The answer, up front
Defense suppliers have a hard date to plan around. The US Department of War published a post-quantum strategy in June 2026 that requires all systems to support the new cryptography by December 31, 2030, with full implementation by December 31, 2031 1. The requirements are expected to reach contractors through the Cybersecurity Maturity Model Certification (CMMC), and reporting says they may flow down before rulemaking finishes 2. The defense industrial base is private-sector by definition, so this is a direct, dated obligation for contractors and their suppliers.
The Department of War strategy
The strategy sets five lines of effort: governance, cryptographic inventory, technology development, commercial integration and large-scale deployment, and it rules out quantum key distribution and simply lengthening keys in vulnerable algorithms 1. In plain terms, the Department wants an inventory first and a migration that uses the standardized post-quantum algorithms, not stopgaps.
The contractor flow-down
DefenseScoop reported in July 2026 that the Department plans to bring post-quantum requirements into CMMC, though details remain unclear 2. Experts quoted there say most of the defense industrial base is not ready and that contractors should expect requirements to flow down before rulemaking finishes 2. For a supplier, the lesson is to start the inventory now rather than wait for a final rule, because the compliance expectation is arriving through the contract chain.
Australia and NATO
Australia is moving on a similar clock. Defence Connect reported in September 2026 that Australian organizations should produce a transition plan within about four months, start migrating critical systems by 2028, and retire traditional public-key cryptography by 2030, and it argues for sovereign control of keys and maintenance capacity 3. That piece cites survey figures the reporting could not verify and does not state the author's affiliation, so weigh its numbers accordingly. NATO, by contrast, has no matching public deadline: an analyst's reading of the alliance's first Quantum Technology Roadmap, approved July 30, 2026, finds it runs to the third quarter of 2029 without an alliance-wide migration date, with a Brussels-Mons pilot aiming to demonstrate post-quantum cryptography in operational networks by the fourth quarter of 2027 4. That source is analysis, not the roadmap text.
What this means for suppliers
The 2030 date is close enough that inventory work should start now. Suppliers should map where vulnerable cryptography lives in their products and networks, document crypto agility and which post-quantum profiles they support, and expect customers to ask for both through CMMC and contract terms.
How ArcQubit approaches it
ArcQubit treats the cryptographic inventory as the first deliverable the Department of War strategy itself calls for. QuCode builds that inventory across a contractor's systems and products, and QuTrust holds the migration plan so the supplier can show a current, defensible posture as CMMC and flow-down requirements arrive.