Executive Order 14412 moved the federal post-quantum migration target from 2035 to 2030 and 2031. OMB M-26-15 turned it into a five-phase plan with a submission date this fall, and the Department of War published a PQC Strategy on the same clock.
OMB M-26-15 · Every civilian agency · Oct 22, 2026 · 7 days
Every civilian agency. 120 days from issuance. Every executive department and agency must develop and submit a PQC Migration Plan to OMB. Phase 1 inventory and governance work has to be far enough along to support it.
FAR Council, CISA, NIST. 180-day cluster. FAR Council publishes a proposed rule requiring contractor compliance with NIST FIPS standards. CISA releases minimum elements for a cryptographic bill of materials. NIST initiates its pilot PQC migration and revises CMVP processes to accelerate validations.
DoW and Intelligence Community. All new national security system acquisitions must be CNSA 2.0 compliant: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384/512.
NSA, FAR Council. 270-day requirement. NSA submits an initial status report on national security systems PQC migration. FAR Council publishes a proposed rule on contractor vulnerability disclosure programs covering cryptographic flaws.
NIST. Pilot migration on a subset of NIST information systems must be complete, producing the reference pattern other agencies are expected to follow.
Civilian agencies, national security systems and the contractors who supply both.
EO 14412 · Every agency head
Within 30 days of the order, each agency head must identify its PQC migration lead and provide the name and contact details to the OMB Director and the National Cyber Director.
OMB M-26-15 · GSA
60 days from issuance of M-26-15. Coordinates identity, credential, and access management implications of the PQC transition.
EO 14412 · OMB Director
90-day requirement to issue guidance on reviewing HVA and high impact system inventories and developing transition plans. Satisfied early by M-26-15, issued June 24, 2026.
NIST CMVP · All federal procurement
FIPS 140-2 modules may be used for new systems through this date; after it, NIST's CMVP places the remaining FIPS 140-2 certificates on the Historical list (September 22) and new federal procurement requires FIPS 140-3 validated modules. Existing-system use can continue. Validation currently averages 500+ days — and the question that matters is whether your vendor's module is validated today.
OMB M-26-15 · Every civilian agency
120 days from issuance. Every executive department and agency must develop and submit a PQC Migration Plan to OMB. Phase 1 inventory and governance work has to be far enough along to support it.
EO 14412 · FAR Council, CISA, NIST
180-day cluster. FAR Council publishes a proposed rule requiring contractor compliance with NIST FIPS standards. CISA releases minimum elements for a cryptographic bill of materials. NIST initiates its pilot PQC migration and revises CMVP processes to accelerate validations.
CNSSP 15 · DoW and Intelligence Community
All new national security system acquisitions must be CNSA 2.0 compliant: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384/512.
EO 14412 · NSA, FAR Council
270-day requirement. NSA submits an initial status report on national security systems PQC migration. FAR Council publishes a proposed rule on contractor vulnerability disclosure programs covering cryptographic flaws.
EO 14412 · NIST
Pilot migration on a subset of NIST information systems must be complete, producing the reference pattern other agencies are expected to follow.
OMB M-26-15 · Civilian agencies
Pilots executed and prioritized systems in migration. Plans refined from lessons learned before the Phase 3 push.
EO 14412 · HVAs, high impact systems, covered contractors
The headline deadline. All High Value Assets and high impact systems must use PQC for key establishment (FIPS 203 / ML-KEM). The FAR proposed rule extends the same date to covered contractors. In parallel: CNSA 2.0 exclusive use for software/firmware signing and network equipment, non-compliant NSS equipment phased out, and NIST IR 8547 deprecates RSA-2048 and ECDSA P-256.
EO 14412 · HVAs, high impact systems
All HVAs and high impact systems must use PQC for digital signatures (FIPS 204 / ML-DSA or FIPS 205 / SLH-DSA). Same date: every national security system must be running CNSA 2.0 under CNSSP 15.
CNSA 2.0 · National security systems
Browsers and cloud services, operating systems, constrained equipment, and custom or legacy systems must exclusively use CNSA 2.0 algorithms or be replaced.
NIST IR 8547 · NSM-10 · M-26-15 · Federal enterprise
End state. Remaining systems complete migration under M-26-15 Phase 5; NIST disallows all quantum-vulnerable public-key algorithms; NSM-10’s original government-wide target is reached.
Securing the Nation Against Advanced Cryptographic Attacks. Signed June 22, 2026; 91 FR 38483, published June 25, 2026. Key establishment migrated to PQC by December 31, 2030 for high-value and high-impact systems; digital signatures by December 31, 2031; FAR Council rules extend NIST FIPS compliance and CBOM requirements to contractors; NIST directed to accelerate CMVP validation throughput.
Execution of the Migration to Post-Quantum Cryptography. Issued June 24, 2026. Phase 1 (2026 to 2027): inventory, governance, migration plan. Phase 2 (2027 to 2028): pilots and prioritized systems in migration. Phase 3 (2029 to 2030): key establishment migrated for HVAs. Phase 4 (2031): signatures migrated. Phase 5 (2035): full enterprise completion. The near-term one: every agency submits a PQC migration plan to OMB by October 22, 2026, including the methodologies and automated tools used for the cryptographic inventory.
Five lines of effort (June 2026): optimize governance; baseline inventory and plan; develop and analyze; integrate commercial solutions; deploy quantum-resistant devices. QKD, quantum networking and non-local quantum randomness are explicitly excluded. CNSA 2.0 (CNSSP 15): AES-256, ML-KEM-1024, ML-DSA-87, SHA-384/512, LMS/XMSS for firmware; new NSS acquisitions compliant from January 1, 2027, exclusive use for software and firmware signing by December 31, 2030, all NSS by December 31, 2031.
FIPS 140-2 modules may be used for new systems through September 21, 2026. After that date NIST's CMVP places the remaining FIPS 140-2 certificates on the Historical list, and new federal procurement requires FIPS 140-3 validated modules. Existing-system use can continue. CMVP validation currently averages 500 days or more.
Procurement will ask both questions: is the cryptographic module itself FIPS 140-3 validated, and how are its PQC algorithms validated and delivered?
EnQuanta's cryptography is a FIPS 140-3 validated cryptographic module, CMVP certificate #5312 (Active, software-only). The NIST PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) are delivered through a CAVP-validated provider, with module-boundary PQC validation in process.
The FAR proposed rule extends the 2030 key-establishment deadline to covered contractors, and M-26-15 instructs agencies to prioritize procurement of products that already support PQC. Read plainly: if your product cannot do PQC, agencies are being instructed to plan its removal.
Can you hand us a CBOM for your product?
Which FIPS 140-3 module do you ship, and how are its PQC algorithms validated?
Is your cryptography configuration-driven, or compiled in?
What is your published migration timeline?
How fast can you rotate a broken algorithm out of deployed firmware?
Deadlines derived from published federal documents; this page is informational and is not legal advice.
