Post-quantum cryptography is on a federal procurement clock

Quantum computers capable of breaking today's public-key encryption don't exist yet. The migration meant to defend against them is already underway.

Six days before World Quantum Readiness Day on Sept. 17, 2026, federal agencies and their contractors are buying post-quantum cryptography (PQC) products on a procurement clock set by Executive Order 14306, the June 2025 order that amended the two prior cybersecurity executive orders and directed the government toward quantum-resistant standards. The threat that put PQC on that clock isn't a future quantum breakthrough. It's a present-tense data-collection problem called harvest now, decrypt later.

"Harvest now, decrypt later" describes adversaries copying encrypted traffic today, storing it, and waiting for a cryptanalytically-relevant quantum computer, the term the joint CISA, NSA and NIST factsheet on quantum readiness uses for a device large and accurate enough to run Shor's algorithm against RSA and elliptic-curve keys. The model is the named risk in an Arizona State University Q&A with Michel Kinsy, director of the ASU Secure, Trusted and Assured Microelectronics Center. The categories most exposed are the ones with the longest confidentiality shelf life: medical records, financial data, classified communications, and encrypted backups whose secrecy still matters five or ten years from now.

That long shelf life is the problem with waiting. PQC migration touches every layer of an organization's stack that uses public-key cryptography, the math behind TLS handshakes, signed software updates, identity tokens, and the keys that protect data at rest. Each layer needs to be inventoried, prioritized, and replaced with algorithms from NIST's first post-quantum standards, FIPS 203, 204 and 205, which shipped in 2024. Symmetric encryption (AES) and hash functions are not in the same risk bucket; the migration target is the asymmetric primitives that key exchange and digital signatures depend on.

EO 14306 turned that engineering project into a procurement requirement. The order amended Executive Order 13694 and Executive Order 14144, and directed CISA to publish a list of product categories where the government should acquire PQC-capable products going forward. CISA released that list in 2025, and per a WilmerHale client alert on EO 14306, the modified requirements flow down to federal contractors and subcontractors. In practice, a vendor selling into the federal market is being asked to ship PQC-capable versions of products in those categories, or risk losing the contract.

For organizations outside the federal supply chain, the same engineering problem exists without the same legal clock. Kinsy uses the SHA-1 transition as a cautionary analogue: the move from SHA-1 to SHA-2 took most of a decade across browsers, certificate authorities, and operating systems, and was driven by academic attacks rather than a live exploit. PQC migration will follow a similar arc across a broader surface, with more software, more vendors, and more cryptographic primitives under the same deadline pressure. A flawed deployment is recoverable; a delayed deployment leaves data exposed for the entire window between now and whenever a cryptanalytically-relevant quantum computer arrives.

The work is not. Inventory where public-key cryptography lives in the stack; identify the data classes with the longest confidentiality shelf life; track which product categories CISA's list covers; and stage the migration behind FIPS 203, 204 and 205. Treat Sept. 17 as a checkpoint, not a finish line. The readiness day is an ASU-promoted observance rather than a globally codified event, and the real deadlines are the ones CISA's procurement list sets.

The next concrete milestone is CISA's ongoing review of the product-categories list. As more categories are added and as standards mature, the procurement clock for federal contractors tightens. For private-sector organizations, the equivalent clock is the one an internal PQC roadmap sets today.