Under the CNSA 2.0 January 2027 deadline, new acquisitions for US National Security Systems (NSS) must be CNSA 2.0 compliant from January 1, 2027, unless otherwise noted. It is not a deadline for finishing the migration, and it does not apply to the economy as a whole. NSA’s CNSA 2.0 FAQ<\/a> says plainly that “NSA does not mandate requirements on any other entity outside of NSS.”<\/p>\n The date is about nine weeks away, and a lot of what has been written about it comes from vendors. This article sticks to what NSA and NIAP have published, notes where secondary sources disagree, and lays out the deadlines that follow in 2030, 2031, 2033 and 2035.<\/p>\n CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is NSA’s list of public algorithms approved to protect National Security Systems against both classical and quantum attacks. The policy that makes these algorithms binding for NSS is CNSSP 15, which was updated in 2025 to include CNSA 2.0 and deprecate CNSA 1.0<\/a>.<\/p>\n NSS are systems that handle classified or national-security information, run by the Department of Defense, the intelligence community and some other agencies. If you sell nothing into that environment, either directly or through a prime contractor, CNSA 2.0 doesn’t bind you. Civilian federal systems and the private sector follow NIST’s guidance instead. Those deadlines are covered in our explainer on NIST IR 8547 and whether RSA is deprecated in 2030<\/a>.<\/p>\n In practice, though, the reach is wider than the definition. Component suppliers, firmware vendors and software makers in the defense supply chain end up meeting CNSA 2.0 requirements because their customers have to.<\/p>\n According to NSA’s FAQ, from January 1, 2027 new NSS acquisitions must be CNSA 2.0 compliant unless otherwise noted. This is a procurement rule. It controls what agencies may buy from that date on, and it does not switch off equipment already in service.<\/p>\n The FAQ also has a practical fallback. If fully certified CNSA 2.0 products aren’t available by the end of 2026, agencies may buy products that can be updated and move them to CNSA 2.0 later. This reading is consistent across PostQuantum’s analysis of FAQ v2.1<\/a> and Quantum Sentinel’s overview of the 2027 date<\/a>. For vendors, this means that an algorithm-agile product with a credible upgrade path will matter in 2027 even if it doesn’t yet run CNSA 2.0 everywhere.<\/p>\n “Unless otherwise noted” also matters. NSA’s guidance sets different timelines for different equipment categories (see below), so the 2027 rule is not one switch that flips for every product type on the same day.<\/p>\n CNSA 2.0 uses NIST-standardized algorithms, and for the post-quantum ones it picks the largest parameter sets. Based on NSA’s FAQ<\/a> and the CNSA summary on Wikipedia<\/a>:<\/p>\nWhat is CNSA 2.0, and who has to follow it?<\/h2>\n
What the CNSA 2.0 January 2027 deadline actually requires<\/h2>\n
CNSA 2.0 requirements: which algorithms are approved?<\/h2>\n