US Federal PQC Policy From NSM-10 To The June 2026 Executive Order

The United States has built its post-quantum policy one instrument at a time: a national security memorandum, a law, several executive orders and a series of memoranda from the Office of Management and Budget (OMB), the White House office that sets IT and security policy for federal agencies. Each one added something, and some changed what came before. Reading any one of them alone gives an incomplete picture.

This article puts the instruments in order, as of October 2026, and explains what each one requires and of whom. Most of these rules bind federal agencies, not private companies. They still matter to private firms, because they shape procurement, set expectations for suppliers and are widely copied.

The Chronology

Sources: NSM-10 as cited in M-23-02 and EO 14306,¹² the Act,³ EO 14306,² CISA,⁴ EO 14412⁵ and M-26-15.⁶

2022: Planning And Inventory

National Security Memorandum 10 set the direction. As quoted in later guidance, it gave the goal of mitigating as much quantum risk as is feasible by 2035.¹ OMB Memorandum M-23-02 turned that into a task. Agencies had to send a prioritised inventory of their cryptographic systems to the Office of the National Cyber Director and CISA by 4 May 2023, and annually after that until 2035 or until replaced by later guidance.¹

In December 2022, Congress passed the Quantum Computing Cybersecurity Preparedness Act. It requires agencies to maintain a current inventory of information technology that is vulnerable to decryption by quantum computers, and it requires OMB to issue migration guidance. The Act does not apply to national security systems.³

2025: A Reset

Executive Order 14144, signed on 16 January 2025, was a broad cybersecurity order that included post-quantum measures. Less than five months later, Executive Order 14306 amended it. Among other changes, it struck the post-quantum subsection and inserted new text in its place.²

The new text contains two concrete actions. CISA, in consultation with NSA, was to publish a list of product categories in which post-quantum products are widely available. And NSA, for national security systems, and OMB, for everything else, were to require agencies to support TLS 1.3 or a successor as soon as practicable and no later than 2 January 2030.² OMB describes version 1.3 as the foundation for deploying post-quantum key exchange on federal networks.⁶ CISA published the product categories list on 23 January 2026, after the 1 December 2025 date in the order.⁴

2026: Dated Migration

On 22 June 2026 the President signed Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”. It required OMB to issue guidance within 90 days directing agencies to move all high-value assets and high-impact systems, other than national security systems, to post-quantum key establishment by 31 December 2030 and to post-quantum digital signatures by 31 December 2031.⁵

The order also reaches beyond agencies. It asks CISA, with NIST, to publish guidance on the minimum elements of a cryptographic bill of materials (CBOM), a structured list of the cryptography inside a product, within 270 days. It directs the Federal Acquisition Regulatory Council to propose, within 180 days, a rule requiring covered contractors to comply with NIST’s cryptographic standards, including post-quantum algorithms, by 31 December 2030. And it asks the agencies responsible for each critical infrastructure sector to help owners and operators develop migration plans.⁵

OMB moved two days later. Memorandum M-26-15 tells agencies to run a prioritised migration aimed at mitigating as much quantum risk as feasible by 31 December 2030, and to submit a migration plan within 120 days of 24 June 2026.⁶ By our count, that falls on 22 October 2026; the memorandum itself gives only the number of days.

What M-26-15 Asks Agencies To Do

The memorandum describes migration as a multi-year programme in five phases.⁶

Two parts of the memorandum stand out for anyone outside government. Its appendix says manual discovery is often inadequate at this scale, and recommends a continuously updated inventory built with automated tools, including software composition analysis, code testing and network scanners for protocols and cipher suites, feeding a central CBOM.⁶ It also tells agencies to use the CISA product categories list and require post-quantum support when buying products in those categories.

Why It Matters Outside Government

Federal rules do not bind most private companies directly. They reach the private sector in three ways.

• Procurement. Agencies are told to require post-quantum support in listed product categories, and the proposed contractor rule would extend compliance duties to covered contractors.
• Shared tooling. The forthcoming CBOM guidance is meant to support automated assessment of the cryptography in hardware and software, which is likely to shape what customers ask vendors for.
• Critical infrastructure. The order asks sector agencies to help critical infrastructure owners plan their migrations.