The Post-Quantum Deadline That Matters Isn't 2035. It's the Inventory You Don't Have Yet
October 26, 2026
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
The real post-quantum deadline isn't the 2035 date everyone quotes. It's the cryptographic inventory most organizations still don't have. Executive Order 14412 now requires federal agencies to name a migration lead and produce that inventory on a defined timeline, and a recent GAO review found that almost none of them can do it yet. If your organization sells to, audits, or follows the lead of the federal government, that gap is now your problem too.
What Does Executive Order 14412 Actually Require?
Signed on June 22, 2026, EO 14412 gives federal agencies hard dates for moving high-value assets and high-impact systems to post-quantum algorithms. Agencies must complete the move to post-quantum key establishment by December 31, 2030, and post-quantum digital signatures by December 31, 2031. A proposed Federal Acquisition Regulation rule would extend the same 2030 deadline to federal contractors, which pulls the requirement out of government IT shops and into any vendor that sells software or hardware to Washington.
The order also does something quieter but more consequential day to day: it tells each agency to name a PQC migration lead who owns an agency-wide cryptographic inventory, with the discovery work written into the mandate from the start. Follow-on guidance, OMB Memorandum M-26-15, required every agency to submit a migration plan within 120 days of the order, covering risk-based prioritization, an automated inventory methodology, and a crypto-agility architecture plan. That plan is due before most organizations have even finished deciding who owns the problem.
This matters beyond federal agencies because EO 14412 is not operating in isolation. The NSA's Commercial National Security Algorithm Suite 2.0 already requires that new National Security System acquisitions be CNSA 2.0 compliant by default starting January 1, 2027, with most equipment transitions targeted for 2033, well ahead of the broader federal goal. Civilian and defense timelines are now running on parallel tracks with different dates, and any organization that touches both has to track both.
| Track | Governing Authority | Key Milestone | Full Transition Target |
|---|---|---|---|
| Civilian federal agencies | EO 14412 / OMB M-26-15 | Migration plan due ~120 days after the order | Key establishment 2030, signatures 2031 |
| National Security Systems | NSA CNSA 2.0 | New acquisitions compliant by default, Jan 1, 2027 | Most transitions by 2033 |
| Government-wide goal | NSM-10 | Ongoing agency inventories since 2023 | Full quantum resistance by 2035 |
Why Did GAO Find Agencies Aren't Ready?
Because inventory work is hard, unglamorous, and nobody budgeted for it years ago. A GAO review released in October 2026 found that none of the 24 major federal agencies it examined had fully completed the preparation practices GAO assessed for defending against future quantum computing attacks. The gaps clustered around three things: identifying systems running vulnerable cryptography, estimating what replacing it would cost, and testing quantum-resistant alternatives.
Only one agency out of 24 had fully addressed the work needed to build a prioritized inventory of vulnerable systems, and GAO attributed the shortfall to incomplete inventories, a real shortage of cryptography expertise, and planning that hadn't caught up to the deadlines. That last point is the one worth sitting with. This isn't a tooling problem you fix by buying a scanner. It's a staffing problem, and GAO's earlier confidential report had already made 89 recommendations on building cryptographic inventories and identifying migration funding, most of which were still unresolved by the time the public version came out.
The practical lesson for anyone outside government doing the same work: start the inventory now, because the federal government started early and is still behind. Industry analysts tracking the broader rollout note that PQC talent scarcity is getting worse rather than better as programs scale, since the work spans algorithm knowledge, legacy system integration, and governance all at once, a mix that takes years to develop, not months.
What Is a Cryptographic Bill of Materials, and Why Does It Keep Coming Up?
A Cryptographic Bill of Materials is a structured, machine-readable record of every algorithm, key, certificate, and protocol running in an environment, mapped to how exposed each one is to a quantum attack. EO 14412 directs CISA, working with NIST, to define the minimum elements of a CBOM, but that guidance was still pending as of late 2026, which means agencies and vendors are building inventories now against a standard that hasn't fully landed. You cannot migrate cryptography you haven't found, and a CBOM is simply the artifact that proves you found it.
Inventory by itself isn't the end state either. NIST's own guidance on this, finalized in December 2025, treats crypto agility as the capability layer that sits on top of inventory, meaning a system's actual ability to swap out an algorithm without a multi-year rebuild. NIST's Cybersecurity White Paper 39 defines crypto agility as an essential capability and introduces a maturity model for measuring how far along an organization actually is, versus how far along it claims to be. The distinction matters because a spreadsheet of certificates is not the same thing as a system that can rotate them under pressure.
For practitioners, this is where the work actually lives day to day: mapping algorithm use across applications and infrastructure, scoring exposure, and designing the modular, policy-driven architecture that lets an organization respond the next time NIST or NSA moves a deadline. CompTIA's SecurityX curriculum covers this kind of enterprise cryptographic architecture and risk-based security design directly, which is why it's worth a look if this work is landing on your desk. You can review how the CompTIA SecurityX certification maps to that scope, or check the broader certification resources if you're weighing which credential fits the work you're actually being asked to do.
What Should You Actually Do Before the Next Deadline Hits
Start with the inventory, not the algorithm. Every framework in this space, from CISA and NSA guidance to NIST's own drafts, puts discovery first because prioritization is impossible without knowing what you have and where it sits. Pick your ten most exposed systems, the ones handling long-lived sensitive data or external-facing signing, and build a CBOM for those before trying to boil the ocean.
Next, separate the inventory question from the agility question. Knowing where RSA-2048 or ECDSA lives in your stack tells you your exposure. Being able to swap that algorithm without redeploying every dependent system is a different, harder capability that takes architectural planning, not just a spreadsheet update. NIST's crypto agility guidance treats these as sequential steps for a reason.
Finally, treat the vendor side of this as seriously as your own infrastructure. The proposed FAR rule extending FIPS compliance to contractors, and the NSA's 2027 acquisition deadline for National Security Systems, both mean that procurement conversations are about to start asking which post-quantum algorithms your vendors support, not just whether they patch on time. If you want a study plan built around enterprise cryptographic architecture and the governance skills this work actually requires, you can start training now rather than after the next deadline lands.
None of this resolves on its own timeline. The GAO findings make clear that government agencies, with years of advance notice and a standing executive mandate, are still behind on the basic discovery work. Waiting for the 2030 or 2035 dates to feel urgent is how organizations end up doing rushed, expensive migration under a deadline instead of planned migration on their own schedule.