Statement on executive order to secure the U.S. against advanced cryptographic attacks

Mark Dalton, the policy director of the R Street Institute’s technology and innovation team, has released the following statement:

“The White House has issued an executive order directing federal agencies to migrate high-value systems to post-quantum cryptography (PQC) by 2030 and mandates that federal contractors follow suit.

An upcoming R Street study on this topic advances three findings: PQC migration is a present-day risk management problem, not a future one; prioritization must be driven by data sensitivity and system criticality; and federal leadership is necessary but insufficient. Market forces are already moving, and this represents a strategic opportunity that policy should leverage, not ignore. 

The executive order gets the direction right. It deploys existing executive authority through the Office of Management and Budget  (OMB) and the Cybersecurity and Infrastructure Security Agency (CISA), creates procurement requirements that will send real market signals, and initiates a pilot at the National Institute of Standards and Technology (NIST). The study argues that the next step is to expand those pilots to the Department of Energy (DoE), the Department of Defense (DoD), and the Department of the Treasury to ensure that the feedback loop from the pilots into federal guidance and standards is built in from the start.

The window for proactive migration is narrowing faster than federal planning has acknowledged. This executive order is an important step. The work of implementation is just beginning, and Congress needs to follow with matching budget authority.”