October 2026 marks the first substantive compliance checkpoint under Executive Order 14412, signed in June 2026. Federal agencies are now required to submit post-quantum cryptography migration plans to OMB and the Office of the National Cyber Director — the point at which the order's long-dated 2030 and 2031 deadlines start translating into near-term action, including evaluation of contractor and vendor readiness.
Key dates
- October 2026 — agencies submit PQC migration plans; vendor and contractor readiness evaluation begins
- December 2026 — FAR Council proposed rule embedding PQC requirements into federal contracts
- January 2027 — new National Security System acquisitions must comply with NSA CNSA 2.0
- December 31, 2030 — high-impact systems and covered contractors complete the encryption transition
- December 31, 2031 — high-impact systems complete the digital-signature transition
Crypto-agility, not just new algorithms
NIST finalized ML-KEM, ML-DSA and SLH-DSA in August 2024, so the algorithms are not the open question. The harder problem is that most enterprise systems hard-code cryptography into applications, firmware, certificate authorities and HSMs. An organization that adopts the new algorithms but leaves them hard-coded will hit the same wall at the next transition.
What the paper covers
The full briefing sets out the EO 14412 and OMB M-26-15 timeline, how it reaches the defense industrial base, technology vendors and regulated industries, the case for crypto-agility, and five steps organizations should take now. Download the PDF for the complete analysis and references.