Intel Federal CTO Outlines Post-Quantum Cryptography Mandates for U.S. Government Agencies

Steve Orrin, Chief Technology Officer for Intel Federal, has outlined his priorities for protecting U.S. government technology systems at a moment when federal agencies face sweeping post-quantum cryptography migration mandates with fixed deadlines, according to Quantum Computing Report. In a podcast published August 31, 2026, Orrin addressed how Intel Federal works with civilian and defense agencies to ensure the computing hardware underpinning critical government systems remains trustworthy and verifiably secure in preparation for a cryptographically relevant quantum computer.

Federal Migration Deadlines and Acquisition Requirements

The post-quantum cryptography transition unfolds across multiple deadlines established through executive orders and national security memoranda. According to Orrin, federal agencies must make post-quantum cryptography usable by 2030 and 2031, affecting critical infrastructure within national security systems that rely on encryption and digital signatures. A separate requirement mandates that by 2035, all legacy cryptography must be completely removed from federal environments.

The most immediate deadline, however, emerged from the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) guidance issued in December 2024. New national security system acquisitions beginning January 1, 2027, must require post-quantum cryptography as part of procurement specifications. This means any purchase of new firewalls, web servers, security appliances, servers, or cloud services entering federal contracts after that date must incorporate post-quantum standards. Orrin explained that this early acquisition requirement is essential because large-scale government systems require years between procurement, vetting, testing, deployment, training, and full operational status. Meeting the 2030-2031 deadlines requires starting procurement well in advance.

The scope of these mandates has expanded significantly. A recent executive order broadened the requirements beyond national security systems—Department of Defense and intelligence community systems—to all federal government agencies and the defense industrial base, requiring any high-value assets, including mission-critical systems supporting critical enterprise functions, to meet the 2030-2031 deadline. This expansion means system integrators, platform builders, and contractors manufacturing military and government systems must now accelerate their own cryptographic migration plans.

The Challenge of Cryptographic Inventory

One of the most misunderstood aspects of post-quantum migration involves identifying which cryptographic systems actually require updating. A standard Windows laptop contains approximately 20,000 crypto assets, representing roughly 5,000 unique packages, but only those that an organization actually relies on for security need to meet the deadlines. This distinction is critical for compliance and resource allocation.

Orrin illustrated this principle with practical examples. Windows includes Telnet application software, which uses cryptography but is typically disabled in modern federal environments and plays no role in an organization's security posture. Telnet does not need to be post-quantum ready by 2030-2031 if an agency does not rely on it for security assurance or data protection. However, by 2035, because it still uses legacy cryptography, it must either be removed or updated to post-quantum algorithms.

Another overlooked example involves hardware-level encryption. HDCP (High-bandwidth Digital Content Protection), an encryption protocol running between CPUs and video outputs, was designed decades ago for anti-piracy purposes rather than protecting user data. This encryption protects content creators' intellectual property, not agency data. Since users do not rely on HDCP for protecting their own data, it does not require post-quantum certification by 2030-2031 deadlines.

Multi-Layer Cryptographic Infrastructure

Implementing post-quantum cryptography across federal systems requires coordination across an unprecedented number of vendors and technology layers. When procuring a laptop, post-quantum requirements must be met across the CPU, wireless card, trusted platform module, USB hubs, power regulators, graphics engines, and video capabilities, along with BIOS and firmware governing those components, and the operating system, drivers, and software stacks running on top.

This orchestration demands cooperation among component manufacturers, CPU suppliers like Intel, original equipment manufacturers (Dell, HP, Lenovo), operating system vendors (Microsoft, Linux environments), and all software providers in the stack—including antivirus programs, productivity suites like Adobe, and security tools. Each of these must be post-quantum ready.

The firmware layer represents a particularly critical and often-overlooked component. Federal agencies frequently fail to account for cryptographic requirements in firmware running beneath the operating system or in networked peripherals like printers. Crypto agility—the ability to swap algorithms as cryptanalysis reveals vulnerabilities—matters as much as selecting the initial post-quantum algorithm, because even selected PQC algorithms could later be compromised by new cryptanalysis.

Quantum Threats Already Present

A critical driver of these aggressive timelines is the recognition that quantum computing threats are not merely theoretical future risks. Orrin emphasized that risks are already happening today: data encrypted with legacy algorithms today will be at risk once a capable quantum computer exists. This "harvest now, decrypt later" threat means sensitive government information, communications, and classified documents encrypted today using current cryptography could be compromised by adversaries who store encrypted data and wait for quantum computing capabilities to materialize.

Intel has been embedding post-quantum cryptography capabilities like XMSS and LMS firmware signing into silicon for five chip generations because hardware has a five-year lead time and cannot be patched into existence overnight, unlike software. This long lead time reflects the physical reality that semiconductor manufacturing decisions made today determine the cryptographic capabilities available in federal systems for years into the future.

Intel Federal's Strategic Position

Intel's role addresses a structural shift in how governments treat semiconductors. The chip is no longer simply a commercial component—it has become a node in geopolitical competition over who controls foundational hardware for defense, intelligence, and critical infrastructure. Intel Federal works to help federal government and larger public sector adopt and deploy technologies at scale, taking federal requirements and mission needs back to business units to build better products meeting government expectations and future needs.

Intel's domestic fabrication footprint, expanded under the CHIPS and Science Act framework, positions the company as a key supplier for federal agencies seeking to reduce dependence on Taiwan Semiconductor Manufacturing Company for sensitive workloads. As post-quantum migration deadlines accelerate federal procurement, Intel's ability to supply cryptographically capable hardware manufactured within U.S. borders becomes increasingly valuable for meeting domestic-content requirements and reducing supply chain vulnerabilities.

Background on Post-Quantum Standards

Federal agencies operate within a procurement environment that has grown considerably more complex since the U.S. Commerce Department began tightening export controls on advanced semiconductors in 2022. Federal agencies now face requirements to document the provenance of chips in their systems, particularly for classified or sensitive-but-unclassified workloads. The National Institute of Standards and Technology finalized its first post-quantum cryptographic standards in 2024, creating formal technical specifications for federal migration efforts.

Intel Federal CTO on Post-Quantum Cryptography Mandates