INSTITUTION PROFILE / QUANTUM COMPUTING
NSA (National Security Agency)
The U.S. agency that narrows NIST's standards down to the quantum-resistant cryptography that national security systems may use
The NSA belongs to the U.S. Department of War (formerly the Department of Defense) and handles signals intelligence and cybersecurity. It does not build quantum computers. Its main role in quantum computing is to set the cryptography requirements for U.S. "national security systems". These requirements are called CNSA 2.0, and they pick out, from the post-quantum cryptography standards that NIST wrote, a narrower set that may be used. They apply to national security systems, not to the private sector at large. But vendors that supply those systems have to support CNSA 2.0. This profile looks at one question: how much influence the NSA actually has over quantum computing. Cryptography standards and deadlines change quickly, so each is given with a check date (16 October 2026), and the profile does not describe how to break cryptography.
- The NSA in 30 seconds
- What kind of body it is: the four types of influence
- What it does for quantum computing
- How far its influence reaches (powers and geography)
- Whom it reaches: the organizations involved
- Outlook
- Glossary, references and claim-to-source audit
1. The NSA in 30 seconds
The NSA decides cryptography only for national security systems. Standards for the private sector and for other government systems are set by NIST. The NSA's FAQ says it is "not using these requirements to dictate to any other entity outside of" national security systems what algorithms they should use Sourced. It also says that a commercial product that does not use CNSA 2.0 algorithms is not allowed to protect national security systems, unless the NSA has provided specific written guidance otherwise Sourced. So the NSA's requirements are not an obligation for the private sector at large, but in practice a must-have for vendors who want to sell to national security customers. If NIST's standards are a broad parts catalog, the NSA's requirements are a short list of the parts allowed in systems that handle secrets.
It is a U.S. government information system that handles information related to national security (defined in the U.S. law 44 U.S.C. 3552). NIST's FIPS 203 says plainly that it does not apply to national security systems Sourced. The NSA fills that gap. It is thought that a sufficiently powerful quantum computer would put today's public-key cryptography at risk, so the NSA has set requirements early for national security systems, which must keep secrets for a long time. The NSA's FAQ says it does not know when a quantum computer capable of attacking real cryptography will exist and that expert opinions differ widely, but because these systems last so long, requirements have to be set now Sourced.
Our retrieval could not read the NSA's site or the host of its documents directly. The content was checked in archived copies dated 2 to 12 October 2026. The versions we could confirm are the CNSA 2.0 advisory of September 2022 (Ver. 1.0) and the FAQ of December 2024 (Ver. 2.1). The 2022 advisory still uses the old algorithm names (CRYSTALS-Kyber and CRYSTALS-Dilithium), so a newer version may exist. The updated CNSSP 15, which sets the deadlines, is shown on the NSA's resource page as "released March 4, 2025", while the FAQ calls it "the 2024 update". We could not confirm the reason for the difference in year, nor the text of CNSSP 15 itself Not yet confirmed. The deadlines in this article follow what the NSA's FAQ says about CNSSP 15.
2. What kind of body it is: the four types of influence
Unlike companies, the "institutions" in quantum computing articles do not build quantum computers themselves. They fall into four types, depending on the route by which they influence the industry.
3. What it does for quantum computing
3-1. CNSA 2.0: the algorithms the NSA allows in national security systems
CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is the list of quantum-resistant cryptography allowed in national security systems. The NSA says it chose, from among the algorithms NIST selected for standardization, only those that meet its demanding requirements Sourced.
| Purpose | What the NSA allows (CNSA 2.0) | How it differs from NIST's standards |
|---|---|---|
| Key establishment | ML-KEM-1024 (FIPS 203), for all classification levels | FIPS 203 has three settings: ML-KEM-512, 768 and 1024. The NSA specifies only the strongest, 1024 |
| Digital signatures (general) | ML-DSA-87 (FIPS 204). May also sign software and firmware | The NSA specifies only the strongest setting. The other signature standard, SLH-DSA in FIPS 205, is not approved for any use in national security systems |
| Digital signatures (software and firmware only) | LMS and XMSS (NIST SP 800-208). LMS with SHA-256/192 is recommended. The multi-tree variants (HSS and XMSSMT) are not allowed | Hash-based signatures used with careful state tracking. Signing must be done in hardware, and no waivers are given for that requirement |
| Symmetric encryption and hashing | AES with 256-bit keys, and SHA-384 or SHA-512. SHA-3 only in limited cases such as internal hardware functions | Symmetric cryptography is described as being less affected by quantum computers. There is little change |
| FN-DSA (derived from FALCON) | Not expected to be added | The NSA agrees with NIST in preferring ML-DSA, because FN-DSA seems more susceptible to implementation errors |
* The NSA says it "does not currently plan to add future NIST post-quantum standards to CNSA" (while noting that circumstances could change) Sourced. It also does not require "hybrid" use of two methods together for security reasons, and allows it only for exceptions that protocols need (such as IKEv2).
3-2. Deadlines: by when to move
The deadlines below are what the NSA's FAQ says about CNSSP 15. The 2022 advisory gave a timetable by type of technology, but the newer FAQ says that the CNSSP 15 update set the dates. The two are not the same.
| Date | What it says | Source and status |
|---|---|---|
| 31 December 2025 | National security systems validated under NIAP or CSfC profiles remain approved for the life of that validation. No transition is enforced before this date | FAQ (December 2024). This date has passed |
| 1 January 2027 | All new acquisitions for national security systems must be CNSA 2.0 compliant (unless otherwise noted) | FAQ. A planned date. Not yet reached on the check date |
| 31 December 2030 | Equipment and services that cannot support CNSA 2.0 must be phased out | FAQ. A planned date |
| 31 December 2031 | Use of CNSA 2.0 algorithms is mandated (unless otherwise noted) | FAQ. A planned date |
| 2035 | The goal that all national security systems be quantum-resistant. The NSA intends to finish well ahead of it | The goal in National Security Memorandum 10 (NSM-10). FAQ |
| (The 2022 timetable by technology) | Software and firmware signing: prefer in 2025, exclusive in 2030. Web browsers, servers and cloud: prefer in 2025, exclusive in 2033. Networking equipment: prefer in 2026, exclusive in 2030. Operating systems: prefer in 2027, exclusive in 2033. Niche equipment: prefer in 2030, exclusive in 2033. Custom applications and legacy equipment: update or replace by 2033 | Advisory (September 2022 version). We could not confirm how it relates to the newer CNSSP 15 dates |
The NSA explains that the signature method for firmware (the basic software built into a device) is often hard to change over a device's whole life, so it should move first Sourced. A quantum-resistant "root of trust" may be needed in firmware years before the rest of the system is upgraded. That is why the NSA urges starting now with state-tracked hash-based signatures (LMS and XMSS), for which validated products already exist. For anyone supplying parts or equipment, the longer a device lives, the longer an early cryptographic choice stays with it.
3-3. The NSA's position on quantum key distribution (QKD)
The NSA does not consider quantum key distribution (QKD) a practical way to protect national security systems from quantum computers. It gives these reasons: it needs special equipment and dedicated optical fiber, a separate way to authenticate the other party is still needed, trusted relays add cost and insider risk, and it is hard to validate. It says it does not anticipate approving QKD products "unless these limitations are overcome" Sourced. The NSA regards post-quantum cryptography as cheaper and easier to maintain. For more, see our explainer on quantum key distribution and quantum communication.
4. How far its influence reaches (powers and geography)
| Dimension | What the NSA has | What it does not have |
|---|---|---|
| Powers | Authority to set, approve and monitor the cryptography requirements for national security systems. NSM-10 explicitly calls on the NSA to provide timely guidance on quantum resistance for these systems. It manages NIAP (certification of commercial products) and CSfC (a scheme that combines commercial products to protect classified information) | Power to set standards for the private sector or for other government systems (NIST's domain). Power to publish an algorithm as a standard. Power to fund quantum computer development (no such provision found) |
| Geography and scope | U.S. national security systems, their owners and operators, and the vendors that supply them | Power to bind governments or companies outside the U.S. directly. Power to make the private sector at large use its list (the NSA itself says it has no intention to dictate) |
| Binding force | Operators of national security systems must report progress on the transition. Algorithms other than the approved ones are generally not allowed and need a waiver specific to the algorithm, implementation and use. For some items (the hardware requirement for software and firmware signing), no waivers are given | Legal obligations for the private sector at large. Power to make standards bodies such as the IETF adopt its choices |
| Size and breadth | The NSA's FAQ and advisory are addressed to national security systems and also give guidance for the Department of War and the defense industrial base (the companies that supply defense) | The NSA's headcount and budget are not in the official materials we could check |
The NSA's FAQ says: "NSA establishes NSS requirements. NIST establishes cryptographic standards for other government systems." Sourced. The NSA chooses the algorithms in CNSSP 15 from among those NIST selected, both to meet its own requirements and to keep implementation and interoperability simple by aligning with NIST's standards. If it is unclear whether national security requirements apply to a particular system, the NSA advises contacting it.
5. Whom it reaches: the organizations involved
| Organization | Relationship | What the primary sources confirm |
|---|---|---|
| NIST (Department of Commerce) | The body that writes the standards | The NSA chooses from NIST's standards. National security systems are outside FIPS. See our NIST profile |
| Committee on National Security Systems (CNSS) | Issuer of the policy | CNSSP 15 (use of public standards) sets the commercial cryptographic algorithms for national security systems. The NSA's resource page gives the release date of the update as 4 March 2025 |
| NIAP and CSfC (certification schemes the NSA is involved in) | The entry point for commercial products | Commercial products used in national security systems must meet NIAP requirements. CSfC registers combinations of products that comply with an NSA-defined configuration |
| Department of War, the Director of National Intelligence (DNI), the FBI and others | Coordination under Executive Order 14413 | The DNI and the Secretary of War are directed to identify the national security implications of the growing scale and performance of commercial quantum computers, including for the migration to post-quantum cryptography. The FBI is directed to propose, with the NSA and others, an expansion of quantum counterintelligence protection |
| Standards bodies such as the IETF | Protocol standards | The NSA is working with the IETF to produce guidance on CNSA 2.0 for protocols. Standards bodies are independent and keep their own schedules |
| The Department of War's Chief Information Officer (CIO) | A separate document | The release feed on war.gov lists a "Post Quantum Cryptography Strategy" released on 23 June 2026 (only the title, summary and date were confirmed; the text was not) |
* The NSA's documents do not name companies when stating requirements. We could not find a primary source showing a relationship with the quantum computing companies in this series Not yet confirmed.
6. Outlook
| What can be read from the sources | Supporting primary information | Type |
|---|---|---|
| From 1 January 2027, new acquisitions for national security systems are to require CNSA 2.0 compliance. Non-supporting equipment is to be phased out by the end of 2030, and use mandated by the end of 2031 | Dates that the NSA's FAQ describes for CNSSP 15. We could not confirm the text of CNSSP 15. The dates are plans and may change | Not yet confirmed |
| The first report identifying the national security implications of larger commercial quantum computers (including the migration to post-quantum cryptography) is due around June 2027 | Sections 4(f) and 10(c) of Executive Order 14413: a report within one year of the order, then annually. The due date is our calculation from the order's date (22 June 2026) | Not yet confirmed |
| The NSA does not currently plan to add future NIST post-quantum standards to CNSA, and does not expect to add FN-DSA | The NSA's FAQ (December 2024). It also notes that circumstances could change | Sourced (current policy) |
| Because the NSA specifies only the strongest settings (ML-KEM-1024 and ML-DSA-87), vendors that supply national security systems may prioritize implementing those settings | The NSA's FAQ says a commercial product that does not use CNSA 2.0 cannot be used in national security systems. We did not check vendors' actual implementation choices | Inference |
| Vendors outside the U.S. may also need to support CNSA 2.0 if they supply U.S. national security systems | The NSA's FAQ says vendors are covered, without distinguishing by nationality. We did not check how foreign vendors are treated individually | Inference |
7. Glossary
- National security system (NSS)
- A U.S. government system that handles national security information. It is outside NIST's FIPS and follows the NSA's and others' requirements.
- CNSA 2.0
- Commercial National Security Algorithm Suite 2.0. The list of quantum-resistant cryptography allowed in national security systems.
- CNSSP 15
- A policy of the Committee on National Security Systems that sets the public-standard cryptography national security systems use.
- NSM-10
- National Security Memorandum 10 (4 May 2022). The U.S. government's policy of moving to quantum-resistant cryptography by 2035.
- NIAP / CSfC
- A scheme to certify commercial products for use in national security systems (NIAP), and a scheme to register configurations that combine commercial products to protect classified information (CSfC).
- CRQC
- Cryptanalytically relevant quantum computer: a quantum computer with enough performance to attack real cryptography.
- Hybrid
- Using several methods together so that all must be broken to break the system. The NSA does not require it for security.
8. References
- NSA About NSA/CSS (a combat support agency of the Department of War, a member of the Intelligence Community, mission; read in a copy dated 3 October 2026). https://www.nsa.gov/about/
- NSA Mission & Combat Support (its position as part of the Department of War; read in a copy dated 9 October 2026). https://www.nsa.gov/about/mission-combat-support/
- NSA Post-Quantum Cybersecurity Resources (release date of CNSSP 15 as 4 March 2025, the position on QKD; read in a copy dated 12 October 2026). https://www.nsa.gov/Cybersecurity/Post-Quantum-Cybersecurity-Resources/
- NSA The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ (December 2024, Ver. 2.1; algorithms, deadlines, CNSSP 15, QKD, hybrids, the division of roles with NIST; read in a copy dated 11 October 2026). https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF
- NSA Announcing the Commercial National Security Algorithm Suite 2.0 (the advisory; the version we could confirm is September 2022, Ver. 1.0; timetable by technology and scope; read in a copy dated 2 October 2026). https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF
- U.S. National Archives Records of the National Security Agency/Central Security Service (how it was established; effective 4 November 1952). https://www.archives.gov/research/guide-fed-records/groups/457.html
- Committee on National Security Systems (CNSS) CNSS Policies (the title and purpose of CNSSP 15; read in a copy dated 13 September 2026; the text itself could not be retrieved). https://www.cnss.gov/CNSS/issuances/Policies.cfm
- NIST FIPS 203 full text, PDF (national security systems are outside its applicability; the three ML-KEM settings). https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf
- NIST Post-Quantum Cryptography (FIPS 203, 204 and 205; FN-DSA in development; checked 15 October 2026). https://csrc.nist.gov/projects/post-quantum-cryptography
- The White House Executive Order 14413, Ushering in the Next Frontier of Quantum Innovation (22 June 2026; Sections 4(b), 4(f), 7(b) and 10(c)). https://www.whitehouse.gov/presidential-actions/2026/06/ushering-in-the-next-frontier-of-quantum-innovation/
- Department of War Securing Global Dominance: DoW Unleashes Quantum Defense Strategy to Harden Networks and Empower the Joint Force (23 June 2026; title, summary and date confirmed from war.gov's release feed; the text was not confirmed). https://www.war.gov/News/Releases/Release/Article/4524599/securing-global-dominance-dow-unleashes-quantum-defense-strategy-to-harden-netw/
9. Claim-to-source audit
| Claim in the text | Type | Source |
|---|---|---|
| A combat support agency of the Department of War, a member of the Intelligence Community, its mission (cryptology, signals intelligence, cybersecurity) | Sourced | Reference 1 https://www.nsa.gov/about/ |
| Its position as part of the Department of War | Sourced | Reference 2 https://www.nsa.gov/about/mission-combat-support/ |
| Release date of the updated CNSSP 15 (4 March 2025), the NSA does not recommend QKD for national security systems, its reasons, no plan to approve | Sourced | Reference 3 https://www.nsa.gov/Cybersecurity/Post-Quantum-Cybersecurity-Resources/ |
| The CNSA 2.0 table (ML-KEM-1024, ML-DSA-87, LMS and XMSS, AES-256, SHA-384 and 512, limited SHA-3), SLH-DSA not approved, no plan to add FN-DSA, the position on hybrids, the deadlines (31 December 2025, 1 January 2027, 31 December 2030, 31 December 2031, 2035), the division of roles between the NSA and NIST, "not dictating to entities outside NSS", "non-compliant commercial products cannot be used", NSM-10, the absence of NSA headcount and budget in the materials | Sourced | Reference 4 https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF |
| The 2022 timetable by technology, the coverage of NSS plus the Department of War and the defense industrial base, the reporting obligation | Sourced | Reference 5 https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF |
| Effective 4 November 1952 | Sourced | Reference 6 https://www.archives.gov/research/guide-fed-records/groups/457.html |
| CNSSP 15 is the policy on the use of public standards for national security systems | Sourced | Reference 7 https://www.cnss.gov/CNSS/issuances/Policies.cfm |
| National security systems are outside FIPS 203; the three ML-KEM settings | Sourced | Reference 8 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf |
| Publication of FIPS 203, 204 and 205; FN-DSA in development | Sourced | Reference 9 https://csrc.nist.gov/projects/post-quantum-cryptography |
| Executive Order 14413: mention of the NSA, identification of national security implications, the FBI's counterintelligence protection, reporting deadlines | Sourced | Reference 10 https://www.whitehouse.gov/presidential-actions/2026/06/ushering-in-the-next-frontier-of-quantum-innovation/ |
| The Department of War CIO's release of a post-quantum cryptography strategy (23 June 2026) | Sourced | Reference 11 https://www.war.gov/News/Releases/Release/Article/4524599/securing-global-dominance-dow-unleashes-quantum-defense-strategy-to-harden-netw/ |
| The four-type grouping of institutions; the due date around June 2027 | Our calculation | This article's own grouping (one year from the order's date of 22 June 2026 in Reference 10) |
| The date and text of CNSSP 15, how the 2022 timetable relates to the new dates, whether a newer advisory exists, the NSA's headcount and budget, relationships with quantum companies | Not yet confirmed | Not in References 3, 4, 5 or 7, or the original text could not be checked. This article does not estimate them |
| How compliance proceeds after 1 January 2027 | Not yet confirmed | Reference 4 https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF gives it as a planned date. It had not been reached on the check date |
| The two items in the outlook in Section 6 (vendors prioritizing the strongest settings, treatment of vendors outside the U.S.) | Inference | This article's reading of References 4 and 5 |
Last updated 16 October 2026 / Troy Technical
This article rests on the NSA's website and documents (read in archived copies), the U.S. National Archives, NIST's standards and a U.S. executive order. Cryptography requirements and deadlines change quickly, so the check date (16 October 2026) is stated throughout. Items marked "Inference" are this article's reading of the primary information, not statements by the NSA.