What Actually Binds You in the US Post-Quantum Rulebook

Nine data items per system. That was the ask in OMB Memorandum M-23-02, the November 2022 memorandum that told federal civilian agencies to inventory their quantum-vulnerable cryptography: FISMA system identifier, FIPS 199 categorization, high value asset identifier, every vulnerable algorithm in active use with its key length, software package and vendor, operating system, hosting arrangement, lifecycle characteristics, and notes. When CISA published its strategy for automated cryptographic discovery in September 2024, it reported that tooling could collect three of the nine. The other six were somebody’s spreadsheet.

Every cohort we teach on regulatory readiness arrives with a version of the same question, and it is almost never what the deadline is but which of these documents an auditor can hold them to, and what the auditor will want to see. The United States moved first on post-quantum cryptography (PQC) policy, meaning cryptography designed to resist attack by a quantum computer, and it has been layering instruments on top of each other ever since. Statutes, national security memoranda, executive orders, OMB memoranda, federal standards, agency acquisition rules and supervisory guidance all now say something about the same migration. They do not bind the same organizations, they do not survive the same events, and they do not ask for the same evidence.

This guide sorts them by durability and by evidence, then runs three organizations through the sort.

Six kinds of instrument, six kinds of evidence

Before the dates, the taxonomy. A compliance register that lists an executive order and a federal statute in the same column will mislead whoever inherits it, because one of them can change on a Tuesday and the other cannot.

Instrument	Example	What changes it	What evidence it asks for
Federal statute	Quantum Computing Cybersecurity Preparedness Act, Public Law 117-260	An act of Congress	Existence of an inventory and a migration plan, reporting to Congress
Presidential directive	NSM-10, Executive Order 14144 as amended	A signature	Dated agency plans and designations
OMB memorandum	M-23-02 and its successor	A new memorandum	Submitted inventories, named leads, funding assessments
Federal standard	FIPS 203, 204 and 205	A revision cycle, and draft status until then	Validated module certificates, algorithm parameter sets
Acquisition rule or contract clause	USDA AGAR, CNSA 2.0 through product validation	A rulemaking or a renegotiated contract	Solicitation text, product validation records, flow-down clauses
Supervisory guidance and standard of care	OCC and FINRA material, FDA premarket guidance, insurer questionnaires	Nothing formal; it moves as practice moves	Board minutes, inventory, a dated roadmap

The bottom row is the one GRC teams underrate. It carries no deadline and no citation, and it is the row most likely to be quoted back at a private-sector organization after an incident.

The statutes, which outlast everything else

Three enacted laws sit underneath the whole US framework, and none of them can be undone by executive action.

The Quantum Computing Cybersecurity Preparedness Act, Public Law 117-260, was signed on December 21, 2022. It required OMB to issue guidance directing each federal agency to maintain a prioritized inventory of systems vulnerable to quantum decryption, and it required a second round of OMB guidance on migration prioritization within one year of NIST issuing PQC standards. Those standards landed on August 13, 2024, which set the second deadline around August 2025. The Act also requires annual reporting to Congress on migration progress for five years after the standards were published, so reports run through at least 2029. National security systems are carved out and governed separately.

The National Quantum Initiative Act, Public Law 115-368, signed December 21, 2018, created the coordination machinery rather than any migration duty. Its authorization lapsed in September 2023 and reauthorization hasn’t cleared the Senate. The CHIPS and Science Act, Public Law 117-167, funds quantum research and contains no migration mandate at all.

One rule for the register: pending legislation is not an obligation. Several PQC bills have been introduced in the current Congress, and amendments to defense authorization have proposed forcing at least one high-impact system per agency into production PQC. Track them as forecast, never as requirement, and revisit at each review.

Directives, which get line-edited rather than repealed

National Security Memorandum 10, signed May 4, 2022, is where the 2035 migration target comes from. It directed agencies to produce annual inventories of quantum-vulnerable systems and to develop transition plans, and it tasked NSA with guidance for national security systems. It hasn’t been rescinded, and later executive action has referenced it as the foundation document.

Executive Order 14144, signed January 16, 2025, carried the most prescriptive PQC provisions any directive has contained. Executive Order 14306, signed June 6, 2025, amended it rather than revoking it. Three things survived: CISA’s obligation to publish a list of product categories where PQC-capable products exist, a requirement to support TLS 1.3 or a successor protocol by January 2, 2030, and the recognition of the threat from a cryptographically relevant quantum computer. Three things were removed: the trigger that would have required agencies to write PQC into solicitations within 90 days of a category being listed, the instruction to adopt PQC or hybrid key establishment as soon as practicable, and the mandate to promote NIST algorithms internationally. The Congressional Research Service described the method as line edits to text the administration disagreed with, which is a better description of the resulting document than “rollback.”

The June 2026 reset

PostQuantum.com’s June 2026 update to its US framework analysis reports that a new executive order set hard 2030 and 2031 migration dates for federal high value assets, meaning the systems an agency has formally designated as most critical, and for high-impact systems generally; that a successor OMB memorandum replaced M-23-02 with a five-phase civilian timeline running to 2035; and that the Department of Defense issued a department-wide PQC strategy on the same 2030 and 2031 dates. Read the operative text before you rely on any date in this section. The taxonomy holds, and so do the statutes underneath it. The middle two rows moved inside eighteen months.

Memoranda and the evidence they demand

M-23-02 is the document that turned policy into paperwork. It required each agency to designate a cryptographic inventory and migration lead within 30 days, to submit a prioritized inventory of quantum-vulnerable systems annually, and to follow each submission within 30 days with a funding assessment for the next fiscal year’s migration work. It named the algorithms that have to go eventually: RSA, ECDSA, ECDH, DSA, Diffie-Hellman and MQV, which between them cover essentially every asymmetric algorithm in production today. OMB’s July 2024 report to Congress on post-quantum cryptography migration, submitted under the Preparedness Act, put the cost at roughly 7.1 billion USD in 2024 dollars across 2025 to 2035.

The Department of Defense CIO memorandum of November 20, 2025 shows what the memorandum layer looks like when an agency means it. It directed components to inventory cryptography across every system type, including weapons systems, cloud services, mobile devices, unmanned systems and operational technology; it gave them 20 days to name PQC migration leads; and it prohibited components from testing, procuring or using quantum key distribution or quantum random number generation for security functions without an exception. That last clause is a useful reminder that a PQC mandate and a quantum-hardware mandate are different things, and that some agencies have decided against the hardware.

If you supply any of these agencies, the memorandum layer reaches you through the inventory. Agencies cannot complete nine data items per system without asking vendors for algorithm, key length, package version and hosting detail. Prepare that answer once, in a form you can reissue.

Standards, and the difference between final and draft

NIST published three final standards on August 13, 2024. FIPS 203 standardizes ML-KEM, a key encapsulation mechanism, which is the algorithm two parties use to agree a shared secret over an untrusted channel. FIPS 204 standardizes ML-DSA, the primary digital signature algorithm. FIPS 205 standardizes SLH-DSA, a hash-based signature scheme kept as a mathematically different backup in case lattice-based schemes are ever broken. FN-DSA, the compact-signature scheme derived from FALCON, is still working through clearance as FIPS 206. HQC was selected in March 2025 as a code-based alternative to ML-KEM, with a draft expected later. Neither is a reason to wait; ML-KEM and ML-DSA are the deployable pair.

The deprecation dates most people quote come from NIST IR 8547, which proposes deprecating quantum-vulnerable algorithms at or below 112-bit security after 2030 and disallowing all quantum-vulnerable public-key algorithms after 2035. It’s still a draft. Treat those dates as a planning assumption and as NIST’s stated technical judgment, and do not cite them to a board as binding.

Three supporting publications earn a place in a GRC library. SP 800-227, finalized September 2025, covers operational use of key encapsulation mechanisms including hybrid deployment. CSWP 39, finalized December 2025, defines crypto-agility and gives it a maturity model. CSWP 48 maps the NCCoE migration capabilities onto the Cybersecurity Framework 2.0 and SP 800-53 Rev. 5, which is the single most useful artifact we have found for expressing PQC work as auditable control outcomes rather than as an engineering project with no home in the register.

One operational number from the NCCoE work belongs in capacity planning rather than in the risk register. In NIST’s testing, documented in SP 1800-38 Volume C, hybrid deployments running a classical and a post-quantum algorithm together roughly halved handshake throughput. Raw ML-KEM performed comparably to classical key exchange. Hybrid is the transitional default in most guidance, and it isn’t free.

The validation queue that belongs in the budget cycle

Now, this one matters for procurement timing rather than for policy: FIPS 140-3 validation. The Cryptographic Module Validation Program is scheduled to move all remaining FIPS 140-2 validated certificates to the Historical list on September 21, 2026. After that, only FIPS 140-3 validated modules are acceptable for new federal procurement. PQC implementations have to travel the same route to be usable in federal systems, and the validation queue is long enough that a vendor not already in it should not be assumed to emerge before 2027. Plan for a period where the policy says migrate and the validated product list is thin.

Procurement, now distributed agency by agency

The removal of the government-wide solicitation trigger didn’t remove procurement pressure. It moved the pressure down a level, which for suppliers is harder to track rather than easier.

CISA published its PQC product categories list on January 23, 2026, sorting categories into products where PQC-capable options are widely available, such as cloud services, browsers and endpoint security, and products where the capability is still maturing, such as networking hardware, storage area networks, identity and access management, and container platforms. The list is advisory. It is also a public federal statement about which categories have no excuse left, which is a different kind of force.

Individual agencies can restore the mandate inside their own rules, and at least one has. The USDA Acquisition Regulation, revised in September 2025, instructs that for products in the CISA-listed categories, the solicitation must require PQC support. That is rule text in a specific agency’s acquisition regulation, not guidance. Expect the pattern to spread unevenly, and build your bid library so that a PQC support statement is a standing attachment rather than a scramble.

Two federal programs haven’t caught up yet. CMMC, the Cybersecurity Maturity Model Certification program for defense contractors, rests on NIST SP 800-171 Rev. 2, which specifies classical cryptographic requirements. FedRAMP is waiting on updates to SP 800-53 and on validated modules. PQC requirements will arrive in both when their underlying documents are revised, and neither revision has a firm public date.

National Security Systems run on their own schedule

CNSA 2.0, the Commercial National Security Algorithm Suite published by NSA in September 2022 and updated in December 2024, applies to National Security Systems, meaning systems handling classified information or otherwise critical to military and intelligence missions, and to the vendors who supply them. It specifies AES-256, ML-KEM-1024, ML-DSA-87 and SHA-384 or SHA-512, with LMS and XMSS additionally approved for software and firmware signing. SLH-DSA is not approved for this suite.

The dates are the hardest in the US framework. Software and firmware signing and traditional networking equipment are to use CNSA 2.0 exclusively by 2030; browsers, servers, cloud services and operating systems by 2033. Under Committee on National Security Systems Policy 15 (CNSSP-15) as updated in 2024, new NSS acquisitions are to be CNSA 2.0 compliant from January 1, 2027, equipment that cannot support the suite is to be phased out by the end of 2030, and the suite is mandated across NSS by the end of 2031. Validation runs through NIAP, the National Information Assurance Partnership, against protection profiles that incorporate the suite. FIPS validation alone doesn’t satisfy it.

Standard of care, and why the private sector should read the federal file anyway

No US sector carries a binding PQC mandate for private-sector entities. The pressure arrives through three other routes.

Supervisory expectation. The OCC raised quantum risk in its Fall 2022 semiannual risk perspective. The Federal Reserve named quantum computing as a significant emerging risk area in its July 2025 resilience report. FINRA published an implications report for the securities industry in 2023 while stating plainly that it created no new requirements. The G7 Cyber Expert Group issued a financial-sector roadmap in January 2026 targeting critical systems in the early 2030s and full transition by 2035. NERC’s 2026 CIP roadmap lists quantum as an emerging security risk with no CIP requirement attached. None of this is enforceable. All of it is quotable in an examination.

Disclosure. SEC cybersecurity disclosure rules do not mention PQC and require companies to describe how they assess material cybersecurity risk. Whether quantum exposure is material is a judgment your disclosure counsel makes, not a question the rules answer.

Reasonable safeguards. HIPAA’s security standard is technology-neutral and evolves with practice. Once a federal agency has published that PQC-capable products are widely available in a given category, an organization breached while running deprecated algorithms in that same category has a harder argument about prevailing practice. That is the mechanism worth putting in front of a board, because it is the one that operates without any regulator taking action.

There is a fourth route that arrives faster than any of these. Ask your broker what the cyber renewal questionnaire asks this year about cryptographic inventory, and put the answer in the file before the renewal call.

Three organizations, three different obligation sets

A 400-person avionics subcontractor. The binding instrument is the contract, not the executive order. CNSA 2.0 reaches this company through NIAP-validated products and flow-down clauses, with new NSS acquisitions expected to be compliant from January 2027, and the Defense Federal Acquisition Regulation Supplement (DFARS) and CMMC obligations sit alongside. Evidence to hold: a component-level cryptographic inventory, validation status for every module shipped, a supplier questionnaire covering the same ground one tier down, and a dated statement of when each product line reaches CNSA 2.0. The prohibition on quantum key distribution in defense environments matters here too, because a supplier pitching it as a differentiator is pitching something a customer has been told not to buy without an exception.

A SaaS vendor selling only to civilian agencies. No NSS exposure, no CNSA 2.0. The concrete obligations arrive through the customer: TLS 1.3 support by January 2, 2030 across federal systems, agency inventory requests carrying the nine data items, and PQC clauses appearing in individual acquisition regulations. The category placement on the CISA list decides how much benefit of the doubt this vendor gets. If cloud services are listed as widely available and this vendor is not, no rule has been broken and the sales conversation gets harder anyway. Evidence to hold: a standing PQC support statement, current algorithm and key length per service, and a FedRAMP-facing plan for validated modules.

A regional hospital network with no federal contracts. Nothing here is mandatory. The exposure is harvest-now, decrypt-later, meaning the practice of capturing encrypted traffic today to decrypt it once a quantum computer can break the key exchange, and patient records have a confidentiality life measured in decades. Medical devices bring a second path, because FDA premarket cybersecurity expectations will carry PQC forward through validated modules and cryptographic bills of materials. Evidence to hold: an inventory, a dated roadmap approved at board level, a data-retention analysis identifying which records outlive their current protection, and vendor commitments from the device manufacturers. None of it is filed with anyone. All of it is what a plaintiff’s expert will ask for.

Two gaps that survive a clean compliance report

The signature gap. Vendor support for ML-KEM has outrun vendor support for ML-DSA, and marketing language hasn’t kept up with the difference. A product can be genuinely quantum-resistant for key establishment and entirely classical for authentication, which protects the payload and leaves signature forgery on the table. When a supplier says quantum safe, ask which FIPS numbers, for which functions, in which product version. Put the answer in the file rather than the claim.

Draft status treated as final. The 2030 deprecation date isn’t yet a rule. Several teams we work with have written it into policy as though it were, which is fine as a planning stance and awkward when someone asks for the citation. Record it as a NIST draft with a review trigger attached, so the register updates itself when the final version lands.

Name an owner, set a review date

Every instrument in your register needs a named individual who owns it, a source URL, a version date, and a next review date. Not a team, not a function. A person, because a function doesn’t notice when a memorandum is superseded.

We recommend a quarterly review as the baseline, with four events that pull the review forward regardless of the calendar: a new or amended executive order touching cryptography, a new or superseded OMB memorandum, publication or finalization of a NIST document already in your register, and any change to an acquisition regulation at an agency you sell to. Add a fifth if you operate internationally, since EU and UK timelines run ahead of US civilian ones in places and can create the earlier obligation.

For each entry, record two separate things: what the instrument requires, and what evidence you would produce tomorrow if asked. Those diverge more often than teams expect, and the second column is the one an auditor works from.

This article carries its own version date for the same reason. The taxonomy is stable. The dates in the middle rows are not, and the June 2026 changes to the executive and memorandum layers happened while the previous analysis was still the most-cited version in circulation.

Building the skill inside the team

Sorting instruments by durability, reading a draft standard as a draft, and translating an inventory requirement into an evidence file are all learnable, and they are the difference between a compliance register that ages well and one that gets rebuilt every time an administration changes.

Quantum Academy’s certification programs cover PQC governance and migration planning for exactly this reader: the compliance, risk and audit professionals who own the register rather than the code. Program details, syllabi and current pricing in USD are at quantumacademy.com/. For migration methodology in more depth, the PQC Framework sets out the phased approach these regulatory instruments assume you are already following, and PostQuantum.com tracks the instrument-level changes as they happen.