What the New PQC Executive Order Means for Organizations

With cryptographically relevant quantum computers (CRQCs) expected sooner than anticipated, timelines for the post-quantum transition are moving in. Dell cyber experts walk through key takeaways from recent Executive Order 14412 and how federal requirements will increasingly influence the broader market.

The recent U.S. government  Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, reinforces a reality many organizations are already confronting: post-quantum readiness, cryptographic modernization and supply chain assurance are becoming important imperatives to ensure long-term resilience.

For customers working on their transition to post-quantum cryptography (PQC) and/or tracking CNSA 2.0 (the Commercial National Security Algorithm Suite 2.0 which guides protection of National Security Systems, or NSS), the message is less about a sudden change in direction and more about growing momentum behind a transition that is already underway.

This is more acceleration than disruption

The new order reinforces that existing roadmaps for compliance, resilience and long-term risk reduction are moving in the right direction.

That matters because organizations are asking practical questions now: Does this affect current plans? Have timelines shifted? What should teams prioritize first? For many organizations, the answer is to stay focused on readiness and continue moving forward.

PQC transition is about more than cryptography

PQC transition is often framed as an encryption issue, but its impact is much broader. Post-quantum cryptography, meaning security algorithms designed to resist attacks from future quantum computers, is only one part of the story. The larger mandate also shapes how organizations think about platform design, infrastructure planning, software and firmware visibility, interoperability and long-term security architecture.

In other words, it is part of a broader shift in how secure technology environments are designed, validated and maintained.

Federal requirements will influence a much broader market

While EO 14412 has immediate relevance for federal agencies and organizations supporting government contracts, its broader direction will increasingly shape security expectations for enterprises and growing businesses as procurement standards, partner requirements and modernization strategies evolve.

Federal agencies, federal contractors and critical infrastructure sectors are the most directly affected, but they are not the only ones paying attention. Technology providers, suppliers, partners and regulated enterprises will all feel the downstream impact as security expectations expand across the broader ecosystem.

Timelines are moving in

Cryptographically relevant quantum computers (CRQC) are expected sooner than anticipated. As such, security mandates are expanding and timelines are moving in.

EO 14412 sets new deadlines for all U.S. federal agencies and critical infrastructure operators to migrate High Value Assets (HVAs) and High Impact Systems (HIS) from current quantum-vulnerable algorithms to PQC algorithms, accelerating transition from the previous 2035 target. Now, HVAs and HIS must transition to PQC key establishment schemes by December 31, 2030, and PQC digital signature schemes by December 31, 2031. These dates are more than compliance checkpoints. They signal a long-term transition that will increasingly influence procurement decisions, modernization roadmaps and security planning across federal environments first, and then more broadly across the wider technology ecosystem.

Why customers need to act now, not later

The biggest takeaway is not to wait for a single forcing event. Organizations should use this period to assess dependencies, validate priorities and continue planning for long-term transition requirements.

Practical next steps include:

• • • • Evaluating supply chain and software visibility requirements
      • Inventorying where cryptography is used across the environment
      • Aligning security, IT and procurement teams around a phased transition plan
      • Identifying systems and data that may be most exposed to future quantum risk
      • Reviewing modernization roadmaps against upcoming refresh cycles

The urgency is also shaped by emerging “harvest now, decrypt later” and “trust now, forge later” risks. In the first scenario, attackers can steal encrypted data today and hold it until quantum capabilities can break it in the future. In the second, future quantum attacks could undermine digital signatures and other trust mechanisms that organizations rely on to verify identities, software and communications.

For federal customers, contractors and critical infrastructure sectors, the urgency is more immediate. For enterprises and growing organizations, the opportunity is to prepare early as federal expectations increasingly shape broader market standards.

Dell can help customers navigate the long-term PQC journey

Quantum resilience is not achieved the moment post-quantum cryptography is introduced. It is achieved when quantum-vulnerable algorithms and protocols are fully deprecated across the environments, systems and workflows that protect critical data. That is why the real objective is broader than a cryptography upgrade alone. It is a long-term transition across the full data pathway and lifecycle, from development and supply chain integrity to data at rest and in transit.

Organizations that start now will be in a stronger position not just to meet future requirements, but to build the durable, end-to-end resilience those requirements are designed to create. As post-quantum readiness requirements continue to shape the market, Dell can help customers turn evolving policy and technical requirements into practical action across infrastructure, security and supply chain planning.