Skip to content
ADVISEDLY.AIBook a demo

EO 14412 and the DIB: Planning for Post-Quantum Cryptography

8Advisedly Research
post-quantum cryptographyEO 14412FIPS 203CNSA 2.0DIB

EO 14412 and the DIB: Planning for Post-Quantum Cryptography

Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, was signed June 22, 2026 and published in the Federal Register on June 25, 2026. It directs federal agencies toward post-quantum cryptography (PQC), including use of NIST FIPS 203, 204, and 205.

The order applies to federal agencies. Contractor obligations are expected through a future FAR rule; the rule is proposed, not final. This article summarizes the order's stated milestones and does not provide legal advice.

Agency milestones

Section 4(a) calls for agencies to name a PQC migration lead within 30 days of signing. Section 4(b) directs OMB to issue guidance on inventorying high-value assets and high-impact systems, excluding national security systems. It sets federal milestones for PQC key establishment by December 31, 2030 and digital signatures by December 31, 2031.

Section 4(c) calls for a NIST pilot. Section 5(d) calls for CISA guidance on minimum cryptographic bill of materials (CBOM) elements. These are agency actions and guidance milestones; they should not be described as a finalized contractor mandate.

Contractor pathway

Section 6(c) calls for the FAR Council to propose a rule by December 19, 2026, with contractor compliance by December 31, 2030 if adopted. The proposed rule is not final. The order does not itself establish a current FAR clause for contractors.

For organizations that support federal work, it can be useful to understand where cryptography is used and to plan how systems could transition to the NIST PQC standards. Applicable contractual requirements depend on the terms that govern each organization and any future final rule.

NIST PQC standards

  • FIPS 203 (ML-KEM) defines a key-encapsulation mechanism.
  • FIPS 204 (ML-DSA) defines a digital-signature algorithm.
  • FIPS 205 (SLH-DSA) defines a stateless hash-based digital-signature algorithm.

EO 14412 identifies these standards in its federal migration direction. Organizations can track their own cryptographic assets and migration plans; a recorded inventory is not an automatic scan of an environment.

What Advisedly tracks

Advisedly provides a PQC readiness planner for recording cryptographic assets, CBOM documents, and migration plans against FIPS 203, 204, and 205. The planner supports customer-managed readiness tracking. It does not itself migrate algorithms or determine an organization's legal obligations.

For current federal actions, review the order and subsequent agency guidance. For contractor requirements, check for a final FAR rule and the terms of applicable contracts.