CNSA 2.0 And National Security Systems: What Suppliers Need To Know

If you sell technology to the US government, you will hear two sets of post-quantum requirements mentioned in the same breath. One comes from the National Security Agency (NSA) and its Commercial National Security Algorithm Suite 2.0, known as CNSA 2.0. The other comes from the White House, the Office of Management and Budget (OMB), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST). They apply to different systems, and confusing them leads to wrong assumptions about dates.

This article explains how the two tracks divide, what is known about each as of October 2026, and how federal post-quantum policy is starting to reach contractors directly. It is written for vendors and suppliers rather than agencies.

Two Tracks: National Security Systems And Everything Else

US law treats national security systems as a separate category. The term is defined in federal statute (44 U.S.C. 3552(b)(6)), and Executive Order 14412 uses that definition.¹ NSA describes these as networks that hold classified information or are otherwise critical to military and intelligence work, and your customer will know whether a system falls into the category. The Director of NSA is the National Manager for these systems and issues the guidance that governs their cryptography.²

Almost every civilian post-quantum instrument carves these systems out. The Quantum Computing Cybersecurity Preparedness Act states that it does not apply to any national security system.³ OMB’s 2022 inventory memo excluded them,⁴ and OMB’s June 2026 migration memo says it does not apply to them either.⁵ Executive Order 14412 directs OMB to require its 2030 and 2031 migration dates for federal high-value assets and high-impact systems, and the inventory review in its section 4(b)(i) expressly excludes national security systems.¹

The result is two parallel tracks:

• Civilian federal systems follow OMB and CISA guidance, with NIST standards and the dates in Executive Order 14412 and OMB M-26-15.
• National security systems follow NSA requirements, including CNSA 2.0.

What CNSA 2.0 Is

CNSA 2.0 is NSA’s suite of algorithms for protecting national security systems against both classical and quantum attacks. NSA announced it on 7 September 2022 with a cybersecurity advisory and a frequently asked questions (FAQ) document, and based its choices on the algorithms NIST had selected for standardisation.² The FAQ has since been updated: the version linked from NSA’s announcement in October 2026 is version 2.1, dated December 2024.⁶

The 2022 advisory set expectations by product type, using two stages: products should first support and prefer CNSA 2.0 algorithms, then use them exclusively. Software and firmware signing, for example, was to support and prefer CNSA 2.0 by 2025 and use it exclusively by 2030, while traditional networking equipment such as virtual private networks and routers had 2026 and 2030. The advisory also said NSA expects the transition for national security systems to be complete by 2035.⁷

The acquisition rules are firmer. NSA’s FAQ, citing the national security systems policy CNSSP 15, says that from 1 January 2027 new acquisitions for these systems must be CNSA 2.0 compliant unless otherwise noted, that equipment unable to support CNSA 2.0 must be phased out by 31 December 2030, and that CNSA 2.0 algorithms are mandated from 31 December 2031.⁶ NSA repeated the 2027 and 2030 points in an announcement on 1 October 2026.⁸ Suppliers should take dates for their own product type from NSA’s current documents, because procurement teams will hold them to NSA’s text.

Executive orders add some cross-cutting duties that also cover national security systems. Executive Order 14306 required NSA to set requirements for agencies running national security systems to support TLS 1.3 or a successor no later than 2 January 2030, matching OMB’s requirement for other federal systems.⁹ Executive Order 14412 requires NSA to report to the President within 180 days, and every year after, on the status of post-quantum migration across agencies that own or operate national security systems.¹

How Federal Rules Reach Contractors

Beyond national security systems, 2026 also brought changes on the civilian side. Three of the procurement measures in Executive Order 14412 matter most to suppliers.¹

First, the Federal Acquisition Regulatory Council must publish, within 180 days of 22 June 2026, a proposed amendment to the Federal Acquisition Regulation (FAR), the rulebook for federal purchasing, requiring covered contractors to comply with NIST’s Federal Information Processing Standards, including those for post-quantum algorithms, by 31 December 2030. Second, within 270 days, the Council must propose rules requiring contractor vulnerability disclosure programmes that accept reports of cryptographic weaknesses, including missing encryption and non-approved algorithms. Third, NIST must revise the Cryptographic Module Validation Program to speed up the validation of cryptographic modules.

OMB M-26-15 adds a buying signal. Agencies are told to use CISA’s list of product categories that support post-quantum standards and to require post-quantum support when they buy products in those categories.⁵ CISA’s list, published in January 2026, covers technologies such as cloud services, web software, networking hardware and software, and endpoint security.¹⁰

Which Track Applies To You

The flowchart below is a simple way to think about which set of requirements is most relevant to a product or service. The two tracks are not exclusive: a supplier to national security systems can also hold contracts that carry the federal acquisition clauses. It is a starting point for a conversation with your customers and counsel, not a legal determination.

Practical Steps For Suppliers

A few actions make sense whichever track applies.

• Know your own cryptography. Customers will ask which algorithms, protocols and libraries your products use. An internal inventory, and in time a cryptographic bill of materials, is the basis for every answer.
• Map products to CISA categories. If a product falls into a listed category, expect buyers to ask about post-quantum support now.
• Plan for TLS 1.3. The 2 January 2030 date applies across federal systems, and products that cannot support TLS 1.3 will be hard to sell into them.
• Read the primary texts. Summaries of CNSA 2.0 dates circulate widely and do not always match NSA’s current documents, which have been updated since 2022.