Mental model
In every module of this course from M0 to M4, you have seen a status badge beside every mention of a standard or algorithm: FINAL2024-08-13, DRAFT2026-07-14, SELECTED2025-03-11, and so on. This lesson gathers the seven values together and, by giving a real, live-verified example from within the course for each, makes the differences clear enough that you can tell them apart instantly in a meeting.
One of the project’s own core rules states why this precision matters: “Never call a draft a standard, never call a selected algorithm a published FIPS, never call a vendor roadmap commitment a validated module. This distinction is the expertise.” In other words, using these seven words correctly is not decorative jargon; it is the basic discipline you need when advising a bank.
Seven statuses, seven real examples
FINAL2024-08-13: a standard has been published in a form that will not change. Example: FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) became final on 13 August 2024 (M3, M4).
DRAFT2026-07-14: a draft, in public comment or editorial review, not final yet. Example: KMIP v3.0, still at Committee Specification Draft (CSD02) stage (you will see it in M9, a module not yet opened on the FOUNDATIONS path; this one line is enough for now).
SELECTED2025-03-11: NIST has chosen an algorithm for standardization, but no draft or final text exists yet. Example: HQC, selected on 11 March 2025 and still at this status today (September 2026) (M2). FN-DSA has the same status; as you saw in M4, despite NIST’s “nearly ready” wording in 2025, its draft (IPD) was still unpublished in September 2026, a concrete reminder that SELECTED may not mean “soon”.
CANDIDATE: a contender in an evaluation round, not selected yet. Example: the additional signature candidates NIST IR 8610 advanced to round 3 (FAEST, MAYO, SQIsign, UOV and others) have this status today; none of them is even SELECTED yet (M4).
VALIDATED2026-07-29: validated by an independent laboratory or program, not a vendor claim. Example: Thales TCT Luna T7, CMVP Certificate #5450, verified directly against NIST’s own database (you will see it in detail in M9).
DEPLOYED2026-02-27: observed running live in production, not a roadmap promise. Example: hybrid ML-KEM key exchange (X25519MLKEM768) is enabled by default in browsers (Chrome, Edge, Firefox). According to Cloudflare’s own live measurement, 60%+SOURCED of the clients connecting to it offered PQ support as of February 2026; that is a capability measurement (does the client support it), not the same thing as “what the traffic uses”. In a separate metric that measures use directly, Cloudflare’s 2025 Year in Review shows that 52%SOURCED of human-generated web traffic was actually PQ-encrypted. Both figures are real DEPLOYED evidence, but they measure different things; it is an example of clarifying what a metric measures as well as the status.
WITHDRAWN2026-07-29: withdrawn from the process or cancelled. Example: HAWK was a candidate in NIST’s round 3 additional signatures and was withdrawn by its own team because of a cryptanalysis finding (you met it in M4; you will see the full case in M14).
Why this distinction is a credibility signal
All seven examples are real events verified live in earlier modules of this course; none is hypothetical. Being able to use these seven words correctly, with their sources, in front of an architect or auditor shows two things at once: current knowledge (statuses change fast; a SELECTED algorithm can become FINAL within years), and source discipline (every status claim must rest on a primary source, usually a live database or an official announcement). Conversely, someone who uses these seven words loosely (for example a vendor presentation mixing up “selected” and “published”) puts their own credibility in question without realizing it.