Federal post-quantum cryptography policy moved from a long-range 2035 objective to a set of nearer, operational deadlines in June 2026. For agencies, the direction is now explicit: assign accountable leadership, review the cryptographic inventory, build a prioritized migration plan, and move high-value and high-impact systems to post-quantum cryptography on defined schedules.
For government contractors, the picture is consequential but more nuanced. The new policy directs the Federal Acquisition Regulatory Council to propose a rule covering contractor compliance. As of August 2026, that direction is not the same thing as a final, universally applicable FAR clause. Current obligations still depend on the contract, agency, system, information type, and any national-security requirements that already apply.
This article summarizes the federal direction and the preparation work agencies and contractors can do now. It is operational guidance, not legal advice; organizations should confirm applicable requirements with their contracting, legal, and authorizing officials.
The 2026 order establishes concrete federal milestones
On June 22, 2026, the White House issued the executive order Securing the Nation Against Advanced Cryptographic Attacks. It directs each agency to identify a post-quantum cryptography migration lead within 30 days. It also directs OMB, working with CISA and the Office of the National Cyber Director, to issue guidance requiring agencies to review their inventories and submit migration plans.
The order sets two especially important dates for federal high-value assets and high-impact systems, excluding National Security Systems:
- December 31, 2030: transition key establishment to post-quantum cryptography.
- December 31, 2031: transition digital signatures to post-quantum cryptography.
Those are not deadlines for every federal system in isolation. They apply to the HVA and high-impact scope described by the order, while separate and subsequent policy will govern other systems and implementation details. But they establish a clear sequencing signal for agency portfolios, acquisition plans, vendors, and shared-service providers.
The inventory requirement predates the new deadlines
The 2026 deadlines build on work agencies were already directed to perform. OMB Memorandum M-23-02 requires agencies to submit a prioritized inventory of systems and assets containing cryptography vulnerable to a cryptanalytically relevant quantum computer. The inventory began with high-impact systems, HVAs, and other particularly vulnerable systems, and it is updated annually.
M-23-02 is notable because it includes systems operated by an agency or on an agency’s behalf. It also asks for operational details, not merely algorithm names: the service provided by the cryptography, key or module length, software package and vendor, operating-system information, hosting details, and other system context.
That makes the inventory a supply-chain and service-management problem as much as a cryptography problem. Agencies need evidence from products, integrators, cloud services, managed-service providers, and application teams. Contractors supporting in-scope systems should expect increasingly specific questions about deployed cryptography, product roadmaps, validated implementations, dependencies, and the evidence behind their answers.
NIST standards are available now
In August 2024, NIST approved the first three federal post-quantum standards: FIPS 203, FIPS 204, and FIPS 205. FIPS 203 specifies ML-KEM for key establishment. FIPS 204 specifies ML-DSA for digital signatures, and FIPS 205 specifies SLH-DSA as a hash-based digital-signature alternative.
Availability of standards does not mean every protocol, product, cryptographic module, or operational environment is ready for immediate replacement. Migration also depends on implementation guidance, interoperability, module validation, platform and vendor support, performance testing, certificate and identity ecosystems, and safe deployment patterns. NIST’s transition report, IR 8547, describes the expected movement away from quantum-vulnerable standards, but the currently published version remains an initial public draft.
What the order says about contractors
The executive order directs the FAR Council to publish, within 180 days, a proposed rule amending the FAR. The proposed rule is to require covered contractors to comply by December 31, 2030, with NIST FIPS, including applicable FIPS that incorporate PQC-compliant algorithms.
Three words matter: proposed, covered, and applicable. The rulemaking process must define scope and contract implementation. Until a final rule and clauses are issued and incorporated, the executive-order direction should not be represented as a blanket present-day requirement for every company that holds a government contract.
That does not make waiting a sound strategy. A contractor that discovers its cryptographic dependencies only after a solicitation or clause appears may have too little time to obtain vendor commitments, redesign integrations, validate modules, test interoperability, or produce credible transition evidence. The proposed-rule direction is a strong planning signal even where it is not yet a current contractual obligation.
National Security Systems follow a separate path
The OMB inventory and the HVA/high-impact deadlines described above exclude National Security Systems. NSS owners, operators, and supporting vendors must follow the national-security policy path, including NSA and CNSS post-quantum guidance. NSA identifies CNSS Policy 15, released in March 2025, and the Commercial National Security Algorithm Suite 2.0 materials as the relevant sources.
Contractors working with classified systems or NSS should not substitute general civilian-agency timelines for program-specific direction. They should coordinate with the responsible government authority and apply the cryptographic selections, validation expectations, and transition milestones required for that environment.
Seven actions to take now
- Identify the governing scope. Map contracts, systems operated on behalf of agencies, HVAs, high-impact systems, NSS involvement, information types, and existing cryptographic clauses.
- Assign accountable ownership. Agencies now need a PQC migration lead. Contractors should identify an executive sponsor and connect security, engineering, product, acquisition, legal, and program teams.
- Build a living cryptographic inventory. Record active key establishment, encrypted connections, and digital signatures; relate them to assets, software, vendors, owners, business services, and source evidence.
- Document coverage and uncertainty. Use multiple discovery channels where appropriate and state their boundaries. A system or algorithm not observed within the connected scope is not proof of absence.
- Segment by deadline and dependency. Prioritize HVA and high-impact exposure, long-lived sensitive data, externally facing services, difficult vendor dependencies, and systems with slow acquisition or refresh cycles.
- Ask vendors for evidence-backed roadmaps. Request supported standards, implementation and validation status, protocol dependencies, compatibility requirements, upgrade paths, and dates. Avoid accepting “quantum safe” as a substitute for technical detail.
- Preserve proof of progress. Connect findings to decisions, owners, exceptions, remediation work, refreshed observations, and scoped exports such as CBOMs.
The operating model matters more than a one-time survey
The federal direction increasingly assumes that cryptographic state can be inventoried, prioritized, migrated, and demonstrated. A spreadsheet assembled for an annual submission may satisfy a moment, but it does not keep pace with certificate rotation, software releases, cloud changes, new endpoints, vendor upgrades, or remediation work.
A durable program needs a repeatable loop: discovery, canonical inventory, evaluation, action, and proof. Vista Platform is designed to support that operating loop by tracking observed cryptography and governing migration evidence. It does not replace legal interpretation, procurement decisions, vendor engineering, or the migration work itself—and it does not generate PQC keys. Its role is to help teams understand what they have, decide what must change, and show what happened.
For agencies, the deadlines are close enough to shape current plans and budgets. For contractors, the acquisition signal is now explicit enough to shape product roadmaps and customer conversations. The organizations best positioned for either path will be those that can connect every migration claim to a current asset, an accountable owner, a defined requirement, and traceable evidence.
Policy status reviewed August 21, 2026. Readers should consult the linked primary sources and current contract or agency guidance for subsequent changes.