Solutions · Regulated
Meet the 2027 acquisition bar before it becomes a disqualifier.
For agencies, national-security suppliers, and the defense industrial base: build the inventory and migration evidence that acquisition now expects.
Context
What is actually happening.
New National Security System acquisitions are expected to be CNSA 2.0-compliant by default from January 1, 2027. The July 2026 executive order then puts PQC key establishment on high-value and high-impact systems by the end of 2030, signatures by the end of 2031, and directs a FAR rule requiring covered contractors to comply by 2030. Suppliers who cannot evidence a plan increasingly lose at the questionnaire, not the demo.
Obligations
What you will be asked for.
Summarized for orientation. Confirm applicability with your counsel, auditor, or contracting officer.
- CNSA 2.0 algorithm compliance for new NSS acquisitions
- PQC key establishment and signature migration plans for high-value assets
- Cryptographic bill of materials for hardware and software delivered to government
- FIPS 140-3 validated modules, with FIPS 140-2 certificates now historical
- Evidence of supplier and dependency cryptographic posture
Approach
What we do about it.
Three workstreams that produce evidence, not just activity.
Inventory against CNSA 2.0
Map every algorithm in your product and environment to the CNSA 2.0 suite, flagging SLH-DSA where it is not approved and LMS/XMSS where signing requires it.
Contractor-ready evidence
Produce CBOMs, migration plans, and control evidence in the formats procurement and assessors ask for.
Migration execution
Move TLS, certificate issuance, and code signing to approved algorithms without breaking fielded systems.
Outcomes
What changes for you.
- A defensible answer to the PQC section of every questionnaire
- A migration plan mapped to 2027, 2030, and 2031 obligations
- CBOM delivery as a standard artifact, not a scramble
Where to start
A six-week readiness sprint scoped to this obligation.
One business unit, one CBOM, one prioritized roadmap, and a board memo that explains the exposure in business terms.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.