NIST has already standardized the principal building blocks:

• FIPS 203: ML-KEM for post-quantum key establishment
• FIPS 204: ML-DSA for post-quantum digital signatures
• FIPS 205: SLH-DSA as another post-quantum digital signature standard

For key establishment, NIST currently recommends ML-KEM-768 as the default parameter set.

However, not everything needs replacement. NIST states that approved symmetric cryptography providing at least 128 bits of classical security is significantly less vulnerable to known quantum attacks, meaning algorithms such as AES-128, AES-192 and AES-256 remain part of the landscape.

For vendors with FIPS 140-3 validation goals, PQC should become part of product and validation roadmap discussions now.

Software cryptographic libraries, hardware cryptographic modules, HSMs, TPMs, PKI infrastructure and the applications and protocols that depend on them may all need to evolve to support PQC. NIST specifically highlights the long development cycles associated with cryptographic hardware and identifies immediate PQC integration as a high priority for hardware vendors.

The immediate priority is not simply “implement PQC.” It is understanding where cryptography exists throughout the product and its dependencies.

NIST explicitly calls for organizations to begin with cryptographic inventories, migration planning, and early deployments of PQC-enabled products and services.

For product leaders, that means asking:

• Where do RSA, ECC, Diffie-Hellman and other quantum-vulnerable algorithms exist today?
• Which products serve customers facing the accelerated 2030/2031 federal deadlines?
• Which libraries, hardware, PKI systems and external dependencies must change first?
• How will ML-KEM, ML-DSA and SLH-DSA affect product architecture and FIPS 140-3 validation plans?
• Is the product sufficiently crypto-agile to accommodate this transition and future algorithm changes?

The critical takeaway from NIST IR 8547 is not that today’s cryptography disappears tomorrow. It is that the transition now has a defined timeline, and vendors serving sensitive federal environments face milestones well before 2035.

Waiting until customers make PQC support an explicit requirement could leave significantly less room for architectural changes, testing, interoperability work and FIPS 140-3 validation planning.

A focused cryptographic and FIPS assessments can help vendors understand their current exposure, identify dependencies and develop a realistic transition roadmap. Corsec can help organizations evaluate that landscape and build a PQC and FIPS strategy aligned with their products, customers and certification objectives.

The deadline may say 2030 or 2035. For product planning, the transition starts now.

DISA News

Announcements:

• DISA is modernizing its hiring process to rapidly recruit and clear cyber professionals needed to defend critical defense networks from emerging AI-powered threats.
• DISA is pushing a new vision for cyber warfare built on AI, standardized data, and proactive network defense to maintain military advantage in an increasingly contested digital battlespace.
• At TechNet Augusta 2026, DISA outlined a vision for commanding networks as warfighting platforms through AI integration, data standardization, and aggressive cyber risk management.

Security Technical Implementation Guide Updates:

• Samsung Android OS 17 with Knox 3.x
• Microsoft Windows Server 2025 STIG – Ver 1, Rel 3
• Microsoft Windows Server 2022 STIG – Ver 2, Rel 10
• Microsoft Windows 11 STIG – Ver 2, Rel 9
• Infoblox NIOS 9.x STIG – Ver 1 Rel 1

NIST News

Updates & Announcements:

• NIST has called for a revision of SP 800-213A, Internet of Things (IoT) Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• IR 8576, Transit Cybersecurity Framework (CSF) Community Profile
• IPD CSWP 36F, Initial Non-Access Stratum (NAS) Message Security
• IPD SP 1353, Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting
• IPD IR 8613, Multi-Cloud Architecture Challenges
• SP 1347, NIST Cybersecurity Framework (CSF) 2.0: Informative References Quick-Start Guide
• IR 8611, m-NGAC: Transcending Traditional Database Security Models

NIAP News

Updates & Announcements:

• 2nd Quarter Progress Report
• Policy #33 – Post Quantum Cryptography Implementation

Protection Profile Announcements:

• Call for participants for the TC reviewing Peripheral Sharing Device (PSD), Version 5.0

DISA News

Announcements:

• July 2026 Quarterly Release
• Group Policy Objects (GPOs) – July 2026

Security Technical Implementation Guide Updates:

• Omnissa Workspace ONE UEM STIG
• Nokia Service Router (SR) OS 25.x STIG
• Unified Endpoint Management SRG
• MongoDB Enterprise Advanced 7.x STIG
• VMware vSphere 8.0 STIG
• Microsoft Intune (Desktop & Mobile) STIG
• Microsoft IIS 10.0 STIG
• Juniper EX Series Switches STIG
• IBM z/OS STIG
• Forescout STIG
• F5 BIG-IP TMOS STIG
• Cisco NX OS Switch STIG
• Cisco ISE STIG
• Cisco IOS Switch STIG
• Cisco IOS Router STIG
• Cisco ASA STIG
• Apache Server 2.4 Unix STIG
• Ivanti Policy Secure STIG
• Google Android 17 STIG

NIST News

Updates & Announcements:

• None

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• Cybersecurity Supply Chain Risk Management (C-SCRM) Due Diligence Assessment Quick-Start Guide
• Draft SP 800-209r1, Security Guidelines for Storage Infrastructure
• Draft SP 800-239, AI Data Center Security Analysis: A High-Performance Computing (HPC) Driven Approach

NIAP News

Updates & Announcements:

• None

Protection Profile Announcements:

• None

DISA News

Announcements:

• DISA Chief Urges Unified Cyber Defense Teaming to Meet Emerging AI-Era Threats
• DISA Unveils New Zero Trust–Driven Coalition Network Strategy to Strengthen Secure, Interoperable Warfare Operations with Allies
• ReForged Creates a Faster Path from Legacy Code to AI-Enabled Warfighter Capabilities

Security Technical Implementation Guide Updates:

• Apple visionOS 26
• Apple vision OS 2
• Apple iOS/iPadOS 26 – Ver 1, Rel 3
• Samsung Android 16
• Google Android 16
• Zebra Android 14
• Google Android 15
• Google Android 14
• Apple iOS/iPadOS 18 – Ver 2, Rel 3
• Omnissa Workspace ONE UEM

NIST News

Updates & Announcements:

• None

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• 2nd Call for Comments on SP 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC
• SP 800-126r4 (Revision 4), Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.4
• SP 800-126Ar4, SCAP 1.4 Component Specification Version Updates: An Annex to NIST SP 800-126r4
• NIST IR 8374 Revision 1, Ransomware Risk Management: A Cybersecurity Framework (CSF) 2.0 Community Profile
• Draft Post-Quantum Cryptography Updates to the PIV Standards
• NIST IR 8618 “Cybersecurity for IoT Workshop: Future Directions”
• SP 1339, Operational Technology Backup Quick Start Guide
• Draft SP 800-219r2 (Revision 2), Automated Secure Configuration Guidance From the macOS Security Compliance Project (mSCP)
• SP 800-213r1 (Revision 1), IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements
• SP 1800-45, Cybersecurity for the Water and Wastewater Sector: Build Architecture
• Draft Project Description Asset Management as a Foundation for OT Cybersecurity
• SP 800-18r2 (Revision 2), Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems

NIAP News

Updates & Announcements:

• NIAP’s First Quarter 2026 Progress Report

Protection Profile Announcements:

• None

DISA News

Announcements:

• Launched new Acquisition Decisions LinkedIn newsletter
• Strong push on skills-based hiring for cyber roles
• Moving beyond resumes to validated technical assessments
• Accelerated hiring tied to live events (e.g., TechNet Cyber)
• Heavy promotion of TechNet Cyber 2026
• Ongoing emphasis on strengthening industry partnerships through increased transparency and accessibility for vendors via new comms channels
• A shift towards modernizing industry engagement, hiring of cyber talent, and communication of opportunities

Security Technical Implementation Guide Updates:

• None

NIST News

Updates & Announcements:

• “Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process”

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• SP 800-234, High-Performance Computing (HPC) Security Overlay
• Pre-Draft Call for Comments on Revision to SP 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping (2012)
• Draft IR 8323 Revision 2, Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT)
• Call for Comments on SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations (2019)
• SP 800-70r5 (Revision 5), National Checklist Program for IT Products – Guidelines for Checklist Users and Developers
• SP 800-172r3 (Revision 3), Enhanced Security Requirements for Protecting Controlled Unclassified Information
• SP 800-172Ar3 (Revision 3), Assessing Enhanced Security Requirements for Controlled Unclassified Information
• Draft SP 800-228A, Guidelines for the Secure Deployment of RESTful Web APIs
• IR 8500A IPD, Blockchain-Based Secure Software Assets Management (BloSS@M)
• IPD of SP 1800-41, Responding to and Recovering from a Cyber Attack: Cybersecurity for the Manufacturing Sector
• SP 800-238, Fiscal Year 2025 Annual Report for NIST Cybersecurity and Privacy Program
• NIST IR 8320E IPD, Hardware-Enabled Security: Confidential Computing of Data in Cloud Workloads

NIAP News

Updates & Announcements:

• NIAP CCEVS Policy #29: Addendum for Certificate Length Updates

Protection Profile Announcements:

• Published – Virtualization Version 2.0

DISA News

Announcements:

• DISA is advancing cybersecurity and operational resilience by modernizing command-and-control infrastructure, adopting zero trust principles, and strengthening the Defense Department’s digital operations capabilities.

Security Technical Implementation Guide Updates:

• Apache Server 2.4 Unix STIG
• Apache Server 2.4 Windows STIG
• Apache Tomcat Application Server 9 STIG
• Application Security and Development STIG
• Application Server SRG
• IBM WebSphere Liberty Server STIG
• JBoss Enterprise Application Platform 6.3 STIG
• Kubernetes STIG
• Kubernetes STIG SCAP Benchmark
• Layer 2 Switch SRG
• Microsoft .NET Framework 4.0 STIG
• Microsoft IIS 10.0 STIG
• Microsoft Office 365 ProPlus STIG
• Microsoft SQL Server 2016 STIG
• Microsoft Windows 10 STIG
• Microsoft Windows 11 STIG
• Microsoft Windows Server 2019 STIG
• Microsoft Windows Server 2022 STIG
• Microsoft Windows Server DNS STIG
• Motorola Solutions Android 13 STIG
• Mozilla Firefox STIG
• Mozilla Firefox SCAP Benchmarks (Linux & Windows variants)
• Tanium 7.x STIG
• Tanium 7.x TanOS STIG
• Trend Micro TippingPoint STIG
• Group Policy Objects (GPOs)
• Microsoft Intune Policy
• Microsoft Entra ID STIG
• Oracle Linux 9 STIG

NIST News

Updates & Announcements:

• None

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• NIST IR 8259r1 (Revision 1), Foundational Cybersecurity Activities for IoT Product Manufacturers
• SP 800-133r3 (Revision 3), Recommendation for Cryptographic Key Generation
• CSWP 52, Firmware-Based Monitoring for Bus-Based Computer Systems
• Draft Small Business Cybersecurity: Non-Employer Firms
• IPD SP 800-230, Additional SLH-DSA Parameter Sets for Limited-Signature Use Cases

NIAP News

Updates & Announcements:

• NIAP Policy #5 Frequently Asked Questions and CAVP Mapping Document Updated

Protection Profile Announcements:

• Published – PP for General Purpose Computing Platform (GPCP) Version 2.0
• Published – PP-Module for Software Defined Networking – Controller Version 1.0
• Published – PP-Module for Media Access Control Security Version 2.0
• Published – cPP-Module for Stateful Traffic Filter Firewalls, Version 2.0

DISA News

Announcements:

• None

Security Technical Implementation Guide Updates:

• STIG Viewer 3.7.0 Release Notes
• Apple visionOS 26 STIG
• HPE Alletra Storage ArcusOS STIG
• Soaring Software Solutions TCMax 9.x STIG – Ver 1, Rel 1
• Red Hat Enterprise Linux 10 STIG – Ver 1, Rel 1
• Adobe Acrobat Professional DC Continuous Track STIG Benchmark – Ver 2, Rel 1

NIST News

Updates & Announcements:

• None

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• SP 800-81r3: Secure Domain Name System (DNS) Deployment Guide
• CSWP Applying 5G Cybersecurity and Privacy Capabilities
• SP 1800-42A, Digital Identities – Mobile Driver’s License (mDL): Accelerating Development and Adoption of Digital Identity for Financial Institutions
• NIST Cybersecurity Framework (CSF) 2.0 quick-start guides (QSG)

NIAP News

Updates & Announcements:

• NIAP 2025 End of Year Report

Protection Profile Announcements:

• NIAP Endorses CPP_DSC_V2.1
• NIAP Endorses CPP_FDE_AA_v3.0
• NIAP Endorses CPP_HCD_v1.1
• NIAP Endorses CPP_FDE_EE_v3.0
• PP-Module for Voice/Video over IP Version 2.0 Published
• PP-Module for Enterprise Session Controller Version 2.0 Published
• PP-Module for Session Boarder Controllers Version 2.0 Published
• PP-Module for Intrusion Prevention System (IPS) Version 2.0 Published
• PP-Module for Authentication Servers Version 2.0 Published

DISA News

Announcements:

• DISA meets Dept of War’s call for speed and responsiveness
• DISA releases RFI related to the development and refinement of the UCR

Security Technical Implementation Guide Updates:

• Adobe Acrobat Professional DC Continuous Track Draft STIG Benchmark – Ver 1, Rel 0.1
• Adobe Acrobat Professional DC Continuous Track Draft STIG Benchmark Comment Matrix
• Oracle Linux 9 STIG for Ansible – Ver 1, Rel 4
• Oracle Linux 9 STIG for Chef – Ver 1, Rel 4
• Nutanix Acropolis STIG
• MongoDB Enterprise Advanced 8.x STIG – Ver 1, Rel 1
• Microsoft Windows Server 2025 STIG – Ver 1, Rel 1
• Zebra Android 14 STIG

NIST News

Updates & Announcements:

• None

Special Publications, Interagency Reports, & Cybersecurity White Papers:

• • IPD SP 1800-39: Data Classification Practices

NIAP News

Updates & Announcements:

• None

Protection Profile Announcements:

• PP-Module for LiFi Access System Version 1.0

DISA News

Announcements:

• None

Security Technical Implementation Guide Updates:

• Draft BIND 9.x V3 STIG
• Draft Microsoft Defender for Endpoint STIG
• STIG Viewer 3.5.1
• SCC 5.10.2

NIST News

Updates & Announcements:

• None

Special Publications & Interagency Reports:

• CSWP 39, Considerations for Achieving Crypto Agility: Strategies and Practices
• SP 800-226 Guidelines for Evaluating Differential Privacy Guarantees
• IR 8545, Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process
• Draft SP 1308, NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick Start Guide
• NIST update to FIPS 202 and SP 800-185
• Draft IR 8523, Multi-Factor Authentication for Criminal Justice Information Systems
• Draft SP 1800-33 5G Cybersecurity Volume A
• Trustworthy and Responsible AI Report, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2)
• Draft SP 800-228, Guidelines for API Protection for Cloud-Native Systems
• IR 8214C 2pd (second public draft), NIST First Call for Multi-Party Threshold Schemes

NIAP News

Updates & Announcements:

• “The NIAP office has fully transitioned back to in-office operations”

Protection Profile Announcements:

• None

DISA News

Announcements:

• DISA has opened the Joint Warfighter Test Center in Fort Huachuca, Arizona
• DISA has cancelled the 2025 Hybrid Cloud Symposium

Security Technical Implementation Guide Updates:

• Out-of-cycle EVMM SRG update
• Draft Cisco ACI STIG
• STIG Viewer 3.5 and User Guide
• Oracle Database 19c STIG
• Canonical Ubuntu 24.04 LTS

NIST News

Updates & Announcements:

• None

Special Publications & Interagency Reports:

• 2nd Draft SP 800-38Gr1 (Revision 1), Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption
• IR 8356, Security and Trust Considerations for Digital Twin Technology
• IPD of IR 8011v1r1 (Volume 1, Revision 1), Testable Controls and Security Capabilities for Continuous Monitoring: Volume 1 — Overview and Methodology
• IR 8475, A Security Perspective on the Web3 Paradigm
• IR 8286 series – 5 publications
• Draft IR 8546, Cybersecurity Framework (CSF) 2.0 Semiconductor Manufacturing Community Profile

NIAP News

Updates & Announcements:

• NIAP Q4 2024 Progress Report
• NIAP Policy Letter #12 – Acceptance Requirements of a Product for NIAP Evaluation

Protection Profile Announcements:

• Call for Participants in the Mobile Device Management (MDM) Technical Community