A customer archive can outlive the cryptography that protects it. Change the protection used for new writes and yesterday’s records still need attention. So do backups, exports and the permissions that will apply when someone restores them.
For teams responsible for long-lived data, the valuable capability is a repeatable migration with evidence of what changed. 8DB, our omnimodal database, connects protected records, registered retained copies and restore authority in one lifecycle. That gives an operator a more useful question to ask: what must happen before this particular migration can be considered complete?
Plan for change beyond the first deadline
NIST’s draft transition plan, IR 8547, sets out a path away from quantum-vulnerable public-key algorithms. Its proposed schedule disallows affected algorithms after 2035, with some lower-strength uses deprecated earlier. As of this article’s September 2026 review, that document remains an initial public draft. Those dates concern the older algorithms being replaced; they do not schedule the retirement of today’s post-quantum standards.
The broader planning principle is durable. NIST’s crypto-agility guidance addresses the ability to replace or adapt cryptographic mechanisms while preserving security and operations. Build that ability into the data lifecycle and the next transition becomes a process you can exercise, inspect and improve.
Give the migration an explicit finish line
Consider an archive whose live records have moved to a new protection profile while a registered backup still carries the earlier one. A useful completion check keeps that backup visible. It also tests what happens when the backup returns: can the current owner read the restored records, and is a revoked reader still refused?
8DB’s recorded native lifecycle evaluations exercise those connections. In the qualified scenario, stored records move from HKDF-SHA256 to HKDF-SHA384 for key derivation while their authenticated-encryption algorithm remains AES-256-GCM-SIV. The retained old archive blocks completion, and historical backup recovery is checked against the current required protection profile and authority.
That scope matters when planning an evaluation. This is recorded evidence for a specific key-derivation and restore transition. Replacing every cipher or signature algorithm, discovering undeclared copies, and maintaining uninterrupted serving through a change require their own tests. The useful result here is concrete: completion includes the registered retained artifact, and restoration does not simply inherit yesterday’s access decision.
8DB · Migration completion
The live store is one part of the picture.
Account for the retained copy and the authority used to restore it.
Verify the records after the declared transition.
Record checkKeep completion open while this artifact remains in scope.
Completion checkVerify owner access and revoked-reader refusal.
Access checkEvaluate the whole lifecycle you operate
Established tools already provide valuable pieces of cryptographic change. Oracle documents online tablespace encryption and rekeying. HashiCorp Vault documents rewrapping ciphertext after key rotation. The buying decision is how those mechanisms fit the records, copies and recovery paths your team actually owns.
8DB’s approach brings those questions into the protected data lifecycle. For an evaluation, define the old and new profiles, register the retained artifacts in scope, and include a restore after an authority change. Inspect the completion decision alongside the recovered records. A successful live-store rewrite is one useful result; an accounted-for archive and a correctly authorized restore answer additional operational questions.
This makes migration evidence useful to more than the team running the change. Security reviewers can inspect the tested protection transition. Operators can see which registered artifact still needs work. Application teams can verify that authorized access survives recovery.
Start with one archive and one restore
Bring us a representative retained dataset, the protection change you need, and the backup or export that is hardest to account for. We can define an evaluation around those inputs, including the conditions that would keep the migration open.
The goal is a transition your team can repeat with confidence in its evidence. Talk with us about a scoped migration evaluation.
Evidence scope Standards reviewed · Recorded KDF and restore qualification. Explore the evidence.