Securing the Nation Against Advanced Cryptographic Attacks

This EO directs the transition of federal information systems to NIST-approved post-quantum cryptography standards, with the Director of OMB and the National Cyber Director coordinating the effort. Agency heads must designate PQC migration leads within 30 days, and OMB must issue guidance within 90 days requiring agencies to transition high value assets and high impact systems to PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. It also directs the FAR Council to publish proposed rules within 180 and 270 days requiring covered contractors to comply with NIST FIPS, including PQC-compliant algorithms, by December 31, 2030 and to implement vulnerability disclosure policies covering cryptographic vulnerabilities.

Covered federal contractors to Covered federal contractors must comply with NIST's FIPS, including all applicable FIPS incorporating PQC-compliant algorithms, under a proposed FAR rule to be published by the FAR Council (December 31, 2030). Covered federal contractors to Covered federal contractors must implement vulnerability disclosure policies consistent with NIST guidelines that incorporate reports of cryptographic vulnerabilities, including testing for lack of encryption and use of non-FIPS approved algorithms, under a proposed FAR rule to be published by the FAR Council (unclear).

No known legal challenges.