EO 14412: What Federal Contractors Must Do Now

What Is Executive Order 14412?

Executive Order 14412, signed on June 22, 2026, is the most significant federal action on cryptographic security since EO 14028 (the SBOM executive order of 2021). It mandates that all federal contractors and agencies:

1. Maintain a cryptographic inventory (CBOM) of all cryptographic assets in their systems
2. Transition to NIST-standardized post-quantum cryptography (PQC) by December 31, 2030
3. Submit cryptographic compliance reports as part of federal procurement processes
4. Implement continuous cryptographic monitoring through CI/CD or equivalent mechanisms

The order triggers an immediate 180-day FAR (Federal Acquisition Regulation) rulemaking clock, meaning new procurement rules will be codified into federal contracts within six months of signing.

Who Is Affected?

EO 14412 applies broadly across the federal ecosystem:

Directly Affected

Indirectly Affected

• Subcontractors — prime contractors will flow down CBOM requirements
• Software vendors — government buyers will request CBOMs as part of procurement
• Financial institutions — federal banking regulators will adopt similar requirements
• Healthcare providers — HIPAA alignment with PQC standards expected by 2028
• Critical infrastructure — CISA is developing parallel guidance

The FAR Rule: What Will Change in Federal Contracts

The 180-day FAR rulemaking process will produce contract clauses requiring:

New Procurement Requirements

1. Cryptographic Inventory (CBOM) — contractors must provide a CycloneDX 1.6-compliant CBOM for all delivered software
2. PQC Migration Plan — documented timeline for transitioning from classical to post-quantum algorithms
3. Continuous Monitoring — evidence of automated cryptographic scanning (CI/CD integration)
4. Incident Reporting — notification within 72 hours if deprecated cryptography is discovered in production systems
5. Subcontractor Compliance — prime contractors must ensure subcontractor cryptographic compliance

Compliance Evidence

Contractors will need to produce the following artifacts:

EO 14412 Compliance Timeline

How to Comply: A Step-by-Step Guide

Step 1: Generate Your Cryptographic Inventory

The first compliance requirement is a complete CBOM. Use KeyLens to scan every repository:

# Scan your primary codebase
cbom scan . --format cbom --output cbom-inventory.json

# Scan multiple repositories
for repo in ./repo1 ./repo2 ./repo3; do
  cbom scan "$repo" --format cbom --output "${repo##*/}-cbom.json"
done

Step 2: Identify Non-Compliant Algorithms

Review your CBOM for algorithms that fail EO 14412 requirements:

# Check against NIST PQC requirements (same algorithms as CNSA 2.0)
cbom scan . --check cnsa-2.0

# Common violations:
# ❌ RSA-2048 — quantum-vulnerable, must migrate to ML-DSA
# ❌ ECDSA-P256 — quantum-vulnerable, must migrate to ML-DSA
# ❌ ECDH-P384 — quantum-vulnerable, must migrate to ML-KEM
# ⚠️ SHA-256 — consider upgrading to SHA-384+
# ✅ AES-256-GCM — compliant

Step 3: Create a PQC Migration Plan

Document your transition strategy:

1. Current state — your baseline CBOM, listing all cryptographic assets
2. Target state — all algorithms replaced with NIST PQC equivalents
3. Migration priority — systems ranked by government procurement exposure
4. Timeline — phased rollout completing before December 31, 2030
5. Testing plan — validation methodology for PQC implementations

Step 4: Implement CI/CD Gating

Show continuous monitoring as required by the EO:

# .github/workflows/eo-14412-compliance.yml
name: EO 14412 Cryptographic Compliance
on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1' # Weekly Monday scan

jobs:
  cbom-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: keylens/cbom-action@v1
        with:
          policy: cnsa-2.0
          fail-on-violation: true
          comment-on-pr: true
          output-format: cbom
          output-file: cbom-report.json
      
      - name: Archive CBOM Report
        uses: actions/upload-artifact@v4
        with:
          name: cbom-compliance-report
          path: cbom-report.json

Step 5: Prepare Procurement Documentation

Generate the artifacts that contract officers will request:

# Generate auditor-ready compliance report
cbom scan . --check cnsa-2.0 --format report --output compliance-report.pdf

# Generate CycloneDX CBOM for procurement submission
cbom scan . --format cbom --output deliverable-cbom.json

Penalties and Enforcement

While EO 14412 doesn’t specify direct penalties in the executive order text, non-compliance carries significant consequences:

Procurement Disqualification

The primary enforcement mechanism is procurement gating. Non-compliant contractors will be:

• Ineligible for new federal contracts
• Unable to bid on task orders under existing IDIQs
• Excluded from GSA Schedule renewals
• Flagged in SAM.gov contractor performance assessments

Contractual Liability

• Breach of contract — failure to meet CBOM requirements constitutes a contract violation
• Liquidated damages — some contracts will include penalty clauses for non-compliance
• False Claims Act exposure — certifying compliance without evidence risks FCA liability

Security Incidents

• Breach notification — discovering deprecated crypto in production triggers mandatory reporting
• CISA coordination — agencies must coordinate with CISA on remediation timelines
• Inspector General audits — IG offices will audit cryptographic compliance

EO 14412 vs EO 14028: Key Differences

Frequently Asked Questions

When does EO 14412 take effect?

EO 14412 was signed on June 22, 2026, and took effect immediately. The 180-day FAR rulemaking process will codify specific procurement requirements by late December 2026. New federal contracts issued after the FAR update will include cryptographic compliance clauses.

Do I need a CBOM if I already have an SBOM?

Yes. An SBOM and CBOM serve different purposes. An SBOM inventories your software dependencies; a CBOM inventories the cryptographic algorithms, keys, and protocols those dependencies use. EO 14412 specifically requires cryptographic inventory (CBOM), which is a separate artifact from the SBOM required by EO 14028.

What if my software doesn’t use cryptography?

Almost all software uses cryptography, even if indirectly. HTTPS connections, authentication tokens, password hashing, database encryption, file signatures — all involve cryptographic operations. A CBOM scan will reveal cryptographic usage you may not be aware of, including in third-party libraries.

Can I use any tool to generate a CBOM?

EO 14412 requires CycloneDX 1.6-compliant CBOMs but does not mandate specific tools. KeyLens is the fastest and most language-complete open-source option, supporting 20+ languages with Rust-native performance. Other tools like CBOMkit exist but are limited to Java and Python.

What about classified systems?

Classified National Security Systems (NSS) have additional requirements under CNSA 2.0 and NSA-specific guidance. The CBOM requirement applies, but the handling and distribution of CBOMs for classified systems must follow classification protocols.

Next Steps

• Scan your codebase now → — Generate your first CBOM in under 2 minutes
• CNSA 2.0 Compliance Checklist → — Detailed algorithm requirements and migration timeline
• PQC Migration Guide → — Post-quantum cryptography transition planning
• What is a CBOM? → — Complete guide to Cryptographic Bills of Materials