2035 NSA CNSA 2.0 Deadline: What It Means and How to Prepare

The CNSA 2.0 Deadlines

The Commercial National Security Algorithm Suite 2.0, published September 7, 2022 by NSA, establishes three enforcement milestones:

1. New NSS quantum-safe by January 2027.
2. Application-layer quantum-safe by 2030.
3. Full NSS infrastructure quantum-safe by 2035.

Mandated Algorithms

For new NSS:

• ML-KEM-1024 (NIST FIPS 203, security category 5).
• ML-DSA-87 (NIST FIPS 204, security category 5).
• LMS / XMSS for code signing (NIST SP 800-208).
• AES-256 for symmetric encryption.
• SHA-384 or SHA-512 for hashing.

Category 5 corresponds to AES-256 equivalent security strength, with AES-256 itself remaining quantum-safe under Grover's algorithm.

Who Must Comply

Strictly: US National Security Systems (NSS) under NSA purview. In practice: defense contractors, federal agencies touching classified data, and any vendor selling into the NSS supply chain.

Indirectly: NSA CNSA 2.0 sets the technical bar. Commercial vendors, allies (Five Eyes coordinate), and even non-NSS federal systems align with CNSA 2.0 to serve the market.

How This Affects Private Sector

1. Government contractors: align with CNSA 2.0 immediately.
2. Cloud providers: AWS KMS, Azure Key Vault, Google Cloud ship CNSA 2.0-compatible options through 2025-2027.
3. Enterprise: use 2035 as the planning backbone even without mandate, since it represents the industry default for quantum-safe maturity.
4. FIPS 140-3 validated modules: ML-KEM and ML-DSA modules are validated through 2026-2027.

Prepare Now Checklist

1. Inventory classical cryptography with CNSA 2.0 target in mind.
2. For any new system acquiring NSS or NSS-adjacent status, mandate ML-KEM-1024 and ML-DSA-87 by contract.
3. For long-lived infrastructure, plan hybrid deployment now with CNSA 2.0 algorithm selection.
4. Track FIPS 140-3 PQC module availability.
5. Align internal deprecation timelines with NIST IR 8547 (disallow classical after 2035).

Frequently Asked Questions

Is CNSA 2.0 the law?

CNSA 2.0 is a policy document by NSA applicable to NSS. Not a statute. In practice it governs defense contracts and NSS-adjacent supply chains.

What happens if a vendor misses the 2027 NSS deadline?

Non-compliant products cannot be deployed in new NSS. Existing NSS on the app-layer timeline (2030) or infrastructure (2035).

Does CNSA 2.0 approve hybrid?

CNSA 2.0 explicitly approves hybrid deployments during transition. Long-term, pure PQC is the direction but hybrid is acceptable for practical migration.

Is CNSA 2.0 binding in the UK, Canada, Australia?

Not directly. Via Five Eyes coordination, allied frameworks (UK NCSC 2035, ASD equivalent, CSE Canada) align closely with CNSA 2.0 algorithm choices and deadlines.

Sources

1. NSA CNSA 2.0 FAQ
2. NSA CNSA 2.0 Algorithms CSA

Related Articles

• US National Quantum Initiative
• NIST FIPS 203/204/205
• NIST PQC Timeline
• FedRAMP and PQC
• Y2Q Countdown