IN Brief:
- The US has set timelines for agencies to migrate high-value and high-impact systems toward post-quantum cryptography.
- Contractor requirements are expected to follow through procurement rules and cryptographic bill-of-materials guidance.
- Defence manufacturers will need to map cryptography across embedded systems, software, communications, test equipment, and supplier networks.
The US has set new deadlines for federal systems and contractors to move toward post-quantum cryptography, taking quantum-safe encryption from specialist cyber policy into defence procurement and supply-chain planning.
The executive order directs federal agencies to prepare for migration to National Institute of Standards and Technology-approved post-quantum cryptographic standards. Agencies are expected to assign migration leads, develop plans, and transition high-value and high-impact systems to quantum-resistant key establishment by the end of 2030 and digital signatures by the end of 2031. Procurement rule changes are expected to bring covered contractors into the same transition path.
For defence manufacturers, the contractor element carries the greatest practical weight. Post-quantum migration will not stop at government data centres. It will move through prime contractors, subcontractors, software suppliers, embedded-system vendors, secure communications providers, and companies maintaining long-life platforms. The operational work begins with identifying where cryptography exists, which algorithms are used, whether systems can be updated, and how compliance can be demonstrated during procurement.
That is a large industrial task. Modern defence production uses cryptography across design tools, manufacturing execution systems, product lifecycle management platforms, secure boot processes, code signing, engineering data exchange, remote maintenance, tactical radios, datalinks, cloud environments, and classified collaboration systems. Some of those systems can be patched. Others are embedded in hardware, qualification baselines, or deployed platforms with long certification cycles.
Cryptographic bills of materials should bring structure to the work, but they will also reveal how little many organisations know about their own security dependencies. A software bill of materials can identify components; a cryptographic inventory has to identify algorithms, key lengths, certificates, libraries, protocols, firmware dependencies, and expiry practices. In defence manufacturing, that information may be spread across engineering, IT, cyber, product teams, quality assurance, and suppliers.
The long deadline should not encourage delay. Defence platform lifecycles are measured in decades. A system entering production now may still be operational long after quantum-capable threats become relevant. Communications hardware, weapons interfaces, mission computers, manufacturing test equipment, and maintenance terminals all need upgrade routes. Where those routes do not exist, procurement teams will need to decide whether to redesign, isolate, replace, or carry risk.
Cyber assurance is becoming inseparable from defence manufacturing. The same trend is visible in recent work around AI-enabled cyber risk and defence software guidance, where security expectations are moving deeper into engineering processes. Post-quantum migration belongs in that same shift. Buyers increasingly want evidence that a system’s software, data handling, cryptographic architecture, and update mechanisms can survive future threat conditions.
The US timelines will also affect allied suppliers. UK, European, and APAC companies selling into US defence programmes may face post-quantum requirements through contract clauses, flow-down obligations, export programmes, and joint development work. Even suppliers outside the US market are likely to feel pressure as NATO and partner nations align cyber and supply-chain expectations around long-life systems.
The production impact will vary sharply by company size. Large primes can build migration programmes, appoint cryptography leads, and construct internal inventories. Smaller suppliers may struggle, particularly if they provide embedded components, firmware, sensors, or test equipment with limited update capability. Unless guidance, tooling, and procurement language are made practical, post-quantum compliance could become another barrier for SMEs entering defence supply chains.
The shift also creates industrial opportunity. Companies able to offer quantum-safe communications modules, crypto-agile embedded architectures, secure update systems, and automated cryptographic inventory tools will find growing demand. Crypto-agility — the ability to change algorithms and security components without redesigning an entire platform — is likely to become a valued engineering characteristic.
Post-quantum cryptography is often discussed in abstract language, but the defence industrial task is concrete. It involves certificates, firmware, procurement clauses, supplier evidence, test benches, radios, production networks, and systems that cannot be casually patched. The US deadlines give the sector a clock, and suppliers that start mapping cryptography now will be better placed when compliance moves from guidance into contracts.
