IC Technology & Surveillance — 2026-06-24

Pentagon Publishes Post-Quantum Cryptography Strategy Mandating All DOD Systems Use PQC by 2031

BLUFDoD's 2031 PQC mandate lacks enforcement teeth for the defense industrial base because the FAR Council is unlikely to publish its proposed contractor compliance rule by late December 2026.

The Department of War released its Post-Quantum Cryptography Strategy on June 23, mandating all DoW systems support PQC by December 31, 2030, and use it exclusively by December 31, 2031; National Security Systems must adopt CNSA 2.0 12. DoW CIO Kirsten Davies organized the strategy around five lines of effort spanning governance, cryptographic inventory, technology development, commercial integration, and enterprise deployment across all warfighting domains 23. EO 14409, signed June 22, directs the FAR Council within 180 days to publish a proposed rule requiring federal contractors to comply with NIST FIPS PQC standards by end of 2030 1. A November 18 memo from acting CIO Katie Arrington, released this week, directed DoW components to inventory cryptographic systems, designate migration leads, and bar quantum key distribution for security functions absent a granted exception 4.

Analysis
The FAR Council is unlikely to publish its PQC compliance rule within EO 14409's 180-day window, leaving the Defense Industrial Base without binding contractual enforcement through most of 2027. Moderate confidence reflects the federal regulatory record: comparable rulemaking has not cleared a 180-day bar, and mandatory consultations with CISA, DHS, and NIST add coordination drag the calendar cannot absorb. The official DoW release is independently corroborated by Inside Cybersecurity; trade outlets echo without adding primary sourcing. Absent an enforceable FAR clause, contractors outside existing DoW vehicles face no immediate compliance obligation despite the 2030 deadline, shifting build/buy decisions 12 to 24 months rightward. The Arrington memo's QKD prohibition compresses the migration design space regardless of where rulemaking lands. NSA's institutional interest in sidelining non-NIST-blessed technologies may explain that prohibition as much as any new security determination, with the exception pathway preserved for classified programs already running QKD at scale.

4 sources

Pentagon launches post-quantum cryptography strategy, as Trump executive order looks to reshape civilian agency procurement - Inside Cybersecurity
Securing Global Dominance: DoW Unleashes Quantum Defense Strategy to Harden Networks and Empower the Joint Force - U.S. Department of War
DoW Unveils Quantum Defense to Fortify Networks - Mirage News
Pentagon CIO Orders Rapid Shift to Post-Quantum Crypto - MeriTalk