"Harvest now, decrypt later," the executive order warns — and it sets a concrete clock for federal agencies to replace the cryptography that protects high-value assets.
Hard deadlines: December 31, 2030 and December 31, 2031
President Trump signed an executive order on June 22 that requires federal agencies to migrate certain systems to post-quantum cryptography (PQC) by two firm dates. Key establishment must move by December 31, 2030; digital signatures must move by December 31, 2031. The order — EO 14409 — leaves national security systems on a separate track.
The order compresses the government’s previous timeline. According to the text, it pulls the federal PQC schedule forward by four to five years from the government-wide target set in the 2022 National Security Memorandum 10, which ran to 2035.
NIST standards are ready; the order converts standards into schedule
The dates line up with standards NIST finalized in August 2024. For key establishment, the required standard is FIPS 203, using the ML-KEM algorithm — the algorithm formerly called CRYSTALS-Kyber. For digital signatures, the applicable standards are FIPS 204 and FIPS 205, using ML-DSA and SLH-DSA. The order notes those standards have been ready for almost two years; the executive action is what turns them into a schedule with consequences.
Immediate agency tasks and staged deadlines
- Within 30 days: each agency head must appoint a PQC migration lead who reports to the agency CIO and "owns" the cryptographic inventory and migration plan.
- Within 90 days: the Office of Management and Budget (OMB) must issue guidance requiring agencies to review inventories of high-value assets and high-impact systems, to plan the migration, and to submit that plan.
- NIST will run a pilot migration on a subset of its own systems, to be completed by December 31, 2027.
- Within 270 days: CISA and NIST must publish the minimum elements for a cryptographic bill of materials — a machine-readable list of the cryptographic assets in a piece of hardware or software.
Federal contracting: FAR Council rules and vulnerability disclosure
The order reaches beyond agency networks into procurement. The Federal Acquisition Regulatory Council has 180 days to propose a rule that would require "covered contractors" to meet NIST’s FIPS — including the PQC algorithms — by December 31, 2030. A second proposed rule, due in 270 days, would fold cryptographic flaws into contractor vulnerability disclosure programs; the order specifies that this includes tests for missing encryption and for non-FIPS algorithms.
What this means for technologists, procurement leaders, and critical infrastructure operators
- Technologists and security teams: the practical gating task is inventory. Teams must find every place key exchange and signatures occur, flag what is not NIST PQC, and sequence swaps against the 2030 and 2031 deadlines. The order makes the cryptographic bill of materials a priority because you cannot swap algorithms at scale if you do not know where they are.
- Procurement leaders and contractors: anticipate a FAR clause and a 2030 compliance line once the proposed rule arrives. The standards exist; the deadlines now exist; the immediate work for procurement is to align contracts and supply chains to the NIST FIPS requirements.
- Critical infrastructure operators: Sector Risk Management Agencies and CISA are directed to help build migration plans, but that assistance is not a mandate. Operators will receive help — not a federal requirement — in creating their own transition roadmaps.
The executive order is paired with a companion order, titled "Ushering in the Next Frontier of Quantum Innovation," which the administration says pushes the other side of the ledger: building quantum machines that make the migration urgent. But the "teeth" of the deadlines remain to be written. The OMB’s 90-day guidance and the FAR Council’s proposed rules will decide whether December 31, 2030 and December 31, 2031 become procurement-enforced deadlines or another federal target that slips as migration work begins.
For now, the standards have been waiting since August 2024; the government has set a countdown clock. The unanswered, immediate question in the text is procedural: will inventory and procurement rulemaking be rapid enough to meet the dates the order imposes?
Source: The Hacker News — Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration
