On January 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published an initial list of product categories for technologies that use post-quantum cryptography (PQC) standards. The list was issued pursuant to President Trump’s Executive Order 14306 of June 6, 2025, which directed DHS, acting through CISA, to release and regularly update the list. CISA developed it in collaboration with the National Security Agency, according to the CISA press release.
The list classifies product categories into two tiers. The “Widely Available” tier includes categories where PQC-capable products already exist commercially, covering cloud services (IaaS, PaaS), collaboration tools, web software (browsers and servers), and endpoint security products such as full-disk encryption systems. A second “Transitioning” tier identifies categories where PQC adoption is underway but not yet widespread, including networking hardware and software, SaaS platforms, telecommunications equipment, operating systems, storage systems, and identity and access management tools.
To qualify as PQC-enabled, products must implement NIST standards FIPS 203, FIPS 204, and/or FIPS 205. Acting CISA Director Madhu Gottumukkala stated that quantum computing “poses a real and urgent threat to the confidentiality, integrity, and accessibility of sensitive data.” The list was published slightly past the December 1, 2025, deadline originally set by EO 14306.
The list is advisory rather than a binding procurement mandate. Under President Biden’s original EO 14144, agencies would have been required to include PQC requirements in solicitations within 90 days of a product category being listed; EO 14306 removed that automatic trigger. CISA stated it would regularly update the list as the PQC technology market matures, and that categories from the transitioning tier would be moved to the widely available tier in future updates.