Skip to content

Back to the catalog

Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness
wiz.ioarticle

Breaking Down the White House’s Actions on Post-Quantum Cryptography Readiness

Wiz breaks down Executive Order 14409 ('Securing the Nation Against Advanced Cryptographic Attacks') and OMB memorandum M-26-15, which set accelerated federal deadlines for migrating High Value Assets and High Impact Systems to NIST-approved post-quantum cryptography (key establishment by 2030, digital signatures by 2031). It covers requirements for automated cryptographic inventories, forthcoming NIST/CISA Cryptographic Bill of Materials (CBOM) guidance, Harvest-Now-Decrypt-Later risk prioritization, FedRAMP/FAR Council contractor compliance rules, and comparable international timelines (EU, Japan, Australia, India), before pitching Wiz's own CBOM/PQC readiness tooling.

TL;DR Breakdown of EO 14409 and OMB M-26-15's accelerated federal post-quantum cryptography migration mandates, CBOM requirements, and contractor compliance timelines.
Open original ↗
Document

What it is

Wiz's breakdown of two federal policy documents — Executive Order 14409 ("Securing the Nation Against Advanced Cryptographic Attacks") and OMB Memorandum M-26-15 ("Execution of the Migration to Post-Quantum Cryptography") — plus the Department of War's separate PQC Strategy. The summary covers the headline mandates; this note carries the phased schedule, hard deadlines, and governance hooks the summary omits.

Preconditions / Affected

  • Federal civilian agencies holding High Value Assets (HVAs) or High Impact Systems — which the piece notes covers "most systems critical to government functionality, mission, or maintaining sensitive information," numbering in the hundreds to thousands.
  • Government contractors providing software, cloud services, or handling sensitive federal data — expected to transition their own environments and coordinate migration with their federal counterparts.
  • DoW systems, under a stricter schedule than the civilian one.

Timeline detail (beyond the summary)

The summary gives the two endpoints (key establishment by 2030, signatures by 2031). M-26-15 requires civilian agencies to deliver a comprehensive PQC Migration Plan within 120 days, structured as phased lines of effort:

timeline
    2026-2027 : Strategy, planning, discovery
    2027-2028 : Pilots + early migration of prioritized systems
    2028-2030 : PQC key establishment (priority systems)
    By 2031 : PQC digital signatures
    By 2035 : Remaining systems migrated

The 2035 full-completion date and the 120-day plan deadline do not appear in the existing summary. The DoW Strategy is more aggressive: quantum-resistant crypto on high-impact systems by 2030 and across its entire force by 2031.

What to do

The page is policy analysis, not a technical advisory — no commands. Actionable implications it states:

  • Build a dynamic, continuously updated cryptographic asset inventory; OMB calls this "the foundation of the migration plan" and pushes automation. DoW specifically recommends Automated Cryptography Discovery and Inventory (ACDI) tools. Manual discovery is stated as unable to scale.
  • Expect CBOM to become a standard deliverable alongside software once NIST/CISA publish minimum-elements guidance (March 2027) — relevant to contractors who ship to federal customers.
  • Use context-driven prioritization: identify where weak algorithms exist per system, then decide whether the risk is easily mitigated or requires modernization/replacement. Extend this to Harvest-Now-Decrypt-Later exposure (weak key-exchange protocols, long-sensitivity data).

Caveats

  • This is a vendor (Wiz) interpretation of the documents, not the primary text; verify deadlines and scope against EO 14409 and M-26-15 directly before planning against them.
  • The fetched text is truncated mid-sentence in the HNDL section, so the full prioritization guidance may include detail not captured here.

Organisations named here

  • Executive Order 14409
  • FAR Council
  • FedRAMP
  • Harvest Now, Decrypt Later
  • M-26-15
  • State and Local Cybersecurity Grant Program

Technologies named here

  • High Value Assets and High Impact Systems
  • Wiz PQC readiness lens
  • FedRAMP cloud services
  • Wiz automated CBOM generation
  • SSL/TLS session key exchanges
  • Wiz PQC Tester
  • Wiz Security Graph
  • Automated Cryptography Discovery and Inventory tools
  • Wiz

Techniques named here

  • Harvest now, decrypt later
  • Context-driven prioritization for high risk systems

Threat actors named here

  • Nation-state actors
  • Harvest Now, Decrypt Later

Related in GRC