PQC Readiness for Manufacturing:

Overview

Every framework in this guide points in the same direction: know what cryptography you have, prove you control it, and be ready to change it. Post-quantum cryptography is where that direction gets a deadline. 

In 2024, NIST finalized the first three post-quantum cryptographic standards and published a transition timeline that deprecates the RSA and elliptic curve algorithms underpinning most industrial infrastructure by 2030, with full disallowance targeted for 2035. In June 2026, Executive Order 14412 converted that technical guidance into federal policy. The order directs OMB and the National Cyber Director to lead an accelerated national migration, requires agencies to transition high value assets to PQC by 2030 or 2031 depending on use case, and sets a Department of Commerce migration pilot for completion by the end of 2027. 

For manufacturers, two provisions matter most. First, the order directs the FAR Council to require covered federal contractors to meet PQC-aligned cybersecurity standards and vulnerability disclosure policies by the end of 2030, extending the migration obligation into the supply chain. Second, it directs CISA, in coordination with NIST, to publish minimum elements for a cryptographic bill of materials (CBOM): a machine-readable inventory of the cryptographic assets in any hardware or software element. If the CBOM follows the trajectory of the software bill of materials, it will move from federal procurement requirement to standard commercial expectation. 

Why it matters 

An executive order is not a conformance standard, and manufacturers will not be audited against EO 14412 directly. Its significance is what it signals: the questions this guide has raised in every section now have dates attached. 

The economics of manufacturing make those dates closer than they look. A PLC commissioned this year will still be running when RSA and ECC are formally disallowed. Proprietary process data and control-plane traffic encrypted today can be harvested now and decrypted once quantum capability arrives, which means the sensitivity horizon of the data, not the delivery date of a quantum computer, sets the deadline. And procurement moves faster than regulation: federal buyers, critical infrastructure operators, and prime contractors will begin asking suppliers for PQC migration plans and cryptographic inventories well before any rule requires them to. 

The CRA’s cryptographic component visibility expectations, IEC 62443’s algorithm inventory requirements, NIS2’s cryptography policy mandate, and SP 800-82’s key lifecycle documentation all converge on the same foundation the CBOM formalizes. Organizations that build that foundation once will satisfy all of them. 

How this maps to cryptography 

Readiness questions

PQC migration reviews, whether initiated by a federal customer, a prime contractor, or an internal risk function, focus on whether the organization knows its exposure and has a governed plan. Key areas assessors will probe: 

• Cryptographic inventory completeness: Can the organization enumerate every certificate, key, algorithm, and cryptographic library in use across IT, OT, and shipped products, including inherited dependencies? 

• Quantum vulnerability classification: Has the inventory been assessed against the NIST deprecation schedule, with quantum-vulnerable assets identified and ranked by data sensitivity and asset lifespan? 

• Migration plan and ownership: Is there a named owner, a documented migration plan, and a timeline aligned to the 2030 deprecation and 2035 disallowance dates? 

• Long-lived asset strategy: For devices that will outlive current algorithms and cannot be re-keyed in the field, are compensating controls or replacement plans documented? 

• CBOM production capability: Could the organization produce a cryptographic bill of materials for its products today if a federal customer requested one? 

• Supplier PQC posture: Are component and software suppliers being assessed for their own migration plans, given that inherited cryptography becomes the manufacturer’s exposure?

TAKE THIS TO MANAGEMENT

The post-quantum transition now has federal dates attached: NIST deprecates today’s core algorithms by 2030, and Executive Order 14412 requires federal contractors to meet PQC-aligned standards by the end of that year. Our industrial systems and the products we ship will still be in service well past both dates, so the cryptographic decisions we make now determine whether we meet them.

The practical first step is the same one every framework in this guide asks for: a complete cryptographic inventory. The order’s cryptographic bill of materials concept will formalize that expectation for anyone selling into federal supply chains, and commercial customers will follow. If we build the inventory, assessment, and lifecycle automation now, PQC becomes a managed migration on our schedule rather than a scramble on someone else’s.