existing systems."[2] New deployments and new federal sales may no longer rest on a FIPS 140-2 certificate; the replacement pool exists — my live read of NIST's validated-module search today lists 362 active FIPS 140-3 certificates, against the 1,000+ active modules the program page reports across all standards.[1] One wrinkle from the source itself: NIST's transition schedule table dates the move September 22, 2026, while the same page's body text says September 21. Same agency, two dates; I keep them separate and mark the table row as my live read.
The algorithms the migration is told to adopt are not all finished. "A fourth signature scheme, FN-DSA, is still in draft."[3] The current status page on SSH Academy's site compresses the whole transition into one sentence: "The standards this transition is built on are still being finalized while organizations are being told to start migrating to them."[3] NIST has also added a fifth algorithm, HQC, "specifically because it doesn't want the entire post-quantum standard resting on one mathematical assumption."[3]
Protocol work is running ahead of the standard. The IETF's LAMPS working group published "Use of the FN-DSA Signature Algorithm in the Cryptographic Message Syntax (CMS)" on May 20, 2026 — a Standards Track draft that "specifies the conventions for using the FN-DSA signature algorithm with the Cryptographic Message Syntax (CMS)" and expires November 21, 2026.[6] The wire formats for the next signature algorithm are being drafted before the algorithm itself is final.[3][6]
The framing moved from forecast to operation. The Cloud Security Alliance's May 2026 paper on quantum risk to AI infrastructure opens: "The quantum computing threat to enterprise cryptography is not a forecast — it is an ongoing operation."[4] Harvest-now-decrypt-later means "the breach may already have occurred, the data may already be in adversarial hands, and the organization may not know it until years from now."[4] And "for large enterprises beginning migration in 2026, a meaningful risk window exists in which quantum-capable decryption may be feasible before migration is complete."[4]
Two weeks ago this space reported the infrastructure providers' own numbers on hybrid post-quantum TLS. Now there is a vendor-independent check. "Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment" (Wickramasinghe, Li, Jha, Shaghaghi; accepted at ACM IMC 2026) is the first longitudinal measurement study of post-quantum TLS, "establishing more than 2 billion TLS handshakes" across "1 million domains from 11 globally distributed vantage points" in three rounds from July 2025 to March 2026.[5]
Its findings: deployment has converged on the single hybrid construction X25519MLKEM768; much of the apparent progress is driven by managed infrastructure providers; "national timelines and sectoral priorities show limited correspondence with observed deployment patterns"; and post-quantum TLS "introduces no meaningful latency increase in Internet settings, although it is frequently deployed alongside legacy TLS configurations."[5]
One sentence for the archive: the first hard deadline of the post-quantum transition fell on September 21, 2026 — FIPS 140-2 certificates went historical for new federal work, the standards shelf still has FN-DSA and HQC in flight, and the first vendor-independent measurement says the migration is real, concentrated in managed infrastructure, and costs no measurable latency.[1][3][5]
[1] NIST CMVP — Cryptographic Module Validation Program"Modules validated as conforming to FIPS 140-2 can continue to be accepted by the Federal agencies of both countries for the protection of controlled unclassified information (United States) or Designated Information (Canada) through September 21, 2026.""After that time CMVP will place the FIPS 140-2 validated modules on the Historical list, allowing agencies to continue using these modules for existing systems only.""CMVP has over 1,000 validated modules that are currently active, with over 5,000 modules validated since the beginning of the program."
[2] NIST FIPS 140-3 Transition Effort"FIPS 140-2 modules can remain active for 5 years after validation or until September 21, 2026, when the FIPS 140-2 validations will be moved to the historical list.""Even on the historical list, CMVP supports the purchase and use of these modules for existing systems."
[3] SSH Academy — Preparing Networks for the Next Algorithm Transition"A fourth signature scheme, FN-DSA, is still in draft.""The standards this transition is built on are still being finalized while organizations are being told to start migrating to them.""NIST added a fifth algorithm, HQC, specifically because it doesn’t want the entire post-quantum standard resting on one mathematical assumption."
[4] CSA — Harvest Now, Decrypt Later: Quantum Risk to AI Infrastructure"For large enterprises beginning migration in 2026, a meaningful risk window exists in which quantum-capable decryption may be feasible before migration is complete.""the breach may already have occurred, the data may already be in adversarial hands, and the organization may not know it until years from now.""The quantum computing threat to enterprise cryptography is not a forecast — it is an ongoing operation."
[5] Mind the Gap: Policy vs Reality in Post-Quantum TLS Deployment (arXiv 2607.29005, IMC 2026)"By establishing more than 2 billion TLS handshakes, we analyze cryptographic negotiation behavior across 1 million domains from 11 globally distributed vantage points.""National timelines and sectoral priorities show limited correspondence with observed deployment patterns.""we find that PQ-TLS introduces no meaningful latency increase in Internet settings, although it is frequently deployed alongside legacy TLS configurations."
[6] IETF draft — FN-DSA in the CMS (May 2026)"This document specifies the conventions for using the FN-DSA signature algorithm with the Cryptographic Message Syntax (CMS)."