On January 16, 2025, President Joe Biden signed Executive Order 14144, “Strengthening and Promoting Innovation in the Nation’s Cybersecurity.” The order, issued four days before the end of the Biden administration, contained the first direct post-quantum cryptography (PQC) migration deadlines embedded in a federal executive order.
Section 6(f) of the order directed the Cybersecurity and Infrastructure Security Agency (CISA) to publish, within 180 days, a list of product categories in which PQC-capable solutions are widely available. Agencies were then given 90 days from a product category being placed on the list to require PQC support in any new solicitations for products in that category. The order also required agencies to implement PQC or hybrid key establishment as soon as practicable on networks already supporting it.
The order further directed the Secretary of Defense (for National Security Systems) and the Director of the Office of Management and Budget (for non-National Security Systems) to each issue requirements, within 180 days, for agencies to support Transport Layer Security protocol version 1.3 or a successor version no later than January 2, 2030. The Departments of State and Commerce were ordered to engage foreign governments and industry groups in key allied countries to encourage adoption of NIST PQC standards within 90 days.
Executive Order 14144 built upon the cybersecurity framework established by Executive Order 14028 of May 2021 and the National Cybersecurity Strategy, as well as National Security Memorandum NSM-10 of 2022 which first designated PQC migration as a national priority. Because the order was issued in the final days of the Biden administration, its implementation fell to the incoming Trump administration. The order was not included on President Trump’s Inauguration Day list of revoked executive orders.