President Donald Trump set deadlines for moving two classes of federal information systems to post-quantum cryptography in an executive order he signed on June 22, 2026. In the order, “Securing the Nation Against Advanced Cryptographic Attacks,” Trump directed the Office of Management and Budget (OMB) to require agencies to move high value assets and high impact systems to post-quantum key establishment by December 31, 2030. OMB must require the same move for digital signatures by December 31, 2031.
High value assets, or HVAs, are federal information or systems designated as such under OMB Memorandum M-19-03 or a successor document. Agencies use FIPS 199, one of NIST’s Federal Information Processing Standards for government computer systems, to categorize their systems by the potential impact of a security breach. Trump defined a high impact system as one in which confidentiality, integrity, or availability is rated “high” under FIPS 199.
For federal contractors, Trump required only a proposed rule, due from the Federal Acquisition Regulatory Council by December 19, 2026, that would set a December 31, 2030, compliance date. The council maintains the Federal Acquisition Regulation (FAR), the rulebook for most federal purchasing.
In Section 2, Trump defined post-quantum cryptography, or PQC, as cryptographic algorithms or methods “designed to be resistant to attack by both a quantum computer and a classical computer.” Key establishment is the step in which two parties agree on a secret key to encrypt their communications. With a digital signature, a recipient can check who produced a message or a software file and that no one has altered it.
In Section 1, Trump wrote of “the risk of adversaries collecting United States information now, and decrypting it later once large-scale quantum computers are operational.” The tactic is known as harvest now, decrypt later.
Agency deadlines
Under Section 4(a), each agency head has 30 days to name a PQC migration lead and send the lead’s name and contact details to OMB and the National Cyber Director. OMB has 90 days under Section 4(b) to issue its guidance, in consultation with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber Director.
In that guidance, OMB must require each agency to review its inventory of HVAs and high impact systems and to submit a migration plan. Agencies must also “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030,” and make the same transition for digital signatures by December 31, 2031.
National security systems, as defined in federal law, include intelligence, military command, and classified systems. The 2030 and 2031 deadlines do not apply to them. OMB’s Memorandum M-19-03 says the HVA designation “is not applicable to national security systems,” and FIPS 199 covers federal systems “other than those information systems designated as national security systems.” Section 4(b) also excludes national security systems by name from the inventory review.
Trump tied the two migration terms to NIST standards, FIPS 203 for key establishment and FIPS 186-5 for digital signatures. In FIPS 203, NIST specified ML-KEM, formerly CRYSTALS-Kyber, a post-quantum method for establishing shared keys. NIST published FIPS 186-5 in February 2023, before its post-quantum signature standards, FIPS 204 and FIPS 205, which followed in August 2024.
In Section 4(c), Trump gave NIST 180 days to start a PQC migration pilot on some of its own systems. NIST must complete the pilot by December 31, 2027.
The NSA’s role
Under Section 3(b), the Commerce Department, through NIST, must give agencies ongoing technical guidance on PQC implementation in consultation with the director of the National Security Agency (NSA) and with CISA.
Under Section 5(c), the NSA’s director, “in his capacity as the National Manager for National Security Systems,” must report to the president through the Committee on National Security Systems. The director must deliver the first report on “the status of PQC migration for agencies that own or operate National Security Systems” within 180 days and one each year after that until migration is complete.
Contractors and critical infrastructure
Under Section 6(c), the FAR Council has 180 days to publish a proposed amendment to the Federal Acquisition Regulation “to require covered contractors to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.” Trump did not define “covered contractor” in the order.
Under Section 6(d), the council has 270 days to propose a second rule. Under that rule, covered contractors would take in reports of cryptographic vulnerabilities, “including testing for lack of encryption and the use of non-FIPS approved algorithms,” through vulnerability disclosure policies required by clauses in their federal contracts.
Sector risk management agencies lead federal security work in each critical infrastructure sector. Under Section 5(a), those agencies must work with CISA “to assist critical infrastructure owners and operators in developing their PQC migration plans.” Trump set no deadline for that work.
Next deadlines
OMB’s guidance is due by September 20, 2026. By December 19, the FAR Council must publish its proposed contractor rule, NIST must start its pilot, and the NSA’s director must deliver the first status report.
Also by December 19, NIST must revise the processes of its Cryptographic Module Validation Program under Section 6(b) to speed up validations, to the extent appropriate and consistent with applicable law. In that program, NIST validates the cryptographic modules that federal agencies use.
Under Section 5(d), CISA has until March 19, 2027, to publish guidance, in coordination with NIST, on the minimum elements for a cryptographic bill of materials. A cryptographic bill of materials is an inventory of the algorithms, keys, and certificates in a hardware or software product. The FAR Council’s proposed vulnerability disclosure rule is due the same day.
In Section 7(b), Trump made the order’s implementation “subject to the availability of appropriations.”
Update, November 13, 2026: The Federal Register published the order on June 25 as Executive Order 14412. On June 24, OMB issued Memorandum M-26-15, which “does not apply to national security systems.”
