pqcstatus
Regulation & guidance

US federal PQC migration (EO 14412, OMB M-26-15, NSM-10): cryptography requirements and deadlines

Government policy

Automated cryptographic inventory and CBOM, PQC key establishment by end of 2030, PQC signatures by end of 2031, full migration by 2035.

At a glance

TypeGovernment policy
JurisdictionUS
Who it applies toUS federal agencies and, through upcoming FAR rules, federal contractors and their software suppliers.

Cryptography requirements

ReferenceRequirementWhat a scan and inventory can evidence
OMB M-26-15Maintain an automated, continuously updated cryptographic inventory; submit a PQC migration plan; TLS 1.3 required by 2030-01-02.
  • Cryptographic inventory
  • TLS configuration
  • PQC migration plan

Key dates

  1. Agency PQC migration plans due (120 days after OMB M-26-15).
  2. High-value and high-impact systems on PQC key establishment; federal contractors expected to comply with FIPS including PQC (FAR rule pending).
  3. High-value and high-impact systems on PQC signatures.
  4. Mitigate as much quantum risk as feasible (NSM-10); full migration.

Sources

  1. Executive Order 14412 — Securing the Nation Against Advanced Cryptographic Attacks · The White House
  2. OMB M-26-15 — Execution of the Migration to Post-Quantum Cryptography · The White House (OMB)
  3. National Security Memorandum 10 (NSM-10) on quantum computing · The White House (archived)

Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.

Frequently Asked Questions

Who must comply with US federal PQC migration (EO 14412, OMB M-26-15, NSM-10)?

US federal agencies and, through upcoming FAR rules, federal contractors and their software suppliers.

What does US federal PQC migration (EO 14412, OMB M-26-15, NSM-10) require for cryptography?

OMB M-26-15: Maintain an automated, continuously updated cryptographic inventory; submit a PQC migration plan; TLS 1.3 required by 2030-01-02.

What are the key dates of US federal PQC migration (EO 14412, OMB M-26-15, NSM-10)?

October 22, 2026: Agency PQC migration plans due (120 days after OMB M-26-15). December 31, 2030: High-value and high-impact systems on PQC key establishment; federal contractors expected to comply with FIPS including PQC (FAR rule pending). December 31, 2031: High-value and high-impact systems on PQC signatures. December 31, 2035: Mitigate as much quantum risk as feasible (NSM-10); full migration.