Executive Order 14412 orders a cryptography bill of materials standard by 2027
22 JUNE 2026, WASHINGTON
Executive Order 14412 directs CISA and NIST to publish the minimum elements of a cryptography bill of materials within 270 days of the order. Counting from 22 June 2026, that points to roughly 19 March 2027. A cryptography bill of materials, or CBOM, is a structured inventory of the cryptographic algorithms, protocols and key lengths a product uses, so a buyer can see which components depend on quantum-vulnerable cryptography.
The order tasks the two agencies with defining what a conforming CBOM must contain rather than prescribing one file format. That mirrors how the software bill of materials guidance developed, where minimum elements set a baseline and tools filled in the detail. The CBOM gives agencies a way to track cryptographic dependencies across their estates and to compare suppliers on a consistent basis.
Vendors should expect CBOMs to appear in procurement questionnaires. Once agencies can ask for a cryptography inventory and check it, post-quantum readiness becomes a verifiable supplier attribute instead of a marketing claim. Suppliers that already maintain a cryptographic inventory of their own products will find the request straightforward to answer.
Why it matters. The CBOM requirement turns cryptographic transparency into a procurement expectation. Buyers gain a repeatable way to ask suppliers what algorithms their products use, and suppliers gain a clear reason to inventory their own cryptography before the questions arrive. Organizations that build a product-level cryptographic inventory ahead of the 2027 standard will be ready to respond when federal buyers start asking.