Does United States have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Office of Management and Budget (OMB), Executive Office of the President.

What is United States's PQC migration deadline?

2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Office of Management and Budget (OMB), Executive Office of the President.

Does United States require a Cryptographic Bill of Materials (CBOM)?

Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.

USRegulated

United States

The US mandates PQC migration for federal civilian agencies via OMB Memorandum M-26-15, with a concrete five-phase timeline running through full migration by 2035 and an automated cryptographic inventory/CBOM required as the foundation of each agency's mandatory migration plan.

United States's post-quantum cryptography posture is classified as regulated, led by Office of Management and Budget (OMB), Executive Office of the President, with a migration target of 2035. It scores 70/100 on this tracker's rubric, one of the more binding and actively enforced rules on this tracker, and that is not a measure of how secure or advanced the country actually is.

What's verified

OMB Memorandum M-26-15 ("Execution of the Migration to Post-Quantum Cryptography," June 24, 2026, signed by OMB Director Russell T. Vought) implements Executive Order "Securing the Nation Against Advanced Cryptographic Attacks" (June 22, 2026) and OMB's guidance duty under the Quantum Computing Cybersecurity Preparedness Act. It establishes a five-phase migration timeline for federal civilian agencies (national security systems are explicitly excluded): Phase 1 Strategy/Planning/Discovery (2026-2027), Phase 2 Pilots and Early Migration (2027-2028), Phase 3 Prioritized Migration (2028-2030), Phase 4 Signature Migration (2031), and Phase 5 Full Migration (2035). Each agency must submit a PQC Migration Plan to OMB and ONCD within 120 days of the memo, built on a dynamic, continuously updated automated cryptographic inventory (feeding a central Cryptographic Bill of Materials) as its foundation. Appendix A sets crypto-agility as an explicit architectural principle/objective, alongside guidance on algorithm selection (FIPS 203/204/205), hybrid architectures, TLS 1.3, and zero-trust integration. The memo also sets an objective to mitigate as much quantum risk as feasible by December 31, 2030.

Other official sources

The White House (Executive Office of the President), Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks" (June 22, 2026), scoring 60/100 on this rubric. Executive Order 14412 (June 2026) directs CISA and NIST to publish CBOM minimum-elements guidance within 270 days and sets hard PQC migration deadlines of Dec 31, 2030 (key establishment) and Dec 31, 2031 (digital signatures), but only for designated federal high-value assets and high-impact systems, with no stated enforcement penalties.
National Institute of Standards and Technology (NIST) / NCCoE, NIST SP 1800-38, "Migration to Post-Quantum Cryptography" Practice Guide (NCCoE), scoring 20/100 on this rubric. NIST's NCCoE SP 1800-38B frames cryptographic discovery as step 2 of a voluntary, non-binding four-step PQC readiness roadmap. It is a technically detailed, CBOM-aligned inventory architecture, but with no statutory mandate, no deadline, no defined regulatory scope, and no enforcement mechanism.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	M-26-15 is an OMB memorandum implementing an Executive Order and a statutory guidance duty (Quantum Computing Cybersecurity Preparedness Act), binding on federal civilian agencies only (national security systems explicitly excluded), with no penalties cited in the source. It is a binding mandate for a defined subset, scoring 10.
Deadline concreteness	20/20	The source publishes specific year/date milestones: five phases with exact ranges (2026-2027, 2027-2028, 2028-2030, 2031, 2035) plus a December 31, 2030 risk-mitigation objective, meeting the 20 standard of specific years published.
Scope of coverage	10/20	Coverage is limited to federal civilian executive agencies under OMB/ONCD, a specific regulated-government sector rather than economy-wide or all critical infrastructure, and national security systems are explicitly excluded, matching the 10 standard for a specific sector only.
Inventory/CBOM requirement	20/20	The memo explicitly names an automated, continuously-updated cryptographic inventory as the foundation of each agency's required PQC Migration Plan, feeding a central Cryptographic Bill of Materials. This is an explicit CBOM/inventory mandate, scoring 20.
Regulatory activity	10/20	OMB (with ONCD) is the named authority requiring migration plans within 120 days and providing technical guidance, but the source describes no fines, audits, or certification enforcement mechanism, matching the 10 standard of a named authority without visible enforcement teeth.
Total	70/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Federal Reserve (Board of Governors)
Not yet addressed, a gap to watch
Not yet addressed directly. Its Supervision and Regulation (SR) letter index has no letter addressing PQC or cryptographic inventory; the only Fed-hosted document on the topic is a FEDS staff research paper, explicitly disclaimed as not representing Board views or guidance.
OCC (Office of the Comptroller of the Currency)
Not yet addressed, a gap to watch
Not yet addressed directly. No bulletin addresses PQC or cryptographic inventory. A widely repeated claim that OCC issued PQC guidance in December 2022 could not be traced to any actual OCC bulletin or rule.
FDIC (Federal Deposit Insurance Corporation)
In progress, no guidance yet
No Financial Institution Letter across 2024-2026 addresses PQC as a formal requirement, but FDIC's 2025 Report on Cybersecurity and Resilience goes well beyond a passing mention: it explicitly discusses "harvest now, decrypt later," and discloses that FDIC's 2024 horizontal examinations of significant service providers specifically evaluated "risks associated with developments in quantum computing." This is real, dated supervisory activity, not yet a binding PQC/CBOM standard.
2025 Report on Cybersecurity and Resilience →Read the full breakdown →
SEC (Securities and Exchange Commission)
Not yet addressed, a gap to watch
Not yet addressed directly. Neither the 2023 cybersecurity disclosure rule nor its accompanying guidance mentions post-quantum cryptography or cryptographic inventory.
FFIEC (Federal Financial Institutions Examination Council)
Not yet addressed, a gap to watch
Not yet addressed directly. FFIEC co-hosted a non-public forum with CISA on PQC in September 2022, but no published FFIEC guidance document resulted from it.

FAQ: United States and PQC

Does United States have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Office of Management and Budget (OMB), Executive Office of the President.
What is United States's PQC migration deadline?: 2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Office of Management and Budget (OMB), Executive Office of the President.
Does United States require a Cryptographic Bill of Materials (CBOM)?: Yes, explicitly. The primary sources listed on this page name a cryptographic inventory requirement functionally equivalent to a CBOM.