No New Money, No New Spec: Reading Past the Quantum EO Headline

Research evidence excerpt

No New Money, No New Spec: Reading Past the Quantum EO Headline

to OMB. The teeth

sit in procurement: a FAR Council rule will require covered contractors to comply with NIST FIPS (including PQC algorithms) by

December 31, 2030, with NIST piloting its own migration by year-end 2027. We remind investors a White House paper notedINDUSTRY federal migration costs estimated at $7.1 billion, but when combining CISA and NSS agencies we continue to believe total spend

is estimated to be closer to $20 billion through 2035.

■ NSM-10 (May 4, 2022) sets 2035 as the policy ceiling for full federal NSS quantum resistance.REPORT ■ OMB M-23-02 (November 18, 2022) mandates annual cryptographic inventories from federal agencies through 2035,

prioritized by HVAs. White House July 2024 report estimated $7.1 billion total federal migration costs from 2025-2035.

■ NAS CNSA 2.0 (September 2022, FAQ updated December 2024): the binding NSS procurement framework. Includes the

following timeline:

■ 2025: software/firmware signing should prefer CNSA 2.0 (LMS/XMSS)

■ Jan 1, 2027: all new NSS acquisitions must be CNSA 2.0 compliance (the key gate)

■ 2030: all deployed NSS software/firmware signing must use CNSA 2.0; legacy networking gear that cannot be upgraded

must be phased out

■ 2031: mandatory exclusive CNSA 2.0 use for general NSS cryptography, with limited niche exceptions

■ 2033: final on-ramp for niche/constrained systems and large PKIs

■ 2035: full NSS quantum resistance under NSM-10

■ EO 14144 (Jan 16, 2025): required CISA to publish PQC product categories (done Jan 23, 2026, "Product Categories for

Technologies That Use Post-Quantum Cryptography Standards" list)

■ see follow-on order EO 14306, June 6, 2025: bifurcating IT into "widely available" categories (cloud PaaS/IaaS, browsers,