PQC planning resources

Know the date.
Understand the scope.

A practical guide to selected federal cryptographic milestones. Read each date alongside the issuing authority and the systems it applies to.

Discuss migration planning Read the milestones

Find. Fix. Defend.

Federal cryptographic-module transition

FIPS 140-2 modules move to Historical.

FIPS 140-3 for new federal systems. Existing systems may continue using FIPS 140-2 modules under NIST guidance.

Source: NIST CMVP ↗

FIPS 140-2 / NIST CMVP

Transition dateSeptember 22, 2026See what changes

Active to Historical.

September 21, 2026 is the final day FIPS 140-2 modules remain on the Active list. On September 22, their certificates move to the Historical list.

Check the module before you select it.

For new federal systems, select an active FIPS 140-3 validated module. Check the certificate and security policy against the configuration you intend to deploy.

Existing systems have a different path.

NIST allows continued use of Historical FIPS 140-2 modules in existing systems. Review agency requirements and replacement plans; this date does not mean every installed module must be removed.

Calendar days in U.S. Eastern time. Guidance checked September 18, 2026.

Selected federal milestones

Dates with the detail that matters.

Sep 22, 2026Federal cryptographic-module selectionFIPS 140-2 modules move to the Historical listNIST CMVPUpcoming

NIST distinguishes use in existing systems from selection for new systems. Review module status and the applicable transition guidance.

NIST CMVP ↗

Oct 22, 2026Covered federal agencies · National Security Systems excludedSubmit an agency PQC Migration PlanOMB M-26-15 · §3(B), §3(D)Upcoming

OMB M-26-15 requires agencies to submit a PQC Migration Plan to OMB and ONCD within 120 days of June 24, 2026. This is a planning submission, not a completed-migration deadline. The memorandum does not apply to National Security Systems.

OMB M-26-15 · §3(B), §3(D) ↗

Dec 19, 2026Rulemaking and national security reportingContractor PQC proposed rule and NSA status reportEO 14412 · §5(c), §6(c)Upcoming

EO 14412 calls for a proposed FAR rule for covered contractors and an NSA status report within 180 days. A proposed rule is not an effective contract requirement.

EO 14412 · §5(c), §6(c) ↗

Mar 19, 2027Guidance and rulemakingCBOM guidance and vulnerability-disclosure proposed ruleEO 14412 · §5(d), §6(d)Upcoming

The order calls for public guidance on minimum CBOM elements and a proposed FAR vulnerability-disclosure rule within 270 days.

EO 14412 · §5(d), §6(d) ↗

Dec 31, 2030Covered federal high-value and high-impact systemsPost-quantum key establishmentEO 14412 · §4(b)Upcoming

EO 14412 directs migration of covered federal systems to PQC key establishment. National Security Systems follow a separate path under the order.

EO 14412 · §4(b) ↗

Dec 31, 2031Covered federal high-value and high-impact systemsPost-quantum digital signaturesEO 14412 · §4(b)Upcoming

The corresponding digital-signature migration deadline applies to the covered federal systems identified in the order.

EO 14412 · §4(b) ↗

Planning a migration

Start with your
own requirements.

Your obligations depend on system type, agency direction, contracts and applicable standards. Confirm applicability with the people responsible for your program.

Read OMB migration guidance

Document the scope

Identify covered systems, owners and the authority behind each requirement.

Build the inventory

Record discovered cryptographic dependencies, collection methods and coverage limitations.

Prioritize and verify

Define a migration sequence, validation requirements and evidence for the review process.

Your next step

Start with one environment.

Explore QuantaView with your team. We will define the scope, access requirements and success criteria before an evaluation begins.

Scope a QuantaView evaluation