CISA publishes a list of product categories that should support post-quantum cryptography
JANUARY 2026, ARLINGTON
CISA released "Product Categories for Technologies That Use Post-Quantum Cryptography Standards" in January 2026. Industrial Cyber and Infosecurity Magazine give 26 January 2026. Executive Order 14306, signed 6 June 2025, directed the list. The order kept the CISA product-category list, now due 1 December 2025, and kept the TLS 1.3 deadline of 2 January 2030, but dropped the requirement that agencies write post-quantum support into solicitations for listed categories. WilmerHale's alert agrees that the list obligation survived while the procurement trigger did not. That makes the list advisory in procurement terms.
Industrial Cyber reports categories including cloud services, networking, endpoint security, collaboration, identity and access, enterprise security, computing, data systems and telecommunications. MeriTalk says products must implement FIPS 203, 204 and 205 to qualify. Infosecurity Magazine says the NSA helped compile the list, that the list will be updated regularly, and that automated discovery tools and IoT or operational technology devices fall outside it for now.
MeriTalk and Industrial Cyber quote Acting Director Madhu Gottumukkala saying organizations must prioritize procurement of post-quantum-capable technologies. MeriTalk also quotes former CISA official Garfield Jones predicting that non-post-quantum products will struggle in government sales. CyberScoop reports that experts doubted the list's usefulness, because most listed products address key establishment but not signatures.
Executive Order 14412 of June 2026 later raised the stakes for the same vendors, as covered in its own entry.
Why it matters. Vendors in the listed categories should expect federal buyers to ask about post-quantum support, even though the order dropped the formal requirement to write it into solicitations. Buyers can use the list as a starting checklist, but the criticism that it covers key establishment more than signatures suggests they should ask vendors about both. Organizations should expect updates.