White House sets October deadline for post-quantum cryptography plans

Federal agencies are now on a PQC clock

The White House has turned post-quantum cryptography from a standards discussion into a federal migration schedule. Executive Order 14412, signed June 22, 2026, directs agencies to move toward NIST-approved post-quantum cryptography and to help critical infrastructure owners and operators prepare for the same shift.

OMB’s June 24 memo, M-26-15, gives each agency 120 days to submit a migration plan to OMB and the National Cyber Director. That makes the first planning deadline October 22, 2026. The memo applies to civilian agencies and excludes national security systems.

What the federal timeline requires

The order and memo treat the transition as a multi-year project. Agencies are told to prioritize inventories, assessments, strategy, training and governance first, then move into pilots and early migrations before the main rollout phase.

The key deadlines are December 31, 2030 for PQC key establishment, December 31, 2031 for digital signatures, and 2035 for completing the remaining migration based on risk and commercial availability. The White House also says the FAR Council should propose contractor rules tied to PQC compliance by the end of 2030.

Why this matters now

This is not a future-only policy statement. NIST says three post-quantum standards are ready to implement now, and it urges organizations to start migrating immediately. That matters for federal agencies, but it also matters for contractors, cloud providers and vendors that sell into government markets.

The memo says agencies should fold PQC work into cloud migrations, software development lifecycles and hardware refresh cycles. In practice, that means the change is meant to show up in ordinary procurement and IT budgeting, not as a separate side project.

What to watch next

The next concrete checkpoint is the October 22 planning deadline. After that, the question is how quickly agencies turn inventories into road maps, pilots and replacements.

For federal contractors and technology vendors, the big issue is whether PQC readiness becomes a routine procurement expectation sooner than many companies planned.

Sources

• White House executive order on advanced cryptographic attacks
• NIST post-quantum cryptography standards page
• Nextgov/FCW report on the quantum executive orders