White House Sets Accelerated Post-Quantum Cryptography Migration Requirements
Summary
A White House executive order and OMB memo accelerate U.S. federal post-quantum cryptography migration, setting agency deadlines and outlining inventory, risk-prioritization, contractor, and critical-infrastructure expectations.
Key points
- The executive order sets deadlines for federal agencies to adopt post-quantum cryptography for key establishment by December 31, 2030, and digital signatures by December 31, 2031.
- OMB calls for agency migration plans within 120 days, phased migration, and a continuously updated inventory of cryptographic assets.
- Agencies are directed to prioritize high-value and high-impact systems, sensitive data, and risks from attackers harvesting encrypted data for possible later decryption.
- NIST and CISA are tasked with issuing minimum guidance for Cryptographic Bills of Material by March 2027.
- Federal contractors, including cloud service providers, are expected to coordinate migration; proposed rules would require NIST-approved PQC standards and address cryptographic vulnerabilities in vulnerability disclosure programs.
- The article says other countries are also setting PQC transition milestones, with timelines varying by country and sector.
Article Details
- Event Type
- U.S. federal post-quantum cryptography policy and migration requirements announced through Executive Order 14409 and OMB memorandum M-26-15.
- Impact
- Federal agencies must migrate critical systems to NIST-approved post-quantum cryptography on accelerated timelines, develop migration plans and cryptographic inventories, and prioritize high-risk systems. Government contractors and cloud service providers are expected to align with the requirements; proposed procurement rules would require applicable contractors to comply with approved standards by December 31, 2030. The article also describes international transition milestones and expected effects on critical infrastructure providers.
Vendors
Products
Countries
Australiaby 2030, with Germany providing additional guidance to require a full transition by 2032. Meanwhile, Australia is seeking to complete transition by 2030, and India has a dual track roadmap, with full migration byCanadaMany nations are targeting 2035 for full transition (including Japan, Canada, and the European Union). However, those timelines are moving targets, and increasingly being qualified with earlier milestones. The EuropeanFranceIn France and Singapore, software certifications will be affected if vendors do not transition by 2027. After that date, all private companies seeking a visa-certification in France or a Cyber Trust mark in SingaporeGermanyThe European Union is targeting the transition of critical infrastructure to PQC by 2030, with Germany providing additional guidance to require a full transition by 2032. Meanwhile, Australia is seeking toIndiato require a full transition by 2032. Meanwhile, Australia is seeking to complete transition by 2030, and India has a dual track roadmap, with full migration by 2029 or 2033 depending on the sector.JapanMany nations are targeting 2035 for full transition (including Japan, Canada, and the European Union). However, those timelines are moving targets, and increasingly being qualified with earlier milestones. The EuropeanSingaporeIn France and Singapore, software certifications will be affected if vendors do not transition by 2027. After that date, all private companies seeking a visa-certification in France or a Cyber Trust mark in SingaporeUnited States
Industries
Cloud servicesMany U.S. government contractors (such as those who provide software, cloud services, or handle sensitive federal data) will also be expected to transition their own environments and coordinate migration with theirCritical infrastructureFinally, these two documents lay out expectations for government contractors and prioritize assistance for critical infrastructure’s transition.Governmentlead to cracking long-standing encryption standards earlier than previously estimated. Now, the federal government is also shifting its timelines.Information Technology