In regard to a nationally required encryption standard, I do not see this happening the near future because right now Congress is (a) preoccupied with health care, and (b) very concerned about imposing costly IT requirements on small and medium-sized businesses at a time when the national unemployment rate is 10.2%. The two big national data security bills being considered right now, H.R. 2221 and S. 1490, do not contain an encryption standard. The Massachusetts data security regulation, 201 CMR 17.00, previously required 128-bit encryption, but after businesses complained about this and other technology-specific provisions, it was amended in August (and finalized just last week) to keep the encryption requirement flexible.

So, for at least the next year or two, outside of specialized areas like HIPAA, I don't see a specific encryption standard being adopted by the federal or state governments. With that said, if a business is using a standard that clearly falls below best practices and then suffers a data breach (just as TJX used a wireless encryption standard that the PCI Security Council had criticized as vulnerable), you can expect the FTC will step in and plaintiffs' lawyers will file negligence claims. In other words, the FTC and the courts will set the standard de facto.