U.S. Executive Order Sets 2030–31 Deadlines for Federal Post-Quantum Cryptography Migration
Summary
A June 22 executive order sets federal post-quantum cryptography deadlines of 2030 for key establishment and 2031 for digital signatures, with agency inventories and migration plans intended to address “harvest now, decrypt later” risks.
Key points
- Federal agencies must transition key establishment to post-quantum cryptography by December 31, 2030, and digital signatures by December 31, 2031.
- The order cites the risk that adversaries could collect encrypted data now and decrypt it later with future quantum computers.
- Agency heads must name migration leads within 30 days; OMB guidance on inventories and migration plans is due within 90 days.
- NIST is to complete a pilot migration on some of its systems by December 31, 2027.
- Proposed contractor rules would set a 2030 compliance deadline and address cryptographic flaws in vulnerability disclosure programs; the rules are not yet final.
- CISA and NIST are to publish minimum elements for a machine-readable cryptographic bill of materials within 270 days.
Article Details
- Event Type
- Executive order establishing federal post-quantum cryptography migration deadlines and implementation requirements.
- Impact
- Federal agencies must transition key establishment for high-value assets and high-impact systems by December 31, 2030, and digital signatures by December 31, 2031. The order also requires agency migration leads, cryptographic inventories and migration plans, and directs proposed contractor rules; national security systems remain on a separate track. It aims to address the risk of adversaries collecting encrypted data now for potential decryption by future quantum computers.