ExecutiveOrdersEO
EO 14412Executive OrderTrump 47 · R Quiet signal

Executive Order 14412

Securing the Nation Against Advanced Cryptographic Attacks

This executive order mandates a government-wide transition to post-quantum cryptography (PQC) to protect against future quantum computing threats. It sets specific deadlines for federal agencies to migrate high-value assets and high-impact systems to PQC standards, requires new procurement rules for contractors, and establishes coordination roles across OMB, NIST, CISA, and NSA.

Federal Register Open PDF 91 FR 38483

Impact dates

  1. In 31d

    OMB issues guidance on agency HVA/high-impact system inventory and transition plans

  2. NSA submits first annual National Security Systems PQC migration report

  3. NIST revises Cryptographic Module Validation Program processes

  4. FAR Council proposes rule on contractor PQC compliance by Dec 31, 2030

  5. CISA releases public guidance on cryptographic bill of materials minimum elements

  6. FAR Council proposes rule on contractor vulnerability disclosure programs for cryptographic vulnerabilities

  7. NIST PQC migration pilot project completion

  8. HVAs and high-impact systems transition to PQC for key establishment

  9. HVAs and high-impact systems transition to PQC for digital signatures

  10. 29d ago

    Agency heads identify PQC migration lead

Market exposure

Policy exposure mapping — not investment advice. Illustrative public companies are incomplete and not recommendations.

Sectors

Technology & softwareDefense primesBanking & financeOil & gasOther industrial

Mechanisms

ProcurementLicensingSubsidy / incentive

Role pressure

  • ProtectiveDomestic producer — NIST-standardized PQC algorithms and accelerated CMVP validation create preference for US-developed cryptographic modules and compliance services
  • AdverseImporter — Non-FIPS-approved algorithms barred from federal procurement; foreign cryptographic products must seek NIST validation to compete for federal contracts
  • MixedDownstream manufacturer — Federal contractors must comply with PQC standards by 2030, creating transition costs but also potential competitive advantage for early adopters
  • ProtectiveEquipment supplier — Shared procurement, centralized technical support, and cloud migration incentives favor established vendors with scale to meet federal PQC requirements

Geographies

USCNEUUKJPKRTW

Exposure dates

  • — FAR Council proposes rule on contractor PQC compliance by Dec 31, 2030
  • — FAR Council proposes rule on contractor vulnerability disclosure programs for cryptographic vulnerabilities
  • — NIST PQC migration pilot project completion
  • — HVAs and high-impact systems transition to PQC for key establishment
  • — HVAs and high-impact systems transition to PQC for digital signatures

Illustrative public companies

Curated watchlist matches by sector/role — incomplete; not a recommendation.

MMM3MGOOGLAlphabetAAPLAppleBACBank of AmericaBLKBlackRockBABoeingCATCaterpillarLNGCheniere EnergyCVXChevronCOPConocoPhillipsXOMExxon MobilFCXFreeport-McMoRanGEVGE VernovaGDGeneral DynamicsGSGoldman SachsHONHoneywellHSBCHSBCQQQInvesco QQQ TrustJPMJPMorgan ChaseLMTLockheed MartinMETAMeta PlatformsMSFTMicrosoftNOCNorthrop GrummanNVDANVIDIA

Confidence: high · Policy alerts

Key directives

  • Each agency head shall identify PQC migration lead within 30 days and report to OMB and National Cyber Director
  • OMB shall issue guidance within 90 days requiring agency inventory review of HVAs/high-impact systems and transition plans
  • All HVAs and high-impact systems (excluding NSS) must use PQC for key establishment by December 31, 2030
  • All HVAs and high-impact systems (excluding NSS) must use PQC for digital signatures by December 31, 2031
  • NIST shall initiate PQC migration pilot to be completed by December 31, 2027
  • NSA shall submit annual PQC migration status reports for National Security Systems starting within 180 days
  • CISA shall release public guidance on cryptographic bill of materials minimum elements within 270 days
  • FAR Council shall propose rule requiring covered contractor PQC compliance by December 31, 2030 within 180 days
  • FAR Council shall propose rule on contractor vulnerability disclosure programs for cryptographic vulnerabilities within 270 days
  • Sector Risk Management Agencies shall assist critical infrastructure owners with PQC migration plans
  • Secretary of State shall engage foreign governments and industry groups on NIST-standardized PQC transition

Who is ordered

Timeline

Immediate

  • Agency heads must identify PQC migration leads within 30 days

Near term (90d)

  • OMB to issue agency guidance on HVA/high-impact system inventory and transition plans
  • FAR Council to propose rule on contractor PQC compliance by Dec 31, 2030
  • NIST to begin pilot project for PQC migration
  • NSA to submit first annual National Security Systems PQC migration report
  • NIST to revise Cryptographic Module Validation Program processes
  • CISA to release public guidance on cryptographic bill of materials minimum elements
  • FAR Council to propose rule on contractor vulnerability disclosure programs incorporating cryptographic vulnerabilities

Long term

  • All HVAs and high-impact systems must transition to PQC for key establishment by December 31, 2030
  • All HVAs and high-impact systems must transition to PQC for digital signatures by December 31, 2031
  • NIST pilot project to be completed by December 31, 2027
  • Annual NSA reports on National Security Systems PQC migration until complete

Risks & tensions

  • Aggressive 2030/2031 deadlines may strain agency budgets and technical capacity, with Sec. 7(b) noting implementation is 'subject to availability of appropriations'
  • Critical infrastructure assistance is voluntary/cooperative, not mandated, creating potential gaps in private-sector preparedness
  • Contractor compliance deadline (Dec 31, 2030) predates some agency digital signature requirements (Dec 31, 2031), potentially creating interoperability issues
  • Annual NSA reporting requirement lacks termination trigger definition for 'until PQC migration is complete'
Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks · Executive Orders