Software and firmware signing for NSS was to begin transitioning immediately, with CNSA 2.0 supported and preferred by 2025 and used exclusively by 2030. NSA's specific recommendation: new software and firmware signed with CNSA 2.0 algorithms by 2025; deployed software and firmware that is not even CNSA 1.0 compliant moved to CNSA 2.0-compliant signatures by 2025; all deployed software and firmware carrying CNSA 2.0-compliant signatures by 2030. The FAQ explains the urgency: firmware validation algorithms are often locked for the life of a system, so a quantum-resistant root of trust may be needed in firmware years before the rest of the system, and NSA prefers the transition to start now with validated LMS or XMSS rather than wait for validated ML-DSA. The CSfC addendum applies the signing requirement to every component on the CSfC Components List.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.