NIST finalized its first three post-quantum cryptography standards on August 13, 2024: FIPS 203 (ML-KEM, key encapsulation, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, digital signatures, derived from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, hash-based signatures, derived from SPHINCS+). Two additional standards remain in progress: HQC, selected as a code-based backup KEM in March 2025, has a draft standard expected in early 2026 and a final version targeted for 2027; FIPS 206 (FN-DSA, based on FALCON) remains in draft as of this writing, expected later in 2026 as a compact-signature alternative.

NIST's transition plan (NIST IR 8547) sets two hard dates that matter for planning purposes: 112-bit classical algorithms including RSA-2048 and ECC P-256 are to be deprecated by 2030, and all quantum-vulnerable algorithms removed from NIST standards entirely by 2035. Separately, NSA's CNSA 2.0 mandates PQC support for new National Security Systems, with network equipment sold for NSS use required to support CNSA 2.0 by January 1, 2027.

Real-world PQC deployment in 2026 is overwhelmingly a hybrid key exchange story, not a pure-PQC story — meaning the TLS session's symmetric key is protected by a combination of a classical algorithm (typically X25519) and ML-KEM-768 running together, so a flaw in either component alone doesn't compromise the connection. Certificate authentication, by contrast, still runs on classical algorithms (ECDSA/RSA) in the large majority of production deployments today — that gap between "hybrid key exchange is live" and "certificates are still classical" is the defining, easy-to-miss nuance of where the industry actually stands.

The core HNDL principle is simple and doesn't require a working quantum computer to matter today: any data an adversary can intercept and store now — encrypted under classical algorithms — becomes retroactively readable the moment a cryptographically-relevant quantum computer exists, regardless of when that arrives. The planning consequence is that data confidentiality requirements should be measured against how long the data needs to stay secret, not against today's threat landscape. Data requiring confidentiality for ten or more years from today is a current HNDL target, full stop — that's not a future risk, it's a today risk with a delayed consequence.

The protocols and channels most worth prioritizing specifically because they represent the highest-value, most collectible interception surface are external authentication and key-exchange: TLS termination points, SSH host keys, and VPN tunnels. These are the traffic types nation-state HNDL collection programs are understood to prioritize, precisely because they protect long-lived credentials and session-establishment material rather than one-off content.

The headline framing to resist: genuine hardware progress this year does not move the central expert estimate for when a cryptographically-relevant quantum computer (one actually capable of breaking RSA/ECC via Shor's algorithm) will exist — that estimate remains centered around 2033–2035 according to independent quantum-security analysis, unchanged by any single announcement below. Treat every quantum hardware headline through that lens.

What actually happened: Google's Willow chip demonstrated "below-threshold" error correction on real hardware — meaning error rates go down as more physical qubits are added, a genuine and hard-won engineering milestone, not a marketing embellishment. IBM's Nighthawk processor (120 qubits) targets demonstrating quantum advantage on a practical computational workload by the end of 2026; separately, IBM's Kookaburra module (~4,158 physical qubits) is slated as the company's first error-correction-enabled module built on logical-density parity-check codes. Microsoft and Quantinuum's H2 system demonstrated 12 logical qubits at a logical error rate of roughly 2-in-1,000 in March 2026 — notable specifically because the logical error rate came in lower than the underlying physical error rate, a threshold researchers describe as the practical definition of "reliable" quantum computing. IonQ's Tempo system reached 64 algorithmic qubits using trapped-ion technology with all-to-all qubit connectivity in Q1 2026.

The distinction that actually matters for security planning, and the one most coverage glosses over: physical qubits are not logical qubits. Current hardware operates in what researchers call the NISQ era — Noisy Intermediate-Scale Quantum — with 50 to a few hundred physical qubits and per-gate error rates too high to sustain the long, deep circuits an algorithm like Shor's requires without error correction. A "120-qubit" or "4,000-qubit" physical-qubit headline is not equivalent to having that many clean, usable logical qubits — and cryptographically-relevant factoring requires the latter, at a scale current systems are nowhere near.

Every credible migration guide agrees on the starting point: you cannot migrate what you haven't inventoried. This is deliberately the first focus area for this briefing series, and every future "readiness checklist" block will build on the assumption this step is underway.