Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks

What does Executive Order 14412 do?

The text directs Agencies to update cryptographic inventories and migration plans, and NIST to maintain standards and implementation guidance.

Reading the operative provisions of Executive Order 14412

EO 14412 directs agencies to identify cryptographic systems that could be vulnerable to future quantum attacks and prioritize migration to post-quantum cryptography. It asks NIST to maintain standards and implementation guidance and agencies to prepare inventories and plans. The Federal Register text of EO 14412 sets federal transition tasks; it does not mean that a cryptographically relevant quantum computer is currently breaking every protected system.

Post-quantum algorithms are designed to resist attacks from both conventional and future quantum computers. Transition planning is complex because cryptography is embedded in websites, identity systems, devices, software updates and long-lived records. Agencies need to inventory where encryption is used, prioritize systems by sensitivity and expected lifetime, and test replacements for performance and interoperability.

Crypto-agility—the ability to replace an algorithm without rebuilding an entire system—can reduce future transition costs. NIST standards provide a technical foundation, but agencies must validate implementations and manage key migration. Critical infrastructure operators have separate legal and operational responsibilities, so federal guidance may inform rather than directly control their systems. The order’s success should be assessed through completed inventories, tested migrations and clear plans for suppliers and legacy equipment.

Long-lived encrypted records create a “harvest now, decrypt later” concern: an adversary could store data today in hopes of decrypting it with future capabilities. Agencies should therefore prioritize sensitive information that must remain confidential for many years. Migration also requires replacing hardware that cannot support new algorithms and coordinating updates across suppliers. Risk ranking helps agencies act before a complete inventory is possible.