Are You a Covered Contractor? Post-Quantum Compliance for the Federal Supply Chain

If your company sells software, hardware, or services to the US federal government, a new clause is heading for your contracts, and most vendors are not ready for it. On June 22, 2026, Executive Order 14412 started a 180-day clock for a Federal Acquisition Regulation rule that will require covered contractors to meet NIST post-quantum FIPS standards by December 31, 2030. A second rule will require them to report cryptographic weaknesses, including the use of non-FIPS-approved algorithms.

So the question every supplier to the government should be asking now is short and uncomfortable: are we a covered contractor, and if the rule lands the way the order describes, can we meet it on time?

Quick Answer: Are You a Covered Contractor Under EO 14412?

You are likely a covered contractor if your company sells software, hardware, or services to the US federal government, whether directly or as a subcontractor to a prime. The pending FAR rule will require covered contractors to meet NIST post-quantum FIPS standards by December 31, 2030. Until the rule is finalized, the safe assumption is that you are in scope, and the right move is to start the inventory and migration work now rather than wait for the final text.

What Is a Covered Contractor?

A “covered contractor” under Executive Order 14412 is a federal contractor that the forthcoming Federal Acquisition Regulation (FAR) rule will require to meet NIST post-quantum FIPS standards by a set deadline. In plain language, it is a company the rule will hold to the post-quantum FIPS deadline because of what it sells to the federal government.

The order directs the FAR Council to publish, within 180 days, a proposed rule requiring covered contractors to comply with NIST FIPS, including the post-quantum algorithms, by December 31, 2030. The rulemaking itself will define the precise boundary: which contract types, thresholds, and product categories are in scope and which are not. That is the part to watch.

Two things are worth saying clearly. First, the clock is real: the FAR Council has 180 days from June 22, 2026 to publish the proposed rule. Second, the rule is proposed, not final, so anyone telling you they know the exact scope today is guessing. The honest posture is to assume you may be in scope if you sell to the government directly or indirectly, and to prepare on that basis rather than wait for the final text. The FAR generally applies to vendors selling into US procurement regardless of nationality, so non-US contractors should assume they may be in scope too.

If you sell to the federal government, post-quantum readiness is about to become a condition of the contract, not a nice-to-have.

Key Takeaways

• The FAR Council has 180 days from June 22, 2026 to propose the contractor PQC rule.
• The proposed contractor deadline is to comply with NIST post-quantum FIPS by December 31, 2030.
• A second proposed rule, due within 270 days, adds vulnerability disclosure requirements covering cryptographic flaws and the use of non-FIPS-approved algorithms.
• Scope likely reaches non-US contractors that sell into US public procurement.
• Post-quantum capability becomes a condition of federal market access, which pulls the requirement down the supply chain.

What Are the Two Proposed FAR Rules?

The order points at two separate rules, and they do different jobs. One sets the cryptographic standard you have to meet. The other makes sure weaknesses get reported. They also run on separate clocks.

Proposed rule	What it would require	Timing
Rule 1: PQC FIPS compliance	Covered contractors comply with NIST FIPS, including the post-quantum standards FIPS 203, 204, and 205, by December 31, 2030.	Proposed rule due within 180 days of June 22, 2026
Rule 2: Vulnerability disclosure	Contractor vulnerability disclosure policies, aligned to NIST guidance, must accept reports of cryptographic weaknesses, including missing encryption and the use of non-FIPS-approved algorithms.	Proposed rule due within 270 days of June 22, 2026

Read together, the two rules do more than set a deadline. The first says your products and systems must use approved post-quantum cryptography. The second says you have to be able to surface where they do not, including places that still run non-FIPS-approved algorithms or no encryption at all. You cannot satisfy either one without first knowing, in detail, what cryptography your products actually contain.

Why Does This Reach Beyond Direct Contractors?

It is tempting to read this as a problem only for the primes, the companies that hold the contract directly. It is not, for two reasons.

The first is the market forcing function. To keep selling to the government, vendors have to ship products that use post-quantum cryptography, and once a product is built that way, it tends to become the default for commercial buyers too. The federal deadline quietly sets the bar for everyone.

The second is the mechanics of federal contracting. FAR requirements typically flow down through subcontracts, so suppliers and subcontractors inherit obligations from the prime above them. A small vendor with no direct federal contract can still find the requirement written into a purchase order from a customer who does.

The rule names direct contractors. Flow-down clauses, and the market, name almost everyone behind them.

How Do You Map Each Requirement to Ownership and Evidence?

Each proposed requirement needs an owner, a control, and proof it happened. Treat the table below as a starting checklist for building your own audit-ready record.

Requirement	Cryptographic control needed	Accountable owner	Evidence artifact
Meet NIST FIPS PQC standards by December 31, 2030	Migrate key establishment and signing to FIPS 203, 204, and 205	CISO or head of security engineering	Cryptographic inventory mapped to FIPS status, with migration dates
Report cryptographic weaknesses (vulnerability disclosure rule)	A vulnerability disclosure policy scoped to accept cryptographic findings	Product security or VDP owner	Published VDP text and an intake log of cryptographic reports
Confirm whether you are in scope at all	A contract review process covering direct and flow-down obligations	Legal or contracts, working with security	A list of active and pipeline federal agreements and their flow-down clauses
Show that weak algorithms have been identified	Algorithm risk classification against FIPS and quantum-vulnerability status	Security architecture	An inventory report flagging non-FIPS and quantum-vulnerable algorithms
Demonstrate migration progress to auditors or federal customers	A funded, sequenced migration roadmap	PQC program owner	A roadmap document with milestones, owners, and dependencies

How Should You Prepare Before the Rule Is Final?

You do not need the final text to start the work that matters, because the first steps are the same under any reasonable version of the rule.

1. Confirm your exposure: Establish whether you sell, directly or indirectly, into federal contracts, and where flow-down clauses might already reach you.
2. Inventory your cryptography: Build a cryptographic inventory, a CBOM, of the algorithms, keys, and certificates in your products and systems. You cannot certify what you have not cataloged.
3. Flag the gaps: Identify non-FIPS and quantum-vulnerable algorithms, since those are exactly what both proposed rules target.
4. Plan the migration: Map a path to the NIST post-quantum standards, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), prioritizing the products closest to federal use.
5. Stand up a disclosure policy: Put a vulnerability disclosure policy in place, aligned to NIST guidance, that can receive and act on reports of cryptographic weaknesses.

None of this is wasted effort if the scope narrows. A current inventory, a migration plan, and a disclosure policy are what every version of this rule will expect, and they are useful for the EU and commercial requirements arriving on the same timeline.

What Are the Limitations of This Guidance?

• The FAR rule is still proposed, not final. Scope, thresholds, and exact wording can change before it is published and again before it is adopted.
• This guidance does not cover National Security Systems, which are handled separately under NSA oversight rather than through the standard agency and contractor requirements.
• It is not a substitute for legal review of your specific contracts. Flow-down obligations vary by agreement, and only your contracts counsel can confirm what applies to you today.
• It does not address parallel state, EU, or industry-specific cryptography mandates, which may carry different timelines and requirements than the federal rule described here.

How Can Encryption Consulting Help?

Becoming a defensible covered contractor is a program, and Encryption Consulting runs it end to end. Compliance Advisory maps your federal obligations and gets you ready for the FAR and FIPS requirements, so you know what the rule will expect and where you stand against it. CBOM Secure inventories the cryptography inside your products and systems and flags the non-FIPS and quantum-vulnerable algorithms the rules target. PQC Advisory plans and sequences the migration to FIPS 203, 204, and 205, and our code signing and FIPS-validated HSM services back the parts of your stack that need validated cryptography.

Related Reading

For a complete, section-by-section breakdown of everything Executive Order 14412 requires, including the agency-side deadlines and the cryptography bill of materials mandate, see The Quantum Deadline Is Not Your Real Problem. If you are a federal agency executing your own migration rather than a contractor selling into one, see PQC for Government and Defense: From Inventory to CNSA 2.0 Execution.

Conclusion

Covered contractor status is a scope question the FAR rulemaking will ultimately settle. But the work that answers it, a cryptographic inventory, a migration plan, and a vulnerability disclosure policy, is the same work you would need to do anyway. The first step is the same one the rules will demand: know exactly what cryptography your products contain, then close the gaps on a schedule you control rather than one set by a deadline. Vendors who start now will meet the December 2030 deadline on their own terms. Those who wait for the final rule text will be racing it.

Frequently Asked Questions

Do I need to wait for the final FAR rule before doing anything?

No. The core work, building a cryptographic inventory, identifying non-FIPS and quantum-vulnerable algorithms, and standing up a vulnerability disclosure policy, is required under every plausible version of the rule. Waiting for the final text only compresses the time you will have to act once it is published.

What happens if my company misses the December 2030 deadline?

The order itself does not spell out specific penalties, since that detail belongs to the FAR rule the Council is still drafting. In practice, FAR compliance clauses are typically tied to contract eligibility and to the representations vendors make when bidding, so missing the deadline puts continued access to federal contracts, and to prime contractors’ subcontractor pools, at risk.

Does this apply if I only sell to civilian agencies, not defense?

Yes. The FAR rule applies government-wide, not just to defense procurement. If your product or service reaches any federal agency through a covered contract, the pending rule is written to reach you regardless of whether the buying agency is civilian or defense.

How is this different from CMMC or CNSA 2.0?

CMMC governs cybersecurity practices for defense contractors that handle controlled unclassified information, and CNSA 2.0 is the NSA’s cryptographic suite for National Security Systems. The FAR rule under Executive Order 14412 is broader: it reaches civilian and defense contractors government-wide through the FAR itself, though the obligations can overlap for suppliers who fall under more than one framework.

What should a subcontractor do if the prime hasn’t raised this yet?

Do not wait for the prime to bring it up. Flow-down clauses often arrive with little notice once a rule is final, and building your inventory and migration plan independently means you can answer the question when it comes rather than scrambling after it does.