On June 6, 2025, President Trump signed Executive Order 14306, titled “Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144.” The order amended rather than revoked the Biden administration’s January 2025 cybersecurity executive order (EO 14144), performing targeted line edits to PQC and other cybersecurity provisions.
The order retained the core finding that a cryptanalytically relevant quantum computer (CRQC) will be capable of breaking much of the public-key cryptography used on digital systems across the United States and around the world. It explicitly preserved National Security Memorandum 10 (NSM-10) of May 2022 as the foundational directive for federal PQC transition.
Two PQC-specific deadlines were set or retained. By December 1, 2025, the Secretary of Homeland Security, acting through CISA and in consultation with the NSA, must release and regularly update a list of product categories in which PQC-supporting products are widely available. By January 2, 2030, the NSA (for national security systems) and the Director of OMB (for non-national security systems) must issue requirements for agencies to support TLS 1.3 or a successor version.
The order removed several provisions from EO 14144, including the requirement that agencies include PQC support in solicitations within 90 days of a product category being listed by CISA, the directive that agencies implement PQC key establishment “as soon as practicable,” and provisions directing the State and Commerce Departments to engage with foreign governments and industry groups on PQC adoption. According to the Congressional Research Service, the order “established policies to reduce the involvement of federal agencies in shaping the nation’s cybersecurity posture while also giving the private sector greater influence.”