EO 14409 Sets Federal Post-Quantum Deadlines. The Cryptographic Bill of Materials Is the Test.

President Trump signed Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks," on June 22, 2026. The order moves federal post-quantum cryptography from a decade of NIST recommendations to a schedule of dated obligations with named owners. It also introduces a requirement most agencies cannot satisfy with the cryptographic inventories they hold today: a cryptographic bill of materials.

The threat model behind the order is the harvest-now, decrypt-later problem. Adversaries collect encrypted federal data now and hold it against the arrival of a cryptographically relevant quantum computer. NIST standardized the defenses in 2024 as FIPS 203 (ML-KEM) for key establishment and FIPS 204 (ML-DSA) for digital signatures. EO 14409 sets the calendar for putting them into production.

What the order requires and who owns it

The order assigns strategic coordination to the Director of the Office of Management and Budget and the National Cyber Director. Technical guidance flows from NIST, in consultation with the National Security Agency and CISA. Agencies that serve as Sector Risk Management Agencies, defined under National Security Memorandum 22 of April 30, 2024, work through CISA to help critical infrastructure operators build their own migration plans.

The deadlines are specific. Within 90 days, OMB issues guidance requiring each agency to inventory its high value assets and high impact systems, excluding National Security Systems, and to submit a migration plan. Those systems must use post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. Federal contractors are directed to comply with post-quantum FIPS by the end of 2030, and NIST runs a migration pilot to be completed by December 31, 2027. National Security Systems sit outside this order and follow the separate CNSA 2.0 timeline, which mandates ML-KEM-1024 and ML-DSA-87.

The requirement most programs are not ready for

Within 270 days, CISA must publish the minimum elements for a cryptographic bill of materials. This is the part of the order that reaches past the transport layer. A cryptographic bill of materials is an inventory of which algorithms protect which assets, at what parameter set, under what key. It is the cryptographic analog of a software bill of materials, and it is harder to produce, because most organizations do not track cryptography at the level of the data object.

An agency can enable hybrid post-quantum key exchange in TLS 1.3 and truthfully report that connections are quantum-resistant in transit. That change says nothing about the data at rest in a database, the records in an object store, or the archived files an adversary already exfiltrated. The mandate asks which algorithm protects which data. A transport upgrade cannot answer that question, because the protection it adds does not travel with the data. This is the same gap NIST IR 8547 flagged when it set the migration floor.

Why this is a data-centric problem

The cryptographic bill of materials is a data-inventory problem before it is a cryptography problem. To report which algorithm protects which object, the algorithm has to be bound to the object. Data-centric zero trust does exactly that. Lattix Technologies binds policy and key material to the data object itself and evaluates every access at a policy enforcement point against attribute-based access control at a policy decision point.

Under that model, the cryptographic bill of materials is a query rather than a discovery project. Each object records the parameter set that protects it, ML-KEM-768 or ML-KEM-1024 for key encapsulation, and Merkle-tree lineage in content-addressed storage (CAS-X) records every key operation against it. Cryptographic agility becomes a configuration property of the object rather than a rebuild of the transport stack. When a parameter set is deprecated, the migration is a re-wrap governed at the enforcement point, and the lineage chain is the evidence that it happened.

What federal programs should be doing now

The pilot deadline of December 31, 2027, is the near-term pressure. A program office that treats post-quantum migration as a transport-layer refresh will meet the connection-level metric and fail the cryptographic bill of materials. The same procurement pattern is already visible in CISA's PQC product categories, where the acquisition language names capabilities rather than accepting generic quantum-safe claims. The durable work is establishing an authoritative record of which data objects exist, which policies govern them, and which algorithms protect them.

EO 14409 turns post-quantum migration into an auditable federal obligation. The audit does not test whether a cipher was swapped. It tests whether an agency can name the cryptography protecting a given asset and prove the migration with evidence. That is a property of the data layer, and it is the property agencies have the least time to build.

References

• The White House, Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks" (June 22, 2026)
• The White House, Fact Sheet: President Donald J. Trump Secures the Nation Against Advanced Cryptographic Attacks
• The White House, Executive Order "Ushering in the Next Frontier of Quantum Innovation" (June 2026)
• NIST, FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
• NIST, FIPS 204 Module-Lattice-Based Digital Signature Standard (ML-DSA)
• The White House, National Security Memorandum 22 on Critical Infrastructure Security and Resilience (April 30, 2024)