Federal agencies would move systems toward quantum-resistant encryption

Agency heads must name employees to lead post-quantum cryptography migration and provide their contact information. This applies to each federal agency and covers agency-wide management of cryptographic systems. OMB guidance must require agencies to review high-value assets and high-impact systems, excluding National Security Systems from that review. The order defines post-quantum cryptography as methods designed to resist both quantum and classical computer attacks. Agency heads must name their migration leads within 30 days of June 22, 2026. OMB must issue the related agency guidance within 90 days of that date. The guidance must set migration deadlines of December 31, 2030, for key establishment and December 31, 2031, for digital signatures.

Federal officials must coordinate the transition, provide technical guidance, assist critical-infrastructure operators, and oversee related pilot, reporting, and public-guidance work. The duties cover federal agencies, critical-infrastructure owners and operators, National Security Systems, and a suitable subset of NIST-owned or operated systems. Sector Risk Management Agencies must work with CISA to help critical-infrastructure owners and operators develop migration plans. The Secretary of State is directed to encourage foreign governments and industry groups in key countries to adopt NIST-standardized algorithms. The order does not itself create a legal right or benefit, and implementation remains subject to existing law and available appropriations. NIST must start its pilot within 180 days of June 22, 2026, and finish it by December 31, 2027. NSA reporting begins within 180 days and continues annually until migration is complete. CISA must publish cryptographic bill-of-materials guidance within 270 days.

Procurement officials must coordinate cost-saving efforts, while the FAR Council must publish proposed rules for contractor encryption and vulnerability disclosure practices. The proposed contractor rules would cover contractors subject to the Federal Acquisition Regulation and would address NIST standards, cryptographic vulnerabilities, encryption, and nonapproved algorithms. The proposed rules would not become contractor requirements unless adopted through the applicable rulemaking process. NIST may revise validation processes only to the extent appropriate and consistent with applicable law. The order preserves agency legal authority and makes implementation subject to available appropriations. NIST must act on validation processes within 180 days of June 22, 2026. The FAR Council must publish the encryption proposal within 180 days and the vulnerability-disclosure proposal within 270 days. The proposed encryption rule would set December 31, 2030, as the contractor compliance date if adopted.