Challenges

• CUI and Classified Data Are Primary Harvest Targets: Controlled Unclassified Information, program data, acquisition documents, and technical specifications are exactly the category of data nation-state adversaries prioritize for Harvest Now, Decrypt Later collection. Defense contractors handling CUI over classically encrypted channels are building adversary archives today.
• NSA CNSA 2.0 Mandates Intermediate Milestones Now: CNSA 2.0 transition requirements vary by acquisition date and system category. Consult CNSSP 15 and current NSA profiles for phased equipment, algorithm-use, and validation requirements. Inventorying cryptography early helps identify vendor and integration dependencies before applicable deadlines.
• CMMC 2.0 Cryptographic Controls: CMMC assessments evaluate applicable safeguards for CUI. Level 2 uses NIST SP 800-171 requirements, while Level 3 adds requirements from NIST SP 800-172. A PQC inventory can support planning, but a CBOM or PQC roadmap is not, by itself, a universal CMMC requirement or proof of compliance.
• Supply Chain Cryptographic Risk: A prime contractor's own cryptographic posture is only as strong as the weakest subcontractor in its supply chain. ITAR-controlled technical data and CUI traverse the defense supply chain through dozens of tier-1 and tier-2 vendors. Quantumize surfaces supply chain cryptographic dependencies in the CBOM.

Regulatory and Policy Requirements

The defense sector faces the most aggressive post-quantum migration mandates of any vertical.

• NSA CNSA 2.0: Specifies algorithms for NSS, including ML-KEM-1024 and ML-DSA-87. Current NSA profiles and CNSSP 15 govern transition milestones and exceptions.
• CMMC 2.0: Provides an assessment framework for applicable CUI safeguards. Determine requirements from the contract and assessment level; do not infer a universal PQC mandate.
• NIST FIPS 203/204/205: Finalized NIST standards. CNSA 2.0 does not approve SLH-DSA (FIPS 205) for NSS use; NIST standardization and NSA approval are distinct.
• ITAR / EAR: International Traffic in Arms Regulations and Export Administration Regulations require cryptographic controls on technical data. Post-quantum encryption provides the forward-secure protection ITAR demands for long-lived program information.
• FAR/DFARS: Federal Acquisition Regulation and Defense Federal Acquisition Regulation Supplement incorporate cybersecurity requirements including NIST SP 800-171 compliance for contractors handling covered defense information.

How Quantumize Helps

• CUI Encryption With ML-KEM (FIPS 203): Protect Controlled Unclassified Information at rest and in transit with NIST-standardized post-quantum encryption. Envelope encryption with hardware-backed key wrapping, KMS migration tooling, and Cryptographic Recovery Packages (CRP) for disaster scenarios.
• NSS Software and Firmware Signing: CNSA 2.0 allows LMS and XMSS for software and firmware signing, with validated ML-DSA also approved for those uses. ML-DSA-87 is specified for general-purpose NSS signatures. SLH-DSA is not approved for NSS use; follow current NSA validation and profile requirements.
• WORM-Locked Audit Trail for CMMC Assessments: Every cryptographic operation, key event, and access decision is logged in a tamper-evident audit trail exportable to S3 Object Lock for CMMC assessment evidence. Role-Based Access Control with Admin / Crypto Officer / User separation meets SP 800-171 access control requirements.