Post-Quantum Requirements in the United States
Executive Order 14412, signed on June 22, 2026, put federal post-quantum migration on a schedule. OMB Memorandum M-26-15 asked agencies for migration plans by October 22, 2026. High-value assets and high-impact systems must move key establishment to post-quantum cryptography by December 31, 2030, and digital signatures in 2031. Agencies are to migrate their remaining systems by 2035.
CNSA 2.0 applies to national security systems, and new acquisitions must support its algorithms from January 1, 2027. The executive order also directs the FAR Council to propose a rule requiring federal contractors to comply with post-quantum standards by December 31, 2030. Supervisors, customers, insurers and auditors already ask banks, insurers, health systems and other US companies about their plans. In this course, we cover what each instrument requires, who it binds, and the evidence that shows your organization is on track.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and NIST IR 8547, the draft timeline for phasing out today’s public-key algorithms between 2030 and 2035. We also compare the US dates with those in Canada, the EU, the UK and Australia.
Module 2. US Requirements in Detail (60 minutes)
We work through Executive Order 14412 and OMB M-26-15. That covers the five migration phases, the agency plans, the 2030 and 2031 deadlines, and the TLS 1.3 requirement for January 2, 2030. We cover CNSA 2.0 for national security systems and the vendors that supply them. We explain CISA’s list of product categories that support post-quantum standards, and what it means for procurement. We cover the proposed FAR rule and how contractors will flow it down to subcontractors. Earlier instruments still apply, including NSM-10, the Quantum Computing Cybersecurity Preparedness Act and OMB M-23-02’s annual inventories. For financial firms, we cover the G7 Cyber Expert Group roadmap, which suggests upgrading the most important systems by 2030 to 2032.
Module 3. Demonstrating Compliance in the United States (30 minutes)
We cover what auditors and contracting officers will ask to see now and by 2030. That includes the migration plan, the cryptographic inventory and the CBOM elements CISA and NIST are due to define by March 2027. It also includes supplier commitments and evidence of crypto-agility. You map the work to NIST SP 800-53, the NIST Cybersecurity Framework, FedRAMP and CMMC assessments, and learn to report progress to your board.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
Compliance officers, GRC leads, CISOs, contracts and legal staff, and migration program managers at federal agencies, the companies that have federal contracts, and their suppliers. Also useful for US banks, insurers, health systems and technology companies, and for non-US suppliers to the US government.
What you’ll be able to do afterward
- Explain what Executive Order 14412, OMB M-26-15 and CNSA 2.0 require, and of whom
- Decide whether your organization is bound directly, through federal contracts, or by what customers and supervisors ask of it
- Map the 2027, 2030, 2031 and 2035 dates onto your own migration plan
- Prepare for the proposed FAR rule and the contract clauses that will follow it
- Assemble the evidence auditors and contracting officers ask for, starting with your inventory and plan
- Report regulatory exposure and progress to your board
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the US instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you operate in several countries, add PQC Compliance: Global Overview. Agencies and defense suppliers should continue with Quantum-Safe Government and Defense. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each US instrument as agencies issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
