NSA Sets Post-Quantum Dates for National Security Systems: New Systems From 2027, Legacy Out by 2030

On October 1, 2026 the US National Security Agency announced post-quantum cryptography measures for National Security Systems under Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, and Committee on National Security Systems Policy 15. From 2027, new commercial National Security Systems must support quantum-resistant algorithms. Legacy systems that cannot support quantum-resilient algorithms are to be phased out by 2030.

The measures apply to National Security Systems, the US Department of War and the defence industrial base. The NSA points suppliers to a new Post-Quantum Cryptography Resource Hub, its Cybersecurity Collaboration Center services for the defence industrial base, and its Zero Trust Implementation Guidelines.

Our take

These dates are written for US national security systems, but they land in Canada through the equipment and the contracts. Canadian suppliers to US defence programs will see 2027 capability requirements in their bids, and Canadian operators buy the same firewalls, VPN gateways and routers from vendors who sell into those systems. Anything bought from 2027 on should support quantum-resistant algorithms, and anything that cannot be upgraded by 2030 is on a clock. The first step is the same on either side of the border: know which of your devices fall into which group. Start your Discovery Program.