Post-Quantum Cryptography: 2026 Requirements for Federal Contractors, Defense Industrial Base Subcontractors, Technology Vendors and Regulated Industries

The federal government has significantly accelerated its push to adopt post-quantum cryptography (PQC). Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed in June 2026, and OMB Memorandum M-26-15 establish hard federal migration deadlines and extend compliance expectations to the private sector through federal procurement. Federal prime contractors and subcontractors—especially the defense industrial base and technology, IT and cloud vendors selling into government—plus financial services firms, healthcare and life-sciences organizations and critical-infrastructure operators (including energy and telecommunications) face the nearest-term exposure as requirements reach them first through procurement and sector-specific guidance; the compliance clock is now ticking.

Key 2026 Developments and Deadlines

The National Institute of Standards and Technology (NIST) finalized the first three PQC standards in August 2024—FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)—and urged organizations to begin transitioning immediately. Building on these standards and the Quantum Computing Cybersecurity Preparedness Act (Public Law 117-260), EO 14412 and M-26-15 now impose a five-phase migration timeline running through 2035. Near-term deadlines that matter to private-sector companies include:

• October 2026: Federal agencies must submit PQC Migration Plans to the Office of Management and Budget (OMB) and the Office of the National Cyber Director (ONCD). Agencies will be assessing contractor and vendor readiness as part of this process.
• December 2026: The FAR Council must publish a proposed rule on contractor PQC compliance—the mechanism by which quantum-safe requirements will flow into federal contracts.
• January 2027: All new National Security System acquisitions must comply with NSA’s CNSA 2.0 suite, directly affecting the defense industrial base.

While no quantum computer can break current encryption today—mainstream estimates place a cryptographically relevant quantum computer five to twenty years away—adversaries are already conducting “harvest now, decrypt later” campaigns, collecting encrypted data for future decryption. Data with a long confidentiality horizon is at risk now.

How Commercial Clients Are Affected

Government contractors face the most immediate pressure. The forthcoming FAR rule will embed PQC obligations directly in contract requirements; agencies preparing their migration plans will scrutinize contractor security postures. Regulated industries, including financial services, healthcare and critical infrastructure, should also prepare: PQC signals are emerging in sector-specific guidance (e.g., HHS/ASPR quantum guidance for healthcare), and frameworks such as PCI DSS and HIPAA will incorporate PQC requirements over time. As quantum-safe standards mature, “reasonable security” expectations will shift accordingly.

1. What You Should Do Now

• Communicate with internal stakeholders the importance of understanding the encryption in your network. Conduct business continuity impact assessments and document the process as you move towards quantum resilience.
• Conduct a cryptographic inventory. Identify where your organization uses quantum-vulnerable public-key cryptography, the algorithm types deployed, and associated data-lifecycle and confidentiality requirements.
• Assess your supply chain. Review vendor and third-party security representations, and update contractual security requirements and incident-response plans to address quantum-era risk.
• Build crypto-agility. Design systems with the ability to swap cryptographic algorithms as standards evolve, avoiding costly rip/replace migrations later.
• Engage in the rulemaking process. Government contractors should monitor and consider commenting on the forthcoming FAR proposed rule.
• Prioritize high-value data. Focus first on data with long confidentiality requirements that are most vulnerable to harvest-now, decrypt-later threats.

For most private companies, the current imperative is risk management and proactive compliance readiness—not responding to an imminent cryptographic threat. Private companies should keep in mind the financial exposure they may face if their data is decrypted in the future and they failed to comply with post-quantum cryptography regulatory, legal, ethical and cybersecurity industry standards. Private companies can turn to the class action litigation playbook for reference. Private Companies have paid millions of dollars to settle class action cases over cyberattacks exposing customers' personal information. The cost for settling data breach cases will only increase over time, but private companies can avoid this type of costly litigation by ensuring that their systems are post-quantum safe. The regulatory trajectory is unmistakable, and the organizations that begin planning and investing in quantum-safe transitions now will be best positioned when binding contractual and sectoral requirements arrive. 

Buchanan’s Cybersecurity and Data Privacy and Advanced Technology teams are available to answer questions about how these developments affect your organization.

Authors: