CNSA 2.0, the NSA’s Commercial National Security Algorithm Suite 2.0, is the set of quantum-resistant cryptographic algorithms required for U.S. national security systems. Its first hard date is close: under Committee on National Security Systems Policy 15 (CNSSP 15), new products and services acquired for national security systems must be CNSA 2.0 compliant from January 1, 2027, unless otherwise noted. For defense contractors that build, sell, or operate those systems, the post-quantum transition is no longer a future planning exercise.
This article explains what CNSA 2.0 requires, the deadlines by product category, who among defense contractors it reaches, and how it relates to CMMC.
What CNSA 2.0 Requires
The NSA first published CNSA 2.0 in a September 2022 advisory. It replaces the classical public-key algorithms of the earlier suite, RSA, Diffie-Hellman, and elliptic curve cryptography, with quantum-resistant ones, and it keeps strong symmetric and hash algorithms that are not seriously threatened by known quantum attacks. It also takes a narrower path than general NIST guidance: it allows only the highest-strength parameter set of each post-quantum algorithm.
| Function | CNSA 2.0 algorithm | Standard |
|---|---|---|
| Key establishment | ML-KEM-1024 | FIPS 203 |
| Digital signatures | ML-DSA-87 | FIPS 204 |
| Software and firmware signing | LMS or XMSS (stateful hash-based signatures); ML-DSA-87 also permitted | NIST SP 800-208 |
| Symmetric encryption | AES-256 | FIPS 197 |
| Hashing | SHA-384 or SHA-512 | FIPS 180-4 |
The table shows two practical consequences. First, products that offer ML-KEM-768 or ML-DSA-65, the common choices for commercial systems, are not CNSA 2.0 compliant for national security use. Second, software and firmware signing has its own track using hash-based signatures, because signing keys and roots of trust are often fixed for the life of a device. Elevate’s explainer on FIPS 203 and ML-KEM [INTERNAL LINK: FIPS 203 article, add URL after publication] covers the key establishment standard in more detail.
CNSA 2.0 Deadlines by Product Category
The NSA’s timeline sets two dates for each category of product: when it should support and prefer CNSA 2.0 algorithms, and when it should use them exclusively. CNSSP 15 adds acquisition and phase-out dates that apply across categories.
| Product category | Support and prefer CNSA 2.0 by | Use exclusively by |
|---|---|---|
| Software and firmware signing | 2025 | 2030 |
| Web browsers, servers, and cloud services | 2025 | 2033 |
| Traditional networking equipment (VPNs, routers) | 2026 | 2030 |
| Operating systems | 2027 | 2033 |
| Niche equipment (constrained devices, large PKI systems) | 2030 | 2033 |
| Custom applications and legacy equipment | Update or replace | 2033 |
The policy dates sit on top of that schedule. From January 1, 2027, new acquisitions for national security systems must be CNSA 2.0 compliant unless otherwise noted. Equipment and services that cannot support CNSA 2.0 are to be phased out by December 31, 2030, and the CNSA 2.0 algorithms are mandated by December 31, 2031. National Security Memorandum 10 set the broader goal of making national security systems quantum-resistant by 2035.
The table shows why software signing and networking come first. A device with a classical root of trust burned into hardware cannot be fixed with a software update, and VPNs and routers carry the traffic that adversaries can collect today and decrypt later. The NSA’s guidance for 2027 reflects that: new national security products should not ship with a root of trust that relies on a non-quantum-resistant algorithm.
Who CNSA 2.0 Reaches Among Defense Contractors
CNSA 2.0 applies to national security systems, which include systems operated by or on behalf of the government that involve intelligence, cryptologic, command and control, weapons, or classified information. Three groups of contractors are affected:
- Vendors that sell hardware, software, or cloud services intended for use in national security systems, who need CNSA 2.0 support in products offered after January 1, 2027.
- Integrators and operators that build or run national security systems on the government’s behalf, who must select compliant products and plan the transition of what is already deployed.
- Suppliers to those primes, whose components, firmware, or software end up inside national security systems and inherit the signing and key establishment requirements.
A contractor whose only federal obligation is protecting CUI on its own business systems is generally not inside a national security system. For that contractor, CNSA 2.0 is a signal of where federal cryptography is heading rather than a direct requirement.
How CNSA 2.0 Relates to CMMC
CMMC and CNSA 2.0 address different systems and different questions. CMMC Level 2 measures whether a contractor protects CUI on its own systems against the 110 requirements of NIST SP 800-171 Rev 2. One of those requirements, 3.13.11, calls for FIPS-validated cryptography when cryptography protects the confidentiality of CUI. It does not require post-quantum algorithms. CNSA 2.0 governs the cryptography inside national security systems and the products sold into them.
The two meet in three places. A contractor can hold both obligations at once, CMMC for its business environment and CNSA 2.0 for the national security systems it builds or operates. Primes that deliver national security systems are likely to pass CNSA 2.0 expectations down to suppliers through contract terms. And the Department of War released a post-quantum cryptography strategy in June 2026, which indicates that the transition will reach the wider defense industrial base over time, beyond national security systems. Elevate’s guide to NIST 800-171 versus CMMC explains the CMMC side.
What Defense Contractors Should Do Now
With the January 1, 2027 acquisition date eight weeks away, the steps depend on which of the three groups a contractor belongs to.
Step 1: Determine Whether You Touch National Security Systems
Review contracts and product lines to identify any delivery into, or operation of, national security systems, including through primes. If none applies, CNSA 2.0 is planning context. If any applies, the rest of these steps are current work.
Step 2: Inventory Cryptography Where It Matters
For the affected products and systems, record where key establishment, digital signatures, and software or firmware signing occur, and which algorithms and parameter sets they use today. Elevate’s guide to building a cryptographic inventory covers the method.
Step 3: Start With Signing and Roots of Trust
Software and firmware signing has the earliest exclusive-use date, 2030, and roots of trust cannot be changed after a device ships. Vendors should confirm that new products shipped for national security use from 2027 rely on LMS, XMSS, or ML-DSA-87 for their roots of trust and update signing.
Step 4: Confirm Parameter Sets With Suppliers
Ask each supplier of cryptographic components whether its products support ML-KEM-1024 and ML-DSA-87 specifically, not just “post-quantum algorithms,” and when they will be validated. Support for the lower parameter sets does not satisfy CNSA 2.0.
Step 5: Plan the Installed Base
For systems already deployed, map each component to its category deadline and plan replacement or update before the exclusive-use dates. Equipment that cannot support CNSA 2.0 is expected to be phased out by December 31, 2030.
Elevate supports defense contractors with CMMC preparation through its CMMC services. To review how CNSA 2.0 and CMMC apply to your contracts, talk to an Elevate advisor.
Conclusion
CNSA 2.0 turns the post-quantum transition into dated requirements for national security systems: ML-KEM-1024 and ML-DSA-87, hash-based signatures for software and firmware, compliant new acquisitions from January 1, 2027, phase-out of non-supporting equipment by the end of 2030, and exclusive use across categories by 2033. Vendors, integrators, and their suppliers inside that ecosystem have current work to do.
For contractors whose federal obligation is CMMC on their own business systems, CNSA 2.0 is not a direct requirement today, but it shows the direction the Department is taking. The first step for everyone is the same: know where cryptography is used and which algorithms protect it. To review how CNSA 2.0 and CMMC apply to your contracts, book a call with an Elevate advisor.
Key Takeaways
CNSA 2.0 is the NSA’s quantum-resistant algorithm suite for national security systems.
- January 1, 2027 is the first hard date. Under CNSSP 15, new acquisitions for national security systems must be CNSA 2.0 compliant from then, unless otherwise noted.
- Only the strongest parameter sets qualify. CNSA 2.0 requires ML-KEM-1024 and ML-DSA-87, plus AES-256 and SHA-384 or SHA-512.
- Signing comes first. Software and firmware signing, using LMS, XMSS, or ML-DSA-87, has an exclusive-use date of 2030.
- Deadlines vary by product category. Networking equipment reaches exclusive use by 2030; browsers, servers, cloud services, and operating systems by 2033.
- It applies to national security systems, not CMMC. CMMC Level 2 requires FIPS-validated cryptography, not post-quantum algorithms.
- Suppliers inherit it through primes. Components and firmware that end up in national security systems must meet the same algorithms.
Frequently Asked Questions
What is CNSA 2.0?
CNSA 2.0 is the NSA’s Commercial National Security Algorithm Suite 2.0, the set of quantum-resistant cryptographic algorithms required for U.S. national security systems. It specifies ML-KEM-1024 for key establishment, ML-DSA-87 for digital signatures, LMS or XMSS for software and firmware signing, AES-256 for encryption, and SHA-384 or SHA-512 for hashing. The NSA first published it in September 2022.
What happens on January 1, 2027 under CNSA 2.0?
Under CNSSP 15, new products and services acquired for national security systems must be CNSA 2.0 compliant from January 1, 2027, unless otherwise noted. NSA guidance also states that new national security products from 2027 should not ship with a root of trust that relies on a non-quantum-resistant algorithm. Existing equipment follows the category deadlines.
What are the CNSA 2.0 deadlines?
Software and firmware signing should support CNSA 2.0 by 2025 and use it exclusively by 2030. Browsers, servers, and cloud services follow 2025 and 2033; networking equipment 2026 and 2030; operating systems 2027 and 2033; niche equipment 2030 and 2033. Equipment that cannot support CNSA 2.0 is to be phased out by December 31, 2030, and national security systems are to be quantum-resistant by 2035.
Does CNSA 2.0 apply to CMMC?
No. CMMC measures protection of controlled unclassified information on a contractor’s systems against NIST SP 800-171, which requires FIPS-validated cryptography but not post-quantum algorithms. CNSA 2.0 applies to national security systems and the products sold into them. A contractor can be subject to both if it supports national security systems as well as handling CUI.
What is the difference between CNSA 2.0 and NIST post-quantum standards?
CNSA 2.0 uses NIST’s post-quantum standards but restricts them to the strongest parameter sets: ML-KEM-1024 and ML-DSA-87. NIST’s standards also allow ML-KEM-512 and 768 and ML-DSA-44 and 65, which are acceptable for many commercial and federal civilian uses but not for national security systems. CNSA 2.0 also sets earlier, category-specific deadlines.