The White House is circulating a draft executive order that would set firm deadlines for federal agencies and their contractors to migrate to post-quantum cryptography (PQC), according to reporting by Nextgov. The document is a draft and has not been signed, and its provisions could change or be dropped before any public release, which was reported to be expected during the week of May 20, 2026. As written, the reported order would require so-called covered contractors working with federal agencies to bring their systems into line with PQC standards by the end of the decade, a timeline that would reshape compliance planning for much of the government-contracting community.
What the Draft Order Would Require
The draft would establish two principal migration timelines. Agencies and covered contractors would be expected to transition their key establishment processes to post-quantum cryptography by December 31, 2030. Separately, agencies would migrate digital signatures for high-impact systems and high-value assets to quantum-resistant standards by December 31, 2031. The reported order would task the Office of Management and Budget with issuing guidance and deadlines for transitioning high-impact systems to encryption intended to withstand code-breaking by an eventual fully operational quantum computer.
National security systems would be excluded from the agency mandate described in the draft. That carve-out tracks with existing federal practice, in which national security systems follow a separate cryptographic-modernization track overseen by the National Security Agency rather than the civilian guidance OMB issues to agencies. The split matters for contractors that straddle both worlds, because work touching national security systems would continue under the NSA's separate requirements while the same firm's civilian-agency work would fall under the reported order's deadlines. Reading any signed order alongside existing national security system guidance would therefore be necessary to determine which set of obligations applies to a given contract or system.
Key Establishment and Digital Signatures
The two cryptographic functions named in the draft serve different purposes. Digital signatures authenticate user identity for secure access, verifying that a person or system attempting to connect is who it claims to be. Key establishment generates a cryptographic key for specific parties, producing the shared secret that allows two endpoints to encrypt and decrypt data between them. Both rely today on mathematical problems that a sufficiently powerful quantum computer could, in theory, solve far faster than classical machines, which is why the reported order would address them on staggered timelines.
The Threat Driving the Timeline
The reported push reflects concern over what cybersecurity specialists call "harvest now, decrypt later." Under that scenario, adversaries capture and store encrypted data today, betting that they will be able to decrypt it once quantum computers mature. Information with a long shelf life, such as classified records, intellectual property, and personal data, is considered especially exposed, because data exfiltrated now could remain sensitive years from now when decryption may become feasible. Setting deadlines well before large-scale quantum computers are expected to arrive is intended to shrink that window of exposure, since data already harvested cannot be protected retroactively once the underlying encryption is broken.
The draft would build on an earlier OMB draft memorandum from the summer of 2025 that addressed PQC migration, signaling continuity in the federal approach rather than a sudden reversal. It also follows years of standards-setting work. The National Institute of Standards and Technology approved 14 post-quantum cryptographic algorithms in October 2024, giving agencies and vendors a defined set of standards to build toward. On the national security side, the NSA issued quantum-resistant requirements for national security systems in 2022, targeting a 2035 transition for those systems.
What It Means for Contractors
For covered contractors, the reported order would convert what has been a forward-looking advisory into a dated compliance obligation. The headline figure for industry is the December 31, 2030 deadline to migrate key establishment to NIST post-quantum standards across systems used in support of federal agencies. PilieroMazza's May 28, 2026 government-contracting weekly update flagged the draft as setting rigid deadlines for quantum-resistant cryptography, underscoring that contractors would need to migrate to certain standards by 2030.
In practice, meeting a 2030 deadline would likely begin with a cryptographic inventory: identifying every place in a contractor's systems where vulnerable public-key cryptography is used, including key establishment and digital signatures embedded in applications, network protocols, identity systems, and third-party components. From there, contractors would map those uses to the NIST-approved PQC algorithms, prioritize high-value and long-lived data, and plan replacements or hybrid approaches that pair classical and post-quantum algorithms during the transition. Because cryptography is often buried deep in software dependencies and hardware, that inventory-and-migration work is widely regarded as multi-year, which is part of why the reported order would set the deadline several years out.
Contractors would also need to coordinate closely with the eventual NIST standards and any implementing guidance OMB issues, since the precise scope of "covered contractors," the systems in scope, and any reporting requirements would be defined through that guidance rather than the executive order text alone. Until the order is signed and accompanying guidance is published, the specific obligations remain provisional. Firms watching the space can reasonably begin inventory and planning work now, since cryptographic discovery is useful regardless of the final deadlines, while holding off on irreversible architectural decisions until the requirements are fixed.
What Remains Uncertain
Because the order is reported as a draft, several questions are unresolved. The release timing, the final deadline dates, the exact definition of covered contractors, and the treatment of high-impact systems versus high-value assets could all shift before signing, if the order is signed at all. Reporting on the broader quantum strategy effort has also noted that drafts in this area have varied in how directly they address post-quantum cryptography, which adds to the uncertainty about the final shape of any signed order. For now, the draft signals the administration's intended direction: dated, enforceable PQC deadlines for agencies and the contractors that serve them, anchored to NIST standards and motivated by the harvest-now-decrypt-later threat.
