Assignments (FIPS 203–205, NIST IR 8547): ML-KEM-512 = 1, ML-KEM-768 = 3, ML-KEM-1024 = 5; ML-DSA-44 = 2, ML-DSA-65 = 3, ML-DSA-87 = 5; SLH-DSA 128s/128f = 1, 192s/192f = 3, 256s/256f = 5; Falcon-512 = 1 and Falcon-1024 = 5.
Categories exist because quantum attack costs are uncertain, so NIST measures each scheme against a well-understood reference problem rather than claiming a bit count. Many deployments choose category 3 (ML-KEM-768, ML-DSA-65) as the default trade-off, while CNSA 2.0 requires category 5.