U.S. Executive Order Sets Federal Post‑Quantum Cryptography Migration Timeline

Executive Order 14409, titled “Securing the Nation Against Advanced Cryptographic Attacks,” directs every U.S. federal agency to begin a multi‑year post‑quantum cryptography (PQC) migration program. Within 30 days, agency heads must designate a PQC migration lead and report the appointment to the Office of Management and Budget and the National Cyber Director.

Within 90 days, OMB will issue guidance requiring agencies to inventory high‑value assets and high‑impact systems, move them to PQC for key establishment by December 31 2030 and for digital signatures by December 31 2031, and submit a migration plan. The order also mandates that CISA, in coordination with NIST, publish guidance on a cryptographic bill of materials (CBOM) within 270 days to help agencies assess vendor cryptographic components. The program emphasizes cross‑agency coordination, authority for the migration lead, and a phased approach separating key establishment from digital‑signature transitions.