It’s easy to read the latest federal post-quantum cryptography requirements and assume they don’t apply to your organization. The language is aimed at federal agencies and the contractors that support them. So if you’re not a federal agency—or signing prime contracts with one—it may feel like post-quantum cryptography is a distant compliance issue, not an immediate business priority. But that’s a risky assumption.
Why This Isn’t Just a Federal Problem
For many organizations, the first real deadline won’t arrive as a direct regulatory mandate. It will arrive as a customer question, supplier requirement, cybersecurity questionnaire, contract clause, or insurance renewal. Post-quantum expectations will move through the same channels that already shape cybersecurity requirements across supply chains. By the time an organization is formally told to comply, its customers and partners may already be asking for proof of progress.
That’s because cryptographic risk doesn’t stop at the edge of the federal enterprise. Today’s organizations rely on sprawling ecosystems of software vendors, cloud services, managed service providers, suppliers, consultants, and technology partners. Sensitive information moves across those relationships, and the systems that protect it may be owned, operated, or updated by third parties. As federal agencies execute post-quantum migration plans, they’ll need vendors and partners to show that the products and services they provide can support the transition.
How Federal Policy Becomes Supply Chain Pressure
The public signal is already clear. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, directs federal agencies to transition to NIST-approved Federal Information Processing Standards for post-quantum cryptography and sets key implementation deadlines around 2030 and 2031. Executive Order 14412 also directs the Federal Acquisition Regulatory Council, working with CISA and NIST, to publish a proposed rule amending the Federal Acquisition Regulation that would require covered contractors to comply by December 31, 2030, with applicable NIST Federal Information Processing Standards incorporating post-quantum cryptography.
While the specific requirements will vary by contract, industry, and customer, organizations should expect these expectations to increasingly influence third-party risk and procurement requirements. Contractual obligations tend to flow downstream because prime contractors depend on subcontractors, technology providers, and service partners to meet their own commitments. A software provider supporting a federal contractor may be asked about its cryptographic inventory. A manufacturer serving a defense supplier may be asked whether its systems can transition to quantum-resistant algorithms. Organizations in healthcare, finance, education, or critical infrastructure may see similar questions through third-party risk programs, even without a direct federal obligation.
“Quantum readiness really starts with visibility. You cannot migrate cryptography you don’t know you have. Before organizations start worrying about replacing algorithms, they need to understand where cryptography exists, what data it protects, how long that data needs to remain confidential, and which vendors and systems they depend on. The organizations that build that inventory now will be in a much better position to respond when a customer, regulator, insurer, or business partner starts asking about post-quantum readiness.” –John Chirillo, Principal Solution Architect at Connection
Four Questions You Must Be Able to Answer
That downstream pressure matters because post-quantum cryptography is not a quick configuration change. Organizations first need to understand what cryptography they use, where it appears, which systems depend on vulnerable public-key algorithms, and which vendors control those systems. Many will find cryptography embedded in places they don’t routinely inspect: network protocols, certificates, identity systems, VPNs, application code, hardware, firmware, cloud workloads, backup systems, APIs, and vendor-managed platforms. Without that visibility, it’s difficult to prioritize risk—or answer basic customer questions with confidence.
The practical conversation often starts with four simple questions. Answering them well requires inventory, ownership, technical planning, vendor coordination, and a credible roadmap for change.
What Cryptography Do You Use?
This question is about discovery. Organizations need to identify the algorithms, protocols, certificates, libraries, and cryptographic modules that protect their data and operations. If encrypted data is collected today and decrypted later by a sufficiently capable quantum computer, the damage may occur years after the data was first exposed. That “harvest now, decrypt later” risk is one reason current guidance emphasizes prioritized migration rather than waiting until quantum computers are fully mature.
Where Does Your Cryptography Exist?
A list of algorithms is not enough. Leaders need to know which business processes, systems, vendors, and data flows depend on them. Cryptography may appear in internal applications, externally hosted services, authentication infrastructure, remote access tools, connected devices, and supplier-managed platforms. If those dependencies are not mapped, it becomes difficult to estimate effort, budget, timing, or operational impact.
Do You Have Crypto-agility?
Crypto-agility means designing systems so cryptographic algorithms can be replaced or adapted without rearchitecting the entire environment or disrupting operations. It is not only a post-quantum concept; it is a resilience concept. Algorithms change, vulnerabilities are discovered, standards evolve, and business requirements shift. Organizations that hard-code cryptography into applications or rely on inflexible legacy systems will face a harder transition.
What Does Your Migration Plan Look Like?
This is where strategy becomes evidence. A credible plan should show how the organization will prioritize systems, coordinate with vendors, update contracts, manage testing, and reduce risk over time. It should identify sensitive data, high-risk systems, and third-party dependencies. Customers will not expect every system to be migrated overnight, but they will increasingly expect a serious plan. Prioritization should also consider how long sensitive data must remain confidential, since information captured today may still have value when cryptographically relevant quantum computing becomes available.
Why Readiness Starts Before the Mandate
For some organizations, the first encounter with the need for post-quantum cryptography may be a contract renewal. For others, it may be a cyber insurance questionnaire, vendor risk assessment, or security review tied to a new opportunity. These requests may not use the same terminology. One customer may ask about post-quantum readiness. Another may ask for a cryptographic inventory. Another may ask whether the organization supports crypto-agility or has a roadmap for replacing vulnerable algorithms. The expectation is the same: know what cryptography your organization depends on and be ready to explain how you’ll manage the transition.
The organizations best positioned for that future will not be the ones that wait for final contract language before acting. They will be the ones that start now: building a cryptographic inventory, identifying high-risk systems, asking vendors about post-quantum roadmaps, and making crypto-agility part of architecture and procurement decisions. Those steps do not require every answer to be final. They require enough visibility and governance to move deliberately instead of reactively.
Post-quantum cryptography may begin as a federal policy milestone, but its impact will reach far beyond federal agencies. The question for many organizations is not whether they are named in the first wave of requirements. It is whether the customers, partners, insurers, and risk programs they depend on will expect them to be ready. Increasingly, the answer will be yes. And when that question arrives, “We are not a federal agency” will not be enough.
As part of our month-long discussion of AI and cybersecurity for Cybersecurity Awareness Month, you can view our recent discussion in a webinar titled AI + Quantum: The Security Threats You Can’t Afford to Ignore. Our Security Center of Excellence team covers how to find the systems, data, and cryptographic dependencies most exposed to future quantum attacks, and how to start prioritizing a move toward post-quantum standards without waiting for every answer to arrive first.
