Almost every secure connection your organization makes, from a browser session to a VPN tunnel to a signed software update, relies on public-key cryptography such as RSA and elliptic curves. A sufficiently capable quantum computer would be able to break those algorithms. No such machine is publicly known today, so why act now?

Because of a threat often called "harvest now, decrypt later". An adversary can record encrypted traffic or copy encrypted archives today and wait until the means to decrypt them exist. If your data must stay confidential for many years, such as national identity records, health records, contracts or intellectual property, the risk starts now, not on the day the machine arrives.

The National Cybersecurity Authority has already written this into the updated National Cryptographic Standards. Below is what they say and how to prepare without disruption.

What changed in NCS-2:2025 #

The second edition of the National Cryptographic Standards, NCS-2:2025, replaces NCS-1:2020. It sets the minimum cryptographic requirements that national entities must meet when they use encryption to protect data, systems and networks for civil and commercial purposes.

It keeps two strength levels: a basic (moderate) level targeting 128-bit security and an advanced level targeting 256-bit security. Each entity chooses the level that fits the nature and sensitivity of what it protects, and a cryptographic system is rated by its weakest component.

The new edition adds a section on post-quantum algorithms. The accepted algorithms are:

  • ML-KEM (key establishment, as specified in NIST FIPS 203): ML-KEM-512 and ML-KEM-768 for the basic level, ML-KEM-1024 for the advanced level.
  • ML-DSA (digital signatures, FIPS 204): ML-DSA-44 and ML-DSA-65 for the basic level, ML-DSA-87 for the advanced level.
  • SLH-DSA (hash-based signatures, FIPS 205): specified 128-bit parameter sets for the basic level and 256-bit sets for the advanced level, with a limit on how many messages one key may sign.
  • Classic McEliece (key establishment): specified parameter sets for each level.

Two requirements in that section deserve attention:

  • Hybrid use: post-quantum cryptosystems must be used together with classical cryptosystems. In practice that means combining, for example, an elliptic-curve key exchange with ML-KEM, so the connection stays secure as long as either one holds.
  • Support: all cryptographic systems and solutions must support post-quantum algorithms.

The standards also cover quantum key distribution (QKD), and require it to be implemented in a hybrid way as well.

Does this apply to you? #

For entities under the Essential Cybersecurity Controls, control 2-8-3 requires cryptography requirements to include, at a minimum, those in the National Cryptographic Standards, at the level that fits the data and the entity's risk assessment.

For private companies under the NCNICC controls, encryption of data at rest and in transit is mandatory in both categories, and using secure, modern algorithms in line with the basic level of the national standards is mandatory for large entities and recommended for small and medium ones.

So even where the post-quantum section is not yet your immediate obligation, the direction is clear, and the systems you buy or build this year will still be running when it matters.

The international timeline #

NIST published the first three post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Its draft transition plan, NIST IR 8547, proposes that quantum-vulnerable public-key algorithms at 112-bit strength, such as RSA-2048 and P-256, be deprecated after 2030, and that quantum-vulnerable public-key algorithms be disallowed altogether after 2035. The plan is still a draft, but it is already shaping vendor roadmaps, which means the products you rely on will change on roughly that schedule.

Symmetric algorithms such as AES, and hash functions, are far less exposed; using the larger key and output sizes keeps a comfortable margin, which is one reason the advanced level targets 256-bit security.

A readiness plan in six steps #

1. Build a cryptographic inventory #

List where your organization uses public-key cryptography: TLS on websites and APIs, VPNs, SSH, code signing, document signing, PKI and certificates, payment and identity integrations, backups, and hardware such as HSMs and smart cards. Record the algorithm, key size, owner and vendor for each.

2. Rank by the life of the data #

Prioritize systems that protect data which must stay confidential for many years, and signatures that must remain trustworthy for a long time. These are the first candidates for hybrid protection.

3. Design for crypto agility #

Avoid hard-coding algorithms. Prefer libraries, protocols and products that let you change algorithms through configuration, so the next transition is a setting, not a rebuild.

4. Ask your vendors the right questions #

When renewing or buying, ask whether the product supports ML-KEM and ML-DSA, whether it supports hybrid modes, and when. Put the answers into contracts and renewal decisions.

5. Pilot hybrid key exchange where it is already available #

Many modern browsers, servers and content delivery networks already negotiate a hybrid key exchange that combines X25519 with ML-KEM-768. Enabling and testing it on a non-critical service is a low-risk way to learn about performance and compatibility.

6. Keep classical hygiene strong #

Post-quantum readiness does not replace today's basics: current TLS versions, strong certificates, sound key management and short key lifetimes. The national standards cover all of these, and they remain the main defence for years to come.

Where to start this quarter #

Pick one business system, map every place it uses cryptography, and record what would need to change to meet the post-quantum section of NCS-2:2025. That single exercise produces your inventory template, your vendor questions and your first roadmap.

Our national cryptographic standards service helps organizations bring their cryptography in line with NCS-2:2025 and plan the post-quantum transition alongside their ECC programme.

Frequently asked #

Which post-quantum algorithms do the National Cryptographic Standards accept?

NCS-2:2025 accepts ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) and Classic McEliece, each with specified parameter sets for the basic and advanced levels.

Can we switch to post-quantum algorithms on their own?

No. NCS-2:2025 requires post-quantum cryptosystems to be used together with classical cryptosystems, so a connection stays secure as long as either algorithm holds.

Is there a deadline for the transition?

The national standards do not set a single date in the text we reviewed. Internationally, NIST's draft plan IR 8547 proposes deprecating 112-bit quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035.

Is AES affected by quantum computers?

Far less than public-key algorithms. Using larger key sizes, such as AES-256, keeps a comfortable margin, which is why the advanced level of the standards targets 256-bit security.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.