The 2026 federal post-quantum mandate: what boards should ask now
By Quentir ·; Published by Quentir Systems LLC
On June 22, 2026, the White House issued two presidential actions on quantum technology. One of them, Securing the Nation Against Advanced Cryptographic Attacks, sets a federal goal of migrating key government systems to post-quantum cryptography by the end of the decade.1 The companion order, Ushering in the Next Frontier of Quantum Innovation, directs a national effort to build a scientifically useful quantum computer and to update the National Quantum Strategy.2 Read together, the two documents move post-quantum cryptography from a standards conversation into an implementation deadline.
Board takeaway. The June 2026 orders do not make 2030 the moment to begin. They make 2030 the horizon by which the hard work has to be substantially sequenced. For private organizations, the practical questions are already familiar: who owns the cryptographic inventory, which data must remain confidential past the transition window, and which vendors control the systems that cannot be moved internally.
For a board, the relevant signal is timing. The migration target named in the security order is 2030 to 2031.1 That window is shorter than the replacement cycle of much enterprise hardware and many long-lived data assets. Organizations that hold data which must stay confidential for a decade or more are already exposed to the harvest-now-decrypt-later problem, in which an adversary records encrypted traffic today and decrypts it once a capable quantum computer exists.3 A federal deadline tends to propagate. Procurement language, vendor questionnaires, and insurance terms follow the government’s lead, so private organizations in regulated sectors should expect the 2030 horizon to reach them through their counterparties well before any direct rule does.
In the European Union the direction of travel is the same. The security-of-network obligations of the NIS2 Directive and the ICT-risk requirements of DORA are read against the current state of the art — which increasingly treats post-quantum readiness as part of appropriate protection for entities holding long-lived sensitive data. Neither instrument yet names post-quantum cryptography as a hard requirement, but both make a documented migration posture easier to defend and harder to omit.
The technical baseline is settled enough to act on. In 2024 the National Institute of Standards and Technology published its first finalized post-quantum standards, including FIPS 203, 204, and 205, which gives engineering teams concrete algorithms to plan around rather than candidates.4 The constraint is no longer the mathematics. It is discovery and sequencing: knowing where cryptography lives across an estate, which systems carry long-lived secrets, and which dependencies must move first.
Why this matters before 2030. PQC migration is constrained less by algorithm selection than by replacement cycles. Certificates, embedded devices, identity systems, archival data stores, vendor platforms, and regulated record systems often move on different calendars. A board that waits for a single enterprise-wide migration project will discover the dependencies too late. A board that starts with inventory can separate systems that need urgent treatment from systems that can move in the ordinary refresh cycle.
That distinction is the commercial and governance hinge. Post-quantum readiness is not “upgrade everything now.” It is a documented sequence: long-lived sensitive data first, high-dependency systems next, vendor-controlled paths in parallel, and a board record showing why the order was chosen.
Where the federal signal reaches private companies
The order is written for federal systems, but the operational effect will not stop at the edge of government. Federal procurement, defense-industrial questionnaires, cloud-security attestations, cyber-insurance renewals, and regulated-sector vendor reviews all tend to convert public-sector security priorities into private-sector evidence requests. The first question will not be “are you fully migrated?” It will be “can you show what you have inventoried, what you have prioritized, and which dependencies are outside your control?”
That is why the migration record matters. A board does not need a finished PQC estate in 2026. It does need a defensible explanation of the path: which systems are in scope, which data has long confidentiality life, which suppliers must move first, and which exceptions are being carried with a date and owner. The record is what turns a future technical programme into current governance evidence.
What should be in the first board pack
A useful first board pack is short. It should not be a cryptography textbook. It should contain five things: an accountable owner, the scope of the first cryptographic inventory, a list of data classes that must remain confidential beyond 2030, the top vendor-controlled dependencies, and the next decision date. If the pack cannot name those items, the organization is still at awareness stage.
The inventory should also distinguish between places where the organization controls the migration path and places where it is waiting on others. Identity providers, managed cloud services, certificate authorities, payment systems, medical platforms, industrial devices, and embedded products will not move on the same schedule. Boards should ask management to separate internal work from vendor dependency, because the risk is different and the evidence is different.
Vendor questions to ask now
Vendor readiness should be tested in ordinary commercial language. Which products or services use RSA or elliptic-curve cryptography in ways that protect long-lived confidential data? What is the vendor’s support plan for NIST-standardized algorithms, including FIPS 203, 204, and 205? Will migration require a product upgrade, a configuration change, a certificate change, or a contract renewal? What telemetry or documentation will the vendor provide so the customer can evidence the migration later?
The answer will often be incomplete. That is acceptable in 2026 if the gap is visible and owned. It is not acceptable if the organization has no list of the vendors it depends on, or if management treats supplier assurances as a substitute for a dated migration plan.
Three questions are worth putting to management this quarter.
- Does the organization have a current cryptographic inventory, including applications, data stores, certificates, identity systems, backups, embedded systems, and material third parties?
- Which assets fail the harvest-now-decrypt-later test because the data must remain confidential past 2030?
- Which vendors or infrastructure dependencies can delay migration even if management approves the work internally?
The answer does not need to be perfect in the first board cycle. It does need to be owned, dated, and repeatable.
None of this requires a board to become technical. It requires a readiness posture that can be evidenced. A useful migration program produces an inventory, a prioritized sequence tied to data sensitivity, and a record that can be shown to an auditor or a regulator. Quentir’s work on the post-quantum transition follows that discipline, drawing on the Bletchley-style migration approach developed in its research practice and on the broader governance frameworks published across its scholarship.5
The two June orders make the direction of travel explicit. The organizations that will absorb the 2030 deadline with least disruption are the ones that begin the inventory now, while the work is planning rather than emergency response.
Quentir resource. For boards that need to turn the June 2026 signal into an inventory-first migration plan, The PQC Migration Roadmap for Boards, 2026 sets out the dated sequence, source spine, and board questions through 2035.
Related Quentir Intelligence
The board’s PQC clock just moved up · Long-lived data, quantum risk: harvest-now-decrypt-later · PQC Migration Roadmap for Boards, 2026
The first board packet should be modest
The first PQC board packet does not need to promise total migration. It should show a dated cryptographic inventory, a long-lived-data register, a vendor dependency map, a migration owner, an exception log and the next review date. That is enough to move the discussion from abstract quantum risk to a record that procurement, security and counsel can use.
Sources
- The White House, Securing the Nation Against Advanced Cryptographic Attacks (June 22, 2026), whitehouse.gov.
- The White House, Ushering in the Next Frontier of Quantum Innovation (June 22, 2026), whitehouse.gov.
- The White House, Fact Sheet: President Donald J. Trump Ushers in the Next Frontier of Quantum Innovation (June 22, 2026), whitehouse.gov.
- National Institute of Standards and Technology, Post-Quantum Cryptography project; NIST, FIPS 203, FIPS 204, and FIPS 205.
- Office of Management and Budget, M-23-02, Migrating to Post-Quantum Cryptography (Nov. 18, 2022).
- European Union, NIS2 Directive; European Union, DORA.
- Quentir, The PQC Migration Roadmap for Boards, 2026 (Quentir Signature Report No. 2), quentir.ai/shop/p/report-no-2.
Published: June 24, 2026.
Published intelligence — identical for every reader, built to inform your own decisions. Dated to the named instruments above and subject to regulatory updates. Forward-looking statements are estimates.
Board-ready intelligence on the post-quantum transition
Quentir publishes fixed-scope, source-bound reports for boards and their advisers.