For a private-sector CISO, Executive Order 14409, “Securing the Nation Against Advanced Cryptographic Attacks” is an additional signal and call to action. For Federal security leaders, it’s an order with your name on it. The recap on what to do is short: inventory your cryptography, name someone to run the migration, and move your priority systems to NIST’s post-quantum standards by the deadline. The challenge is whether you can execute fast enough without losing control of scope, dependencies, and mission risk.

Treat Your PQC Migration Lead As More Than A Contact

Section 4 requires that within 30 days, each agency head must name a PQC migration lead and send the name and contact details to OMB and the National Cyber Director.

What this means: The job is really a multi-year program-office function, and the person needs authority to compel participation and action. This person owns agency-wide cryptographic inventory management, a prioritized migration plan, and cross-agency coordination. Treat the 30-day deadline as a forcing function to decide who has the authority required to own this, identify cross-functional key contributors that will support the migration lead, and establish governance and escalation paths.

Cryptographic Inventory Is Where You Will Gain Or Lose Time

Within 90 days, OMB will issue guidance requiring each agency to review its inventory of high-value assets and high-impact systems, move them to PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031, and submit a plan.

What this means: The 2030 and 2031 dates live in the EO itself, not the forthcoming OMB guidance. The guidance will tell you how to report, not whether the clock runs. Waiting for it spends 90 days of your scarcest resource. You have a head start: your HVA designations under OMB M-19-03 and your FISMA high-impact categorizations already give you the system list to start from. Gaining the required visibility of where cryptography is used across applications, infrastructure, identity systems, certificates, APIs, embedded systems, vendor products, cloud services, and managed services is foundational to your PQC migration. The coordinated efforts for procurement outlined in the EO, including any shared procurement of PQC tools, will help but you may not need to wait. Use this window of time to assess whether you already have existing technologies in your environment with built-in capabilities for cryptographic algorithm discovery and inventory. If you have already started cryptographic discovery activities, use the time to validate and consolidate your existing inventories.

Key Establishment And Digital Signatures Are Different Migration Efforts

The EO separates deadlines for key establishment and digital signatures, in recognition of the complexity involved. This is by design.

What this means: Protecting encrypted data in transit and replacing signature mechanisms are related, but they create different operational problems. Key establishment affects protocols and communications paths. Digital signatures touch software integrity, identity, certificates, authentication flows, document signing, firmware validation, and other trust mechanisms.

This distinction matters for sequencing. Agencies may be able to pilot hybrid or PQC-ready key establishment in some environments sooner than they can unwind signature dependencies (and potentially conduct re-signing for documents, contracts, code, etc.) across software, devices, and vendor ecosystems.

CBOMs Will Expose Vendor And System Blind Spots

The EO requires CISA, in coordination with NIST, to release public guidance within 270 days describing minimum elements for a cryptographic bill of materials (CBOMs). The purpose is to enable automated assessment of cryptographic assets used by hardware or software elements.

What this means: Agencies cannot migrate what they cannot see, and they cannot manage vendor risk if vendors cannot explain what cryptography their products use. A CBOM makes weak visibility harder to excuse as cryptographic transparency will become part of federal supply chain security. Revise SLAs and procurement agreements to ask vendors to disclose their own products’ CBOMs. CBOMs for legacy hardware will likely be unobtainable and will either require a waiver or hardware replacement or firmware upgrade. Because of SBOMs and self-attestation work by CISA and GSA, there is already a centralized portal and process that can be re-used to collect CBOMs cross agency.

Take Note If Owning Or Operating National Security Systems

Section 5 of the order explicitly calls for the NSA to submit a report to the President through the Committee on National Security Systems (NSS) within 180 days and annually after that on the status of PQC migration for agencies that own or operate NSS.

What this means: If your agency runs both FISMA and NSS systems, you now have two migration regimes with different owners, deadlines, and reporting chains. NSA’s CNSA 2.0 published in 2022 already drives NSS on a timeline of legacy gear phased out by 2030 and full migration by 2035. The danger is the seam between them: duplicated inventory work, inconsistent tooling, and cryptographic dependencies that cross the boundary and go unmanaged because each side assumes the other owns them. Stand up coordination for your migration plans.

Lessons To Come From The NIST Pilot Will Shape Expectations

The EO directs NIST to initiate a PQC migration pilot within 180 days on an appropriate subset of NIST-owned or NIST-operated information systems and complete it no later than December 31, 2027.

What this means: This pilot will likely influence how agencies understand feasible scope, migration sequencing, validation methods, and implementation risks. Federal security leaders should track the pilot closely because it may become an important reference point for what good execution looks like.

There Are Deadlines And Not Necessarily Dollars To Match

The order is to be implemented “subject to the availability of appropriations,” and its procurement section leans on cost savings through cloud migration, shared procurement of PQC tools, joint training, and centralized technical support rather than new funding.

What this means: In the absence of a dedicated funding stream, the migration will compete against everything else in your security budget. Plan to draw on the shared procurement and training vehicles the order sets up rather than standing up your own. Understand where your vendors’ quantum migration work will reduce what you need to do yourselves.

The Clock Has Started

Forrester clients can check out the full initiative blueprint to help drive their quantum security migration, or schedule a guidance session or inquiry with us.