CNSA 2.0 Compliance Checklist for 2026–2027

What Is CNSA 2.0?

CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is the NSA’s updated cryptographic standard defining which algorithms are approved for protecting classified and sensitive national security information. Released in September 2022 and updated through 2026, CNSA 2.0 mandates a transition from current public-key algorithms to quantum-resistant alternatives.

CNSA 2.0 replaces the original CNSA 1.0 suite, which permitted RSA, ECDSA, and Diffie-Hellman — all of which are vulnerable to attack by cryptographically relevant quantum computers (CRQCs).

Who Must Comply?

CNSA 2.0 compliance is mandatory for:

• National Security Systems (NSS) — systems handling classified information
• Defense Industrial Base (DIB) — contractors and subcontractors working with DoD
• Intelligence Community — all IC agencies and their technology partners
• Federal contractors — vendors supplying cryptographic solutions to NSS environments

Even if you’re not directly subject to CNSA 2.0, the standard is widely used as a benchmark for cryptographic best practices across regulated industries including financial services, healthcare, and critical infrastructure.

CNSA 2.0 Timeline

The NSA has published a phased transition timeline. Missing these deadlines creates procurement risks — non-compliant products will be ineligible for government contracts.

CNSA 2.0 Algorithm Requirements

Approved Algorithms (Post-Quantum)

Deprecated Algorithms (Must Replace)

Gap Analysis: How to Audit Your Cryptographic Posture

Step 1: Generate a Cryptographic Inventory

Before you can assess compliance, you need a complete picture of what cryptography you’re using. Use KeyLens to scan your entire codebase:

# Full codebase scan with detailed output
cbom scan . --format cbom --output cnsa-audit.json

# View summary table
cbom scan . --format table

The output catalogs every algorithm, key size, certificate, and protocol detected across all supported languages.

Step 2: Check Against CNSA 2.0 Requirements

KeyLens includes a built-in CNSA 2.0 compliance check:

# Run CNSA 2.0 compliance validation
cbom scan . --check cnsa-2.0

# Output shows violations with severity and location
# ❌ RSA-2048 detected in src/auth/jwt.rs:42
# ❌ ECDSA-P256 detected in src/tls/handshake.go:118
# ⚠️ SHA-256 detected in src/hash/digest.py:23
# ✅ AES-256-GCM compliant (src/crypto/encrypt.rs:15)

Step 3: Prioritize Remediation

Categorize your findings by urgency:

Critical (fix immediately):

• Any RSA, ECDSA, or ECDH usage in new code
• Key sizes below CNSA 2.0 minimums (AES-128, SHA-256 for NSS)
• Deprecated protocols (TLS 1.0, TLS 1.1)

High (fix by 2027):

• RSA/ECDSA in production code targeted for government procurement
• Non-PQC key exchange in VPN/networking code

Medium (plan migration by 2030):

• Legacy system RSA/ECDSA that will be migrated to PQC
• SHA-256 usage that should transition to SHA-384+

Step 4: Implement CI/CD Gating

Prevent new CNSA 2.0 violations from entering your codebase:

# .github/workflows/cnsa-check.yml
name: CNSA 2.0 Compliance
on: [pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: keylens/cbom-action@v1
        with:
          policy: cnsa-2.0
          fail-on-violation: true
          comment-on-pr: true

Step 5: Monitor Continuously

Cryptographic dependencies can change with every library update. Schedule regular scans:

# Compare against baseline
cbom diff cnsa-baseline.json --scan .

# Generate compliance trend report
cbom scan . --check cnsa-2.0 --format report

CNSA 2.0 vs FIPS 140-3

These standards are complementary, not competing:

You need both: CNSA 2.0 tells you which algorithms to use. FIPS 140-3 tells you how to implement them securely. A CBOM verifies you’re meeting the CNSA 2.0 algorithm requirements.

Migration Strategy for Defense Contractors

Phase 1: Discovery (Weeks 1–2)

1. Run KeyLens across all repositories and build artifacts
2. Generate a master CBOM for your organization
3. Identify all instances of RSA, ECDSA, ECDH, DH
4. Catalog key sizes and hash functions

Phase 2: Risk Assessment (Weeks 3–4)

1. Map cryptographic usage to business-critical systems
2. Identify systems with government procurement exposure
3. Prioritize by CNSA 2.0 timeline urgency
4. Estimate migration effort per system

Phase 3: Pilot Migration (Months 2–3)

1. Select a non-critical system for PQC migration
2. Replace RSA signatures with ML-DSA
3. Replace ECDH key exchange with ML-KEM
4. Validate with KeyLens --check cnsa-2.0

Phase 4: Rollout (Months 3–12)

1. Migrate production systems in priority order
2. Enable CI/CD gating to prevent regression
3. Generate compliance reports for procurement teams
4. Update supplier requirements to include CBOM

Frequently Asked Questions

Does CNSA 2.0 apply to commercial products?

CNSA 2.0 is mandatory for National Security Systems (NSS). However, it’s increasingly used as a benchmark for commercial products sold to government agencies. If your product handles sensitive government data or is part of the defense supply chain, you should treat CNSA 2.0 as a hard requirement.

Can I use hybrid cryptography during the transition?

Yes. The NSA permits hybrid approaches (combining classical and PQC algorithms) during the transition period. For example, you can use both ECDH and ML-KEM for key exchange. However, by 2033, all classical algorithms must be eliminated from NSS.

What if my cryptographic libraries don’t support PQC yet?

Major libraries are adding PQC support: OpenSSL 3.2+ supports ML-KEM and ML-DSA, AWS-LC includes PQC algorithms, and liboqs provides a cross-platform PQC library. If your library doesn’t yet support PQC, plan your migration to one that does.

How does CNSA 2.0 relate to EO 14412?

EO 14412 reinforces and accelerates CNSA 2.0 adoption by making PQC compliance a procurement requirement for federal contractors. EO 14412 references NIST standards (FIPS 203/204/205), which are the same algorithms mandated by CNSA 2.0.

Next Steps

• Generate your CBOM now → — Run your first CNSA 2.0 compliance check in under 2 minutes
• EO 14412 Compliance Guide → — Understand the federal executive order requirements
• PQC Migration Guide → — Step-by-step post-quantum transition planning
• What is a CBOM? → — Complete guide to Cryptographic Bills of Materials