On June 22, President Trump signed Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks," setting the federal government's first binding executive deadlines for moving to post-quantum cryptography (PQC). For contractors, the consequential part is not the agency timeline — it is the two rulemakings the order puts on the calendar.

The order directs the FAR Council, in consultation with CISA and NIST, to publish a proposed rule within 180 days requiring "covered contractors" to comply by December 31, 2030, with NIST's Federal Information Processing Standards (FIPS), including the standards that incorporate post-quantum algorithms — ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for digital signatures. A second proposed rule, due within 270 days, would extend contractor vulnerability disclosure programs to cover cryptographic weaknesses, including testing for missing encryption and the use of non-FIPS-approved algorithms.

If you already hold or are pursuing CMMC, this isn't entirely new ground: CMMC Level 2 (NIST SP 800-171) already expects FIPS-validated cryptography to protect CUI. The new rule extends that expectation into a government-wide, deadline-bound requirement. 2026 Compliance Guide: CMMC 2.0 for Small Businesses

Scope matters here. EO 14409 covers civilian agencies and their contractors. National security systems — DoD and the intelligence community — are exempt and remain on the NSA's CNSA 2.0 track, which already expects newly acquired national-security systems to be quantum-safe from January 1, 2027.

So if you sell IT or cyber services to DHS, VA, GSA, or other civilian agencies, the forthcoming FAR clause is aimed at you. If your work is DoD-side, CNSA 2.0 — not this order — governs your timeline. Either way the direction is identical: FIPS-validated, quantum-resistant cryptography is becoming a contract requirement, not a best practice.

Does the post-quantum executive order apply to DoD contractors?
No. EO 14409 covers civilian agencies and their contractors. National security systems — DoD and the intelligence community — are exempt and follow the NSA's CNSA 2.0 schedule, which expects new national-security-system acquisitions to be quantum-safe from January 1, 2027.

When does the FAR rule take effect?
It doesn't yet. The order directs the FAR Council to publish a proposed rule within 180 days; it then goes through notice-and-comment before any final rule. The compliance date the rule will set is December 31, 2030.

What is the contractor deadline?
Covered civilian-agency contractors would need to meet NIST's FIPS, including post-quantum algorithms, by December 31, 2030, once the rule is finalized.