Key facts
- President Trump signed two quantum-related executive orders on June 22, 2026: one on post-quantum cryptography and one on quantum innovation.
- The cryptography order requires agencies to move high value assets and high impact systems to post-quantum cryptography by Dec 31, 2030 for key establishment and Dec 31, 2031 for digital signatures.
- Each agency head must name a PQC migration lead within 30 days. Agencies must also submit migration plans and the coordinating authorities must issue inventory and transition guidance within 90 days.
- The order cites 'harvest now, decrypt later' risk, where adversaries collect encrypted data now to decrypt it once capable quantum computers exist.
President Donald Trump signed two quantum-related executive orders on June 22, 2026, one on post-quantum cryptography (PQC) and one on quantum innovation, according to Skadden, Arps, Slate, Meagher & Flom LLP. PQC refers to encryption algorithms designed to resist attack by future quantum computers. The cryptography order sets dates for federal agencies and starts rulemaking that will extend to contractors.
The deadlines
Skadden says the cryptography order requires agencies to move high value assets and high impact systems to PQC by Dec. 31, 2030 for key establishment, and by Dec. 31, 2031 for digital signatures. Skadden says that pulls forward the earlier federal target of 2035, set in a 2022 Biden-era national security memorandum, to 2030 for key compliance requirements.
Industrial Cyber’s account of the order lists the same two end dates and names OMB, the National Cyber Director, CISA and NIST among the agencies with roles in carrying them out.
Near-term clocks for agencies
Skadden reports that each agency head must name a PQC migration lead within 30 days. Agencies must also submit migration plans, and the coordinating authorities must issue inventory and transition guidance within 90 days.
According to Skadden, NIST must start a PQC migration pilot on its own systems within 180 days and finish it by Dec. 31, 2027. NIST must also update the Cryptographic Module Validation Program within 180 days.
Industrial Cyber reports that CISA, working with NIST, must publish guidance within 270 days on the minimum elements of a cryptographic bill of materials. The purpose is to allow automated assessment of cryptographic assets, per the same account.
What reaches contractors
Skadden says the FAR Council, which writes the government-wide procurement rules, must propose a rule within 180 days requiring covered contractors to comply with NIST Federal Information Processing Standards, including PQC algorithms, by Dec. 31, 2030. Within 270 days it must propose a second rule requiring contractor vulnerability disclosure policies that cover cryptographic weaknesses.
Skadden also reports that the Department of War released its own PQC strategy on June 23, 2026. It requires systems to support PQC or be phased out by the end of 2030 and to use PQC by the end of 2031. Skadden says it extends requirements to defense contractors, including through updates to the Cybersecurity Maturity Model Certification (CMMC) program.
For critical infrastructure, Skadden says Sector Risk Management Agencies must work with CISA to help owners and operators develop PQC migration plans.
Why the clock is tightening
The order cites “harvest now, decrypt later” risk, according to Skadden. In that scenario, adversaries collect encrypted data today so they can decrypt it once capable quantum computers exist. Data that must stay secret for many years is exposed to that risk before such a machine arrives.
CyberScoop’s opinion piece, written by a member of Congress, argues that Washington needs to prepare now. It says Google has set 2029 as its own target for moving to PQC. It also cites research from Oratomic this spring suggesting a cryptographically relevant quantum computer may need far fewer physical resources than earlier estimates.
The timing of a quantum computer able to break current encryption remains uncertain, according to both CyberScoop and K&L Gates. The new dates are therefore a bet on preparation time rather than a forecast of when such a machine will appear.
What came before
The order builds on existing law. Skadden says the Quantum Computing Cybersecurity Preparedness Act of December 2022 already requires OMB to prioritize PQC migration and agencies to inventory vulnerable cryptographic systems.
CyberScoop’s opinion piece adds that the NSA has selected quantum-resistant algorithms for National Security Systems and is moving them toward CNSA 2.0, its suite of required algorithms for those systems.
What contractors and operators are being told
Skadden and K&L Gates both advise contractors, critical infrastructure operators and vendors to take four steps. Those are to inventory cryptographic assets, identify long-lived sensitive data, assess vendor PQC readiness, and bring quantum risk into governance.
Agencies and contractors that haven't started a cryptographic inventory are already behind.
Garfield Jones, Industrial Cyber
If you're not doing your cryptography inventories now, you really need to start
Parham Eftekhari, SC Media
What to watch
- Within 30 days: agency PQC migration leads named.
- Within 90 days: inventory and transition guidance from the coordinating authorities, and agency migration plans.
- Within 180 days: the FAR Council's proposed rule on contractor compliance with NIST standards, and the start of the NIST pilot.
- Within 270 days: CISA's cryptographic bill of materials guidance and the FAR Council's proposed rule on contractor vulnerability disclosure.
The FAR Council rule is the step that would turn the 2030 date into a contract requirement for covered contractors. Skadden describes it as a proposal, so its final scope will depend on the rulemaking process.
Join the discussion