Every date that matters.
From the 2022 national security memorandum to the 2035 end state. Past milestones stay listed because they still define today’s obligations.
| Date | Instrument | What it requires | Applies to |
|---|---|---|---|
| May 2022 | NSM-10 | Sets the national goal of mitigating quantum risk as much as feasible by 2035 and requires annual inventories of quantum-vulnerable systems. | Federal agencies |
| Sep 2022 | CNSA 2.0 (NSA) | Quantum-resistant algorithm suite for national security systems: ML-KEM-1024, ML-DSA-87, AES-256, SHA-384/512, and LMS or XMSS for firmware signing. | National security systems, defense |
| Nov 2022 | OMB M-23-02 | Annual prioritized inventories of cryptographic systems and migration funding estimates. | Federal agencies |
| Dec 2022 | Quantum Computing Cybersecurity Preparedness Act | Puts inventory and migration into law and requires annual reports to Congress. | Federal agencies |
| Aug 2024 | FIPS 203, 204, 205 | NIST’s first post-quantum standards: ML-KEM, ML-DSA and SLH-DSA. | Everyone |
| Jun 2025 | EO 14306 | Amends EO 14144. Keeps the TLS 1.3 requirement and the CISA PQC product categories list. | Federal agencies |
| Jan 2026 | CISA PQC product categories | Lists product categories where PQC is widely available or transitioning, for agencies to reference in procurement. | Agencies, vendors |
| Jun 22, 2026 | EO 14412 | Hard deadlines for high-value and high-impact systems; FAR rules for contractors; CBOM guidance from CISA and NIST. | Agencies, contractors |
| Jun 24, 2026 | OMB M-26-15 | Five-phase migration through 2035, migration plans, automated CBOMs, and FedRAMP coordination. | Civilian agencies |
| Sep 21, 2026 | CMVP | Remaining FIPS 140-2 validations move to historical status; new purchases need FIPS 140-3. | Agencies, vendors |
| Jan 1, 2027 | CNSA 2.0 · CNSSP 15 | New national security system acquisitions must be CNSA 2.0 compliant. | NSS, defense vendors |
| Jan 2, 2030 | EO 14306 | Agencies support TLS 1.3 or a successor. | Federal agencies |
| Dec 31, 2030 | EO 14412 | PQC key establishment on high-value assets and high-impact systems. | Agencies, contractors |
| Dec 31, 2031 | EO 14412 | PQC digital signatures on those same systems. | Agencies, contractors |
| 2035 | NSM-10 · M-26-15 · NIST IR 8547 | Remaining systems migrated; quantum-vulnerable public-key algorithms disallowed. | Everyone |
Where you fit.
Federal rules reach well past federal agencies, through contracts, procurement and sector regulators.
Binding now.
Migration plans under M-26-15, automated CBOMs, TLS 1.3 by 2030, and PQC on high-value and high-impact systems by 2030 and 2031.
CNSA 2.0 track.
National security systems follow NSA’s CNSA 2.0, with compliant acquisitions from 2027 and exclusive use between 2030 and 2033. Validation runs through NIAP as well as FIPS.
Next in line.
EO 14412 directs the FAR Council to propose rules requiring covered contractors to meet PQC FIPS standards by the end of 2030. Agencies already reference CISA’s product categories in procurement.
Pressure through existing rules.
No direct PQC mandate yet, but CMMC, HIPAA, PCI DSS 4.0 and quantum-risk guidance from the OCC, the Federal Reserve and FINRA all point the same way.
Requirement to deliverable.
Each federal requirement maps to work we already deliver.
| Requirement | QuanMind service |
|---|---|
| Automated, continuously updated CBOM (M-26-15) | CBOM generation with re-scan runbooks |
| Prioritize high-value and high-impact systems | Q-Readiness Index and cryptographic audit |
| Multiyear migration plan with budgets and owners | Roadmap included in every Assurance and Program engagement |
| PQC key establishment by 2030, signatures by 2031 | Migration support |
| FIPS 140-3 and CISA product categories in procurement | Vendor assessment and the vendor PQC tracker |
| Contractor readiness for upcoming FAR rules | Due diligence and readiness assessments for suppliers |
| Accountable officials and trained staff | PQC training |
This page summarizes public federal documents for planning purposes and is not legal advice. Requirements can change; confirm against the source documents and your contracting officer.