Executive Order 14409
Under the authority given to me as President by the Constitution and the laws of the United States, I hereby order:
Section 1. Background and Policy. The rise of large-scale quantum computers, especially if controlled by adversaries, threatens the security of common cryptographic systems. Current cyber activities against the United States suggest that adversaries might collect information now to decrypt it later when quantum computers become operational. To address these risks, the U.S. must enhance cryptographic defenses for sensitive data, critical infrastructure, and the digital economy.
The policy of the United States is to ensure national security and maintain technological leadership by transitioning Federal information systems to National Institute of Standards and Technology (NIST)-approved Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography (PQC). This transition will also support critical infrastructure owners and operators in their own transitions.
Sec. 2. Definitions. For the purposes of this order:
(a) The term “agency” is defined as in 44 U.S.C. 3502(1);
(b) The term “critical infrastructure” is defined as in section 1016(e) of the USA Patriot Act of 2001 (42 U.S.C. 5195c(e));
(c) The term “high impact system” refers to an information system where at least one security objective (confidentiality, integrity, or availability) is given a FIPS 199 potential impact value of “high”;
(d) “High value asset” or “HVA” refers to Federal information or a Federal information system recognized as a high value asset under Office of Management and Budget (OMB) Memorandum M-19-03, or any successor document;
(e) The term “information systems” is defined as in 6 U.S.C. 650(14);
(f) “National Security Systems” is defined as in 44 U.S.C. 3552(b)(6);
(g) “Post-quantum cryptography” or “PQC” refers to cryptographic algorithms or methods designed to resist attacks from both quantum and classical computers;
(h) “PQC migration lead” refers to the agency employee or detailee responsible for managing agency-wide cryptographic inventory, developing a prioritized PQC migration strategy, and coordinating cross-agency PQC efforts;
(i) The “Cryptographic Module Validation Program” is defined as in FIPS 140-3, or any successor policy;
(j) “Digital signature” is defined as in FIPS 186-5, or any successor policy; and
(k) “Key establishment” is defined as in FIPS 203, or any successor policy.
Sec. 3. Coordinating the PQC Transition. (a) The Director of OMB and the National Cyber Director, in collaboration with the Assistant to the President for National Security Affairs and the Administrator of the Office of Electronic Government, OMB, will lead the strategic coordination and oversight of the national PQC migration policy and strategy outlined in this order, ensuring alignment with wider cybersecurity goals.
(b) The Secretary of Commerce, through the Director of NIST, and in consultation with the Director of the National Security Agency (NSA) and the Secretary of Homeland Security, via the Director of the Cybersecurity and Infrastructure Security Agency (CISA), will provide agencies with ongoing technical guidance on PQC implementation, including best practices and risk management strategies.
Sec. 4. Accelerating the PQC Transition. (a) Within 30 days from this order, each agency head must identify their PQC migration lead and submit their name and contact information to the Director of OMB and the National Cyber Director.
(b) Within 90 days from this order, the Director of OMB, in collaboration with the Secretary of Homeland Security through the Director of CISA and the National Cyber Director, and following 6 U.S.C. 1526(c), will issue guidance requiring each agency to:
(i) Review their inventory of HVAs and high impact systems, excluding National Security Systems;
(ii) Transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030;
(iii) Transition all HVAs and high impact systems to use PQC for digital signatures by December 31, 2031; and
(iv) Develop and submit a plan to the Director of OMB and the National Cyber Director to achieve this directive.
(c) Within 180 days from this order, the Secretary of Commerce, through the Director of NIST, will initiate a pilot project for PQC migration on a subset of information systems owned or operated by NIST, to be completed by December 31, 2027.
Sec. 5. Leading the PQC Transition. (a) All agencies designated as Sector Risk Management Agencies, as defined by the National Security Memorandum 22 of April 30, 2024, or its successor, will collaborate with the Department of Homeland Security through the Director of CISA to support critical infrastructure owners and operators in developing their PQC migration plans.
(b) The Secretary of State will work with the Director of NIST, the Secretary of Homeland Security, the National Cyber Director, the Secretary of War, and the Director of National Intelligence (DNI) to engage foreign governments and industry groups in key countries to encourage their transition to NIST-standardized PQC algorithms.
(c) Within 180 days from this order and annually thereafter until PQC migration is complete, the Director of the NSA, as the National Manager for National Security Systems, will submit a report to the President, via the Committee on National Security Systems, on the status of PQC migration for agencies that own or operate National Security Systems.
(d) Within 270 days from this order, the Secretary of Homeland Security, through the Director of CISA, and in coordination with the Director of NIST, will release public guidance on the minimum elements for a cryptographic bill of materials. This will enable the automated assessment of cryptographic assets used by hardware or software elements.
Sec. 6. Procurement. (a) The Director of OMB, the Secretary of War, the Administrator of NASA, and the Administrator of General Services, in collaboration with the Secretary of Homeland Security, the DNI, and the Director of NIST, will coordinate efforts to identify cost-saving opportunities in implementing the national PQC migration policy and strategy. This includes cloud-based technology migration, shared procurement of PQC tools, joint training programs, and centralized technical support.
(b) Within 180 days from this order, the Secretary of Commerce, through the Director of NIST, will revise the processes used by the Cryptographic Module Validation Program, to the extent appropriate and consistent with applicable law, to expedite validations of cryptographic modules.
(c) Within 180 days from this order, the Federal Acquisition Regulatory Council (FAR Council), in consultation with the Secretary of Homeland Security through the Director of CISA and the Director of NIST, will publish a proposed rule amending the Federal Acquisition Regulation (FAR) to require covered contractors to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC-compliant algorithms.
(d) Within 270 days from this order, the FAR Council, in collaboration with the Secretary of Homeland Security through the Director of CISA and the Director of NIST, will publish a proposed rule amending the FAR requirements and contract clauses for contractor vulnerability disclosure programs. These programs must ensure that covered contractors implement vulnerability disclosure policies (VDPs) consistent with NIST guidelines, and that VDPs incorporate reports of cryptographic vulnerabilities, including testing for lack of encryption and the use of non-FIPS approved algorithms.
Sec. 7. General Provisions. (a) Nothing in this order shall impair or otherwise affect:
(i) The authority granted by law to an executive department or agency, or the head thereof; or
(ii) The functions of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals.
(b) This order shall be implemented in accordance with applicable law and subject to available appropriations.
(c) This order is not intended to create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
(d) The Department of Commerce will cover the costs for publishing this order.
DONALD J. TRUMP
THE WHITE HOUSE,
June 22, 2026.
