US Government Mandates All Agencies Fast-Track PQC Migration
This post is part of my “Post-Quantum Cryptography Series”.
On June 22, 2026, President Trump issued Executive Order 14412 that requires all government agencies to migrate to PQC compliant solutions by December 31st, 2030 (or December 31st, 2031, depending on the use cases around key establishment or digital signatures).
The EU is developing their own strategy for this migration.
Many other countries are establishing similar strategies and implementation timelines.
For years, post-quantum cryptography (PQC) has occupied a strange place in cybersecurity. Everyone agrees it is important. Everyone agrees quantum computers will eventually threaten today’s public-key cryptography. Everyone agrees migration will take years.
Yet for many organizations, PQC has remained a future problem sort of like the Year 2038 Problem.
The White House’s June, 2026 Executive Order, “Securing the Nation Against Advanced Cryptographic Attacks,” signals that the era of planning is ending and the era of execution has begun, at least, for the US Government. There are other countries and organizations that are further along the path.
You can read about what Post Quantum Cryptography is, what’s impacted and why this is important in my “Post-Quantum Cryptography (2026): Preparing for the End of RSA and ECC” blog post.
What Changed?
Previous US Government guidance focused heavily on preparation:
- Inventory cryptographic systems
- Assess risk
- Develop migration plans
- Monitor NIST standardization efforts
The new Executive Order goes further. It formally establishes a policy that Federal information systems should transition to NIST-approved PQC standards and directs agencies to actively execute migration activities. It also expands support for critical infrastructure operators facing the same challenge.
So, 2022-2025 was preparing for PQC; 2026–2030/2031 we will see real movement towards PQC implementations.
“Prepare for PQC”
NIST Standards Are The Destination
The Executive Order centers on migration to NIST-approved Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography.
This is important because the cryptography industry has spent years waiting for standards to stabilize before making large-scale investments.
The standardization phase is largely complete.
Organizations can now begin planning around concrete algorithms rather than hypothetical future candidates.
Deadlines
According to administration statements, agencies are expected to establish migration plans, conduct pilot implementations, and accelerate deployment over the next several years. Public reporting surrounding the order references government migration targets extending into the 2030–2031 timeframe.
Whether those deadlines ultimately prove achievable is almost beside the point. The existence of deadlines changes organizational behavior. Progress will be made.
Projects receive funding.
Inventories get completed.
Vendors receive requirements.
Procurement teams begin asking difficult questions.
Crypto Agility Becomes a Survival Skill
One of the less glamorous lessons from the PQC transition is that replacing cryptography is difficult.
Many organizations do not know:
- Which applications use cryptography
- Which certificates are deployed
- Which libraries perform encryption
- Which vendors embed cryptographic functions
The organizations best positioned for the PQC transition are not necessarily those with the strongest cryptography teams. It is the organizations with the strongest crypto agility (not my term, there are earlier references to it).
Crypto agility refers to the ability to replace cryptographic algorithms quickly and safely when standards, threats, or requirements change.
The coming migration will likely become the largest cryptographic upgrade in internet history.
Critical Infrastructure in Scope
The Executive Order is not limited to Federal agencies.
It explicitly recognizes the importance of helping critical infrastructure sectors transition as well.
This includes industries such as:
- Energy
- Healthcare
- Telecommunications
- Transportation
- Financial services
Many of these environments contain systems with life cycles measured in decades rather than years.
Waiting until a cryptographically relevant quantum computer exists would be far too late.
What Organizations Should Do Now
Even organizations outside the Federal government can take practical steps immediately:
- Build a cryptographic inventory.
- Identify uses of RSA and ECC (hint, start with TLS uses).
- Evaluate vendor PQC roadmaps.
- Develop crypto-agility capabilities.
- Test hybrid cryptographic deployments.
- Track NIST PQC standards and implementation guidance.
- Prioritize systems containing long-lived sensitive data.
The most difficult part of a PQC migration is often discovering where cryptography is being used in the first place.
Summary
The June 2026 Executive Order marks an important shift in the post-quantum story. For years, quantum-safe cryptography was viewed as a future requirement. The U.S. government is now treating it as a present-day modernization effort.
No one knows exactly when a cryptographically relevant quantum computer will arrive. What is clear is that the migration effort itself will take many years.
The organizations that succeed will not be those that correctly predict “Q-Day” (the day a practical quantum computer is implemented that can render RSA & ECC ineffective with Shor’s Algorithm). They will be the organizations that start preparing before it arrives.
Notes
- AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
- ChatGPT was used to generate the images.
- I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
- Names have been changed to protect the guilty.
- None of the hostnames or users used in examples actually exist.
- Feel free to post any comments or suggestions below.
Originally published on Medium.