NSA Guidance for Transition to Quantum-Resistant Cryptography P-2025: P-2025 CNSA 1.0 acceptable through 31 December 2025; earlier CNSSP 15 waivers cancelled, six months to comply or 90 days to seek a new waiver

CNSA 1.0 algorithms remain acceptable in all products through 31 December 2025, although products with validated CNSA 2.0 implementations are to be preferred. Every exception and waiver granted under the 2016 version of CNSSP 15 is cancelled: activities relying on one must come into compliance within six months of the policy's effective implementation date or, if they cannot, submit a new waiver request with a mission justification to the National Manager (NSA, Cybersecurity Policy) within 90 days; NSA decides each request on bona fide mission-essential need within 60 days of receipt. Approvals already validated against NIAP protection profiles, CSfC capability packages or other National Manager processes follow that guidance as it is updated, and the profiles and packages move to CNSA 2.0 as commercial availability allows.