What NIST 2030/2035, CNSA 2.0, the federal migration order and NCSC milestones commit operators to — and how to sequence a migration backwards from them.