Securing the Nation Against Advanced Cryptographic Attacks

What it does

• •Directs federal agencies to transition their high-value assets and high-impact information systems to post-quantum cryptography (PQC) for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.
• •Requires each agency to identify a PQC migration lead within 30 days and submit a transition plan within 90 days to the Office of Management and Budget (OMB) and National Cyber Director.
• •Tasks the Department of Commerce (through NIST) and Department of Homeland Security (through CISA) with providing technical guidance and assistance to federal agencies and critical infrastructure owners on PQC implementation.
• •Directs the Federal Acquisition Regulatory Council to amend federal procurement rules within 180 days to require covered contractors to comply with NIST post-quantum cryptography standards by December 31, 2030.

Why it matters

• •Large-scale quantum computers pose a significant threat to current cryptographic systems; adversaries may be collecting encrypted U.S. information now to decrypt later once quantum computers become operational.
• •The order aims to strengthen national security and maintain U.S. technological leadership by executing a coordinated, government-wide transition to quantum-resistant cryptography standards.

Who is affected

• •All federal agencies managing high-value assets or high-impact information systems (excluding National Security Systems, which follow a separate timeline).
• •Critical infrastructure owners and operators, who will receive assistance from Sector Risk Management Agencies in developing their own PQC migration plans.
• •Federal contractors and vendors subject to Federal Acquisition Regulation requirements to adopt NIST-approved post-quantum cryptography standards.

What happens next

OMB shall issue detailed guidance within 90 days establishing agency-specific transition requirements; NIST shall initiate a pilot project within 180 days; and the FAR Council shall publish a proposed rule within 180 days to impose contractor compliance deadlines.