The clock started: the 2030 federal post-quantum mandate
The clock started on June 22, 2026
Executive Order Securing the Nation against Advanced Cryptographic Attacks sets hard post-quantum deadlines, key establishment by 2030, signatures by 2031, with a NIST pilot due in 2027 and procurement rules that reach private contractors. For any institution whose data must stay secret for years, the message is blunt: cryptographic agility is now a deadline. ACM was built to meet it on day one.
A timeline with no slack
The order, signed by the President on June 22, 2026, lays out a cascade of deadlines that, for many organizations, is roughly four to five years sooner than the prior 2035 expectation. The specifics leave little room to wait:
- 30 days: every agency names a PQC migration lead responsible for a cryptographic inventory and a prioritized migration plan.
- 90 days: OMB issues guidance requiring agencies to inventory high-value assets and high-impact systems and submit migration plans.
- December 31, 2030: all high-value assets and high-impact systems transition to PQC for key establishment (ML-KEM / FIPS 203).
- December 31, 2031: the same systems transition to PQC for digital signatures (ML-DSA / FIPS 204, SLH-DSA / FIPS 205).
- December 31, 2027: NIST completes a PQC migration pilot, a near-term proof point that the transition is real.
- 270 days: CISA and NIST publish the minimum elements of a cryptographic bill of materials (CBOM) to enable automated assessment of every cryptographic asset.
- Procurement: the FAR Council proposes rules requiring covered contractors to meet FIPS PQC requirements by December 31, 2030 and to run vulnerability-disclosure programs that cover weak or non-FIPS cryptography.
This is not only a government problem
The order pulls private institutions in through two doors, and a third is already open.
- Critical infrastructure: Sector Risk Management Agencies and CISA are directed to help critical-infrastructure owners and operators, financial services among them, develop migration plans.
- The supply chain: the FAR rules bind covered contractors to the same 2030 deadline, so vendors to government inherit the clock.
- Harvest now, decrypt later: adversaries are recording encrypted data today to decrypt once quantum hardware arrives. For banks and securities firms, whose records stay sensitive for decades, the practical deadline is already past, the data leaving your network now must be quantum-safe now.
Recent research has only sharpened the urgency: resource estimates for breaking RSA and elliptic-curve cryptography have fallen by orders of magnitude, and major providers have pulled their own timelines to 2029. The federal government responded by compressing its own.
You cannot migrate what you cannot see
The order's CBOM requirement exposes the real obstacle: most institutions cannot enumerate the cryptography running across their stack, every library, module, protocol, and key. Post-quantum migration is not a drop-in replacement, ML-KEM public keys are roughly three times larger than RSA, and the work touches protocols, hardware, and long-lived archives. Inventory first, prioritize by secrecy-lifetime and exposure, then migrate. That is a multi-year program for anyone starting from scratch.
The partner for immediate post-quantum readiness
ACM is not racing toward the 2030/2031 target, our stack is already there. Post-quantum security is the default in the architecture, not a roadmap item, which is exactly what an institution under a deadline needs from a partner.
- NIST algorithms, already native: ML-KEM, ML-DSA, and SLH-DSA run as native primitives on the Lux post-quantum ledger from genesis, so key establishment and signatures are quantum-safe today, not in a future release.
- Hybrid migration, no flag day: classical and post-quantum signatures verify side by side, so you transition without breaking what works, the order's own crypto-agility principle, in production.
- CBOM & discovery, on day one: ACM helps you inventory quantum-vulnerable cryptography across your environment and prioritize it the way the order asks, by impact and data secrecy-lifetime.
- Regulated-first & non-custodial: MPC threshold custody, enforced on-chain compliance, FHE privacy, and real-time AI/ML AML, the controls a regulated institution needs around the algorithm swap.
- Own it: license the IP, resell it under your brand, or co-build with our team, built on Lux (blockchain, PQ cryptography, FHE), Hanzo (AI & data), and Zen (LLMs). ACM is a member of the W3A (Web3 Alliance).
Read the full analysis in the 2030 mandate white paper, the quantum balance-sheet-risk paper, and our post-quantum security capability. The order itself is published by the White House.
Five years is less than it sounds
Inventory, prioritize, migrate, on a partner that is already quantum-safe. We will map your crypto posture to the 2030/2031 deadlines and a realistic plan to get there.
Review your crypto postureFrequently asked questions
What does Executive Order 'Securing the Nation against Advanced Cryptographic Attacks' require?
Signed June 22, 2026, the order requires federal high-value assets and high-impact systems to transition to post-quantum cryptography for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. Agencies must name a PQC migration lead within 30 days and submit migration plans; NIST runs a pilot to be completed by December 31, 2027; CISA and NIST publish minimum elements for a cryptographic bill of materials (CBOM) within 270 days; and the FAR Council proposes rules requiring covered contractors to meet FIPS PQC requirements by December 31, 2030 and to run vulnerability-disclosure programs covering cryptographic weaknesses.
Does this reach private institutions like banks?
Yes, indirectly but firmly. Sector Risk Management Agencies and CISA are directed to help critical infrastructure owners and operators, which includes financial services, build migration plans, and the FAR rules pull covered contractors into the same 2030 deadline. Combined with the harvest-now-decrypt-later risk to long-lived financial records, regulated institutions have every reason to move on the federal timeline.
How does ACM deliver immediate post-quantum readiness?
ACM's regulated stack already deploys the NIST post-quantum algorithms, ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), as native primitives, with hybrid classical-plus-post-quantum migration, crypto-agility so algorithms rotate, and the inventory tooling a CBOM requires. Institutions partner with ACM to stand where the mandate points, today, instead of starting a multi-year project from zero.