Executive Order 14412 — United States¶

us-eo14412 · pack version 1.0.0 · ✅ Verified

Who this binds¶

EO 14412 directs OMB to require agencies to transition High Value Assets and high impact systems, "excluding National Security Systems" (§4(b)(i)). It is not a blanket federal PQC mandate, it does not reach federal IT generally, and it reaches the private sector only through a FAR rule that is still only proposed. NSS are covered by CNSA 2.0 instead.

Notes¶

VERIFIED 2026-09-06 against the Federal Register text, 91 FR 38483, document 2026-12909, published June 25 2026 (signed June 22 2026). The order never uses the word "hybrid" — its silence is verified, not assumed. Not encoded as a rule, because it is about the ecosystem rather than about any asset: §5(d) requires CISA, within 270 days (by roughly 2027-03-19), to "release public guidance describing the agencies' considered view as to the minimum elements for a cryptographic bill of materials", elements that "shall enable the automated assessment of the cryptographic assets utilized by a hardware or software element". Directly relevant to this tool's input format; watch for it. A rule with no selector would fire on every asset and mask real findings, so it stays here.

Rules¶

✅ `eo14412-key-establishment-2030`¶

§4(b): OMB guidance shall require each agency to "transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030".

Binding: executive_order · Verdict: FAIL · Hybrid: silent · Rationale: harvest_now_decrypt_later · Deadline: 2030-12-31 (complete)

§1: "adversaries collecting United States information now, and decrypting it later once large-scale quantum computers are operational."

Migration target: ML-KEM-1024

Source: EO 14412, Securing the Nation Against Advanced Cryptographic Attacks, §4(b)(ii) — 91 FR 38483 — Signed 2026-06-22, published 2026-06-25 Verified: 2026-09-06 by Sadjad Asadi

✅ `eo14412-signatures-2031`¶

§4(b): OMB guidance shall require each agency to "transition all HVAs and high impact systems to use PQC for digital signatures by December 31, 2031" — one year later than key establishment.

Binding: executive_order · Verdict: FAIL · Hybrid: silent · Rationale: unstated · Deadline: 2031-12-31 (complete)

The clearest primary-source evidence for the urgency asymmetry: one order, one population, one sentence apart, and signatures get an extra year. The order gives no reason, so the rationale stays unstated — the inference is ours, not the document's.

Migration target: ML-DSA-87

Source: EO 14412 §4(b)(iii) — 91 FR 38483 — Signed 2026-06-22, published 2026-06-25 Verified: 2026-09-06 by Sadjad Asadi

✅ `eo14412-far-contractors-2030`¶

§5(c): within 180 days the FAR Council "shall publish a proposed rule amending the Federal Acquisition Regulation (FAR) to require covered contractors to comply by December 31, 2030, with NIST's FIPS, including all applicable FIPS incorporating PQC compliant algorithms."

Binding: executive_order · Verdict: WARN · Hybrid: silent · Rationale: policy_alignment · Deadline: 2030-12-31 (complete)

A proposed rule is not yet a contractual obligation, so this stays WARN rather than FAIL despite the executive_order binding. Revisit when the final rule publishes.

Source: EO 14412 §5(c) — 91 FR 38483 — Signed 2026-06-22, published 2026-06-25 Verified: 2026-09-06 by Sadjad Asadi

Sourcing, open questions and the verification log for this pack are in Policy sources.