1<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"><link rel="icon" type="image/svg+xml" href="/favicon.svg"><title>Executive Order</title><meta name="description" content="Spice Labs: Know your Systems, Chart your Course. The easiest and fastest way to generate CBOMs at scale and manage your PQC journey."><meta property="og:url" content="https://blog.spicelabs.io"><meta property="og:type" content="website"><meta property="og:title" content="Executive Order"><meta property="og:description" content="Spice Labs: Know your Systems, Chart your Course. The easiest and fastest way to generate CBOMs at scale and manage your PQC journey." <meta property="og:image" content="https://blog.spicelabs.io/images/preview.png"><meta name="twitter:card" content="summary_large_image"><meta property="twitter:domain" content="spicelabs.io"><meta property="twitter:url" content="https://blog.spicelabs.io"><meta name="twitter:title" content="Executive Order"><meta name="twitter:description" content="Spice Labs: Know your Systems, Chart your Course. The easiest and fastest way to generate CBOMs at scale and manage your PQC journey."><meta name="twitter:image" content="https://blog.spicelabs.io/images/preview.png">
1<script async src="https://www.googletagmanager.com/gtag/js?id=G-EVMYQSR30G"> 2 // _ 3</script>
3
3<script>(function(){const id = "G-EVMYQSR30G"; 4 5 (() => { 6 window.dataLayer = window.dataLayer || []; 7 function gtag() { 8 dataLayer.push(arguments); 9 } 10 gtag('js', new Date()); 11 gtag('config', id); 12 })(); 13})();</script>
13<link rel="stylesheet" href="/_astro/_slug_.BpjV33An.css"></head> <body> <div id="container" class="with-sidebar"> <header id="header" data-astro-cid-3ef6ksr2> <div id="logo" data-astro-cid-3ef6ksr2> <a href="/" data-astro-cid-3ef6ksr2> <h1 data-astro-cid-3ef6ksr2><img src="/_astro/logo.CG92FhxO_ZTvEcy.webp" alt="Spice Labs" data-astro-cid-3ef6ksr2="true" loading="lazy" decoding="async" fetchpriority="auto" width="223" height="48"></h1> </a> <div class="divider" data-astro-cid-3ef6ksr2></div> <div class="title" data-astro-cid-3ef6ksr2>Blog</div> </div> <div class="toolbar" data-astro-cid-3ef6ksr2> <a class="button" href="https://www.spicelabs.io/get-started" data-astro-cid-3ef6ksr2> Get Started </a> <a class="button login" href="https://dashboard.spicelabs.io/app/login" data-astro-cid-3ef6ksr2> Login </a> </div> </header> <div class="layout-wrapper"> <!-- Mobile menu button --><button class="mobile-menu-toggle" aria-label="Toggle navigation menu" data-astro-cid-ssfzsv2f> <span data-astro-cid-ssfzsv2f></span> <span data-astro-cid-ssfzsv2f></span> <span data-astro-cid-ssfzsv2f></span> </button> <div class="sidebar-overlay" id="sidebar-overlay" data-astro-cid-ssfzsv2f></div> <nav class="sidebar" id="sidebar" data-astro-cid-ssfzsv2f> <div class="sidebar-content" data-astro-cid-ssfzsv2f> <div class="sidebar-header" data-astro-cid-ssfzsv2f> <button class="sidebar-close" aria-label="Close navigation" data-astro-cid-ssfzsv2f>Ã</button> </div> <div class="sidebar-search" data-astro-cid-ssfzsv2f> <div id="search-container" data-astro-cid-otpdt6jm> <div id="search-ui" data-astro-cid-otpdt6jm> <div class="search-placeholder" data-astro-cid-otpdt6jm> <input type="text" placeholder="Search..." disabled style=" 14 width: 100%; 15 padding: 8px 40px 8px 40px; 16 border: 1px solid var(--color-white-20); 17 border-radius: 6px; 18 background: var(--color-white-8); 19 color: var(--color-light); 20 font-size: 0.875rem; 21 font-family: var(--font-ui); 22 height: 36px; 23 box-sizing: border-box; 24 " data-astro-cid-otpdt6jm> </div> </div> </div>
24<script> 25 let pagefindLoaded = false; 26 27 async function loadPagefind() { 28 if (pagefindLoaded) return; 29 30 try { 31 const response = await fetch("/pagefind/pagefind.js"); 32 if (!response.ok) throw new Error("Pagefind not available"); 33 34 const cssLink = document.createElement("link"); 35 cssLink.rel = "stylesheet"; 36 cssLink.href = "/pagefind/pagefind-ui.css"; 37 document.head.appendChild(cssLink); 38 39 const script = document.createElement("script"); 40 script.src = "/pagefind/pagefind.js"; 41 document.head.appendChild(script); 42 43 const uiScript = document.createElement("script"); 44 uiScript.src = "/pagefind/pagefind-ui.js"; 45 document.head.appendChild(uiScript); 46 47 await new Promise((resolve, reject) => { 48 uiScript.onload = resolve; 49 uiScript.onerror = reject; 50 }); 51 52 // Remove placeholder before initializing Pagefind 53 const placeholder = document.querySelector(".search-placeholder"); 54 if (placeholder) placeholder.remove(); 55 56 new window.PagefindUI({ 57 element: "#search-ui", 58 showSubResults: false, 59 showImages: false, 60 excerptLength: 10, 61 resetStyles: true, 62 bundlePath: "/pagefind/", 63 showEmptyFilters: false, 64 autofocus: false 65 }); 66 67 pagefindLoaded = true; 68 } catch (error) { 69 // In dev mode, show a non-functional but styled search interface 70 const searchUI = document.getElementById("search-ui"); 71 if (searchUI) { 72 // Remove placeholder 73 const placeholder = document.querySelector(".search-placeholder"); 74 if (placeholder) placeholder.remove(); 75 76 // Create dev mode search interface 77 searchUI.innerHTML = ` 78 <div class="pagefind-ui"> 79 <form class="pagefind-ui__form"> 80 <input class="pagefind-ui__search-input" type="search" placeholder="Search in prod builds" disabled> 81 <button type="button" class="pagefind-ui__search-clear" disabled style="display: none;">Clear</button> 82 </form> 83 <div class="pagefind-ui__results-area"></div> 84 </div> 85 `; 86 } 87 } 88 } 89 90 function initSearch() { 91 loadPagefind(); 92 93 document.addEventListener("keydown", (e) => { 94 if ((e.metaKey || e.ctrlKey) && e.key === "k") { 95 e.preventDefault(); 96 const searchInput = document.querySelector("#search-ui input"); 97 if (searchInput) searchInput.focus(); 98 } 99 }); 100 101 setTimeout(fixSearchUX, 1000); 102 } 103 104 function fixSearchUX() { 105 const searchInput = document.querySelector("#search-ui input"); 106 let selectedIndex = -1; 107 let results = []; 108 109 const waitForElements = () => { 110 const form = document.querySelector("#search-ui .pagefind-ui__form"); 111 if (!form || !searchInput) { 112 setTimeout(waitForElements, 100); 113 return; 114 } 115 116 const toggleIcon = () => { 117 const hasValue = searchInput.value.trim().length > 0; 118 const isFocused = document.activeElement === searchInput; 119 120 if (hasValue || isFocused) { 121 form.classList.add("hide-search-icon"); 122 } else { 123 form.classList.remove("hide-search-icon"); 124 } 125 }; 126 127 searchInput.addEventListener("input", toggleIcon); 128 searchInput.addEventListener("focus", toggleIcon); 129 searchInput.addEventListener("blur", toggleIcon); 130 toggleIcon(); 131 }; 132 133 const updateSelectedResult = () => { 134 results = Array.from(document.querySelectorAll("#search-ui .pagefind-ui__result")); 135 results.forEach((result, index) => { 136 if (index === selectedIndex) { 137 result.classList.add("selected"); 138 result.scrollIntoView({ block: "nearest", behavior: "smooth" }); 139 } else { 140 result.classList.remove("selected"); 141 } 142 }); 143 }; 144 145 waitForElements(); 146 147 if (searchInput) { 148 searchInput.addEventListener("keydown", (e) => { 149 results = Array.from(document.querySelectorAll("#search-ui .pagefind-ui__result")); 150 151 if (e.key === "ArrowDown") { 152 e.preventDefault(); 153 selectedIndex = Math.min(selectedIndex + 1, results.length - 1); 154 updateSelectedResult(); 155 } else if (e.key === "ArrowUp") { 156 e.preventDefault(); 157 selectedIndex = Math.max(selectedIndex - 1, -1); 158 updateSelectedResult(); 159 } else if (e.key === "Tab" && results.length > 0) { 160 e.preventDefault(); 161 selectedIndex = e.shiftKey 162 ? Math.max(selectedIndex - 1, -1) 163 : Math.min(selectedIndex + 1, results.length - 1); 164 updateSelectedResult(); 165 } else if (e.key === "Enter" && selectedIndex >= 0 && results[selectedIndex]) { 166 e.preventDefault(); 167 const link = results[selectedIndex].querySelector(".pagefind-ui__result-link"); 168 if (link) { 169 searchInput.value = ""; 170 searchInput.dispatchEvent(new Event("input")); 171 window.location.href = link.href; 172 } 173 } else if (e.key === "Escape") { 174 selectedIndex = -1; 175 updateSelectedResult(); 176 searchInput.blur(); 177 } 178 }); 179 } 180 181 document.addEventListener("click", (e) => { 182 const result = e.target.closest("#search-ui .pagefind-ui__result"); 183 if (result) { 184 const link = result.querySelector(".pagefind-ui__result-link"); 185 if (link) { 186 e.preventDefault(); 187 e.stopPropagation(); 188 if (searchInput) { 189 searchInput.value = ""; 190 searchInput.dispatchEvent(new Event("input")); 191 } 192 window.location.href = link.href; 193 } 194 } 195 }); 196 197 const observer = new MutationObserver(() => { 198 const results = document.querySelectorAll("#search-ui .pagefind-ui__result");
199 results.forEach((result) => { 200 if (result && result.querySelector(".pagefind-ui__result-link")) { 201 result.style.cursor = "pointer"; 202 } 203 }); 204 selectedIndex = -1; 205 }); 206 207 const resultsArea = document.querySelector("#search-ui .pagefind-ui__results"); 208 if (resultsArea) { 209 observer.observe(resultsArea, { childList: true, subtree: true }); 210 } 211 } 212 213 if (document.readyState === "loading") { 214 document.addEventListener("DOMContentLoaded", initSearch); 215 } else { 216 initSearch(); 217 } 218</script>
218 </div> <div class="sidebar-nav" data-astro-cid-ssfzsv2f> <a href="/posts/2026-06-06_clock_started/" class="nav-link active" data-astro-cid-ssfzsv2f> Executive Order </a><a href="/posts/2026-04-16-evolution_of_trust/" class="nav-link " data-astro-cid-ssfzsv2f> The (De-)Evolution of Trust In Computer Systems </a><a href="/posts/2026-04-14-understanding_where_we_came_from/" class="nav-link " data-astro-cid-ssfzsv2f> Understanding Where We Came From </a><a href="/posts/2026-04-07-on-open-source/" class="nav-link " data-astro-cid-ssfzsv2f> On Open Source Business Models </a><a href="/posts/os/" class="nav-link " data-astro-cid-ssfzsv2f> On Open Source Business Models </a><a href="/posts/2026-03-27_about_surveyor/" class="nav-link " data-astro-cid-ssfzsv2f> About Spice Labs Surveyor </a><a href="/posts/2026-03-30-caring-about-pqc/" class="nav-link " data-astro-cid-ssfzsv2f> Why You Should Care About Post Quantum Cryptography (PQC) </a><a href="/posts/2026-02-23_writing_png_decoder/" class="nav-link " data-astro-cid-ssfzsv2f> Writing A Slim PNG Decoder In Scala </a><a href="/posts/2025-12-12_lessons_learned_replicating_source_repositories/" class="nav-link " data-astro-cid-ssfzsv2f> Lessons Learned in Replicating Source Repositories </a><a href="/posts/2025-11-17_post_quantum_crypto/" class="nav-link " data-astro-cid-ssfzsv2f> Haystacks and Post-Quantum Crypto </a><a href="/posts/2025-09-30-founder_post/" class="nav-link " data-astro-cid-ssfzsv2f> A Startup Voyage </a><a href="/posts/2025-09-23-mult_publishing_from_github_workflows/" class="nav-link " data-astro-cid-ssfzsv2f> Multipublishing Scala from Github Workflows </a><a href="/posts/2025-02-06-customer_pains/" class="nav-link " data-astro-cid-ssfzsv2f> Building a Fortress in Shifting Sands: How Security Engineers Can Conquer Software Security Uncertainty </a><a href="/posts/2025-01-06-building_profitably_in_2025/" class="nav-link " data-astro-cid-ssfzsv2f> Building Profitably in 2025: A Founder's Perspective </a><a href="/posts/2024-12-10-introducing_spice_labs/" class="nav-link " data-astro-cid-ssfzsv2f> Introducing Spice Labs and the Hyperscale System of Record for Software </a> </div> </div> </nav>
218<script type="module">function i(){const e=document.querySelector(".mobile-menu-toggle"),n=document.getElementById("sidebar"),c=document.querySelector(".sidebar-close"),t=document.getElementById("sidebar-overlay");if(!e||!n)return;const l=()=>{n.classList.add("mobile-open"),e.classList.add("active","menu-open"),t&&(t.style.display="block"),document.body.style.overflow="hidden"},s=()=>{n.classList.remove("mobile-open"),e.classList.remove("active","menu-open"),t&&(t.style.display="none"),document.body.style.overflow=""};e.addEventListener("click",()=>{n.classList.contains("mobile-open")?s():l()}),c?.addEventListener("click",s),t?.addEventListener("click",s),n.querySelectorAll(".nav-link, .category-header-link").forEach(o=>{o.addEventListener("click",s)}),document.addEventListener("keydown",o=>{o.key==="Escape"&&n.classList.contains("mobile-open")&&s()});const d=()=>{const o=document.getElementById("header"),a=o?o.offsetHeight:80;window.scrollY>a-40?e.classList.add("on-content"):e.classList.remove("on-content")};window.addEventListener("scroll",d),d()}document.readyState==="loading"?document.addEventListener("DOMContentLoaded",i):i();</script>
218 <main class="docs-main"> <header class="blog-header"> <div class="blog-header-content"> <h1 class="blog-title">Executive Order</h1> <p class="blog-description">Spice Labs: Know your Systems, Chart your Course. The easiest and fastest way to generate CBOMs at scale and manage your PQC journey.</p> <div class="blog-meta"> <img src="/images/avatar-dpp.jpg" alt="David Pollak" class="author-avatar"> <div class="author-info"> <div class="author-name-date"> <span class="author-name">David Pollak</span> <span class="blog-meta-separator">â¢</span> <time class="blog-date" datetime="2026-06-26T00:00:00.000Z"> June 26, 2026 </time> </div> <div class="author-title">Founder & CEO</div> </div> </div> </div> </header> <div class="docs-content"> <h1 id="the-pqc-clock-started-on-june-22">The PQC Clock Started on June 22</h1> 219<p><em>A note to the federal agency leads who just took on post-quantum cryptography migration.</em></p> 220<p>On June 22, 2026, the President signed an executive order, <a href="https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/"><em>Securing the Nation Against Advanced Cryptographic Attacks</em></a>. It sets a clear national timeline for moving every federal agency to post-quantum cryptography (PQC) â and the clock is already running.</p> 221<p>Maybe youâve just been named your agencyâs PQC migration lead. If so, this oneâs for you: the first move is yours, and thereâs a way to make it a fast one.</p> 222<p>Hereâs the clock, in plain terms:</p> 223<ul> 224<li><strong>30 days</strong> to name a migration lead. (If youâre reading this, thatâs probably you.)</li> 225<li><strong>120 days</strong> to submit your PQC Migration Plan. The Office of Management and Budgetâs implementing memo â <a href="https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf">M-26-15</a>, issued June 24, two days after the order â sets the deadline at late October. The plan has to prioritize your high-value and high-impact systems and name the automated tools youâll use to inventory their cryptography.</li> 226<li><strong>270 days</strong> until the Cybersecurity and Infrastructure Security Agency (CISA) publishes the minimum elements of a Cryptographic Bill of Materials â a CBOM, the machine-readable list of every piece of cryptography inside your software.</li> 227<li><strong>2030, then 2031</strong> â the deadlines to move key establishment, and then digital signatures, to quantum-resistant algorithms.</li> 228</ul> 229<p>Look at the shape of it. The near-term work is inventory and prioritization â building a clear picture of the cryptography you have and where it lives, then ranking it for migration. OMB calls this the first phase; the remediation deadlines come after it.</p> 230<p>So your near-term focus is that plan, and a strong plan starts with a strong inventory. Assemble it the traditional way, booking time with system owners, PKI administrators, and infrastructure teams â talented people carrying their own roadmaps and deadlines â and the calendars fill up fast.</p> 231<p>Hereâs the good news: that inventory is the part Spice Labs can take off your plate this week.</p> 232<p>Point Spice Labs Surveyor at your artifact repository â Artifactory, Docker Hub, wherever your built software lives â and it inventories the cryptographic libraries and materials inside every artifact and sorts them red, yellow, green, so you can prioritize the work. No source code, no agents, running on a machine inside your own boundary â fully air-gapped. While youâre still booking those meetings, Spice Labs has already finished the inventory. You get ground truth without scheduling a single meeting.</p> 233<p>The order also draws a clear line between two layers of cryptography and sets a deadline for each: the key establishment behind your network handshakes by 2030, and the digital signatures applied inside your applications by 2031. That second layer is where forgery lives â a forged signature can produce an authoritative-looking software update, payment instruction, or UAV command that was never real. The network and certificate tools you already run secure the handshakes. The signatures are applied in your compiled applications: in the artifact.</p> 234<p>
234Today, Surveyor goes deepest on the Java Virtual Machine (JVM) â Java, Scala, Kotlin â resolving cryptography down to the call site, including where each signature is applied. Thatâs the depth the remediation phase will call for. .NET is close behind, with more languages arriving through the year. By the time you move from inventory to remediation, Surveyor will be ready for it.</p> 235<p>Donât take my word for any of it. Watch five minutes: we point Surveyor at a repository, pull the full package list, choose our targets, and generate CBOMs with the cryptographic call sites identified and rated red, yellow, green â then show a couple already built.</p> 236<p><a href="https://www.loom.com/share/e511ee55a22f4002b3566ce37a178043"><strong>Discover Post-Quantum Crypto Risks With CBOMs â</strong></a></p> 237<p>Itâs a real body of work on a short clock, and the agencies that start now will set the pace instead of chasing it. We built Surveyor to make the first step â a clear inventory of your cryptography â the easy one. Itâs ready for you today.</p> </div> </main> </div> <footer data-astro-cid-sz7xmlte> <section id="footer" data-astro-cid-sz7xmlte> <a href="https://www.spicelabs.io" data-astro-cid-sz7xmlte> <div id="logo" data-astro-cid-sz7xmlte> <img src="/_astro/logo.kD7HKa-5_ZuUS7w.svg" alt="Spice Labs Logo" data-astro-cid-sz7xmlte="true" loading="lazy" decoding="async" fetchpriority="auto" width="223" height="48"> </div> </a> <div class="nav" data-astro-cid-sz7xmlte> <ul data-astro-cid-sz7xmlte> <li data-astro-cid-sz7xmlte><a href="https://www.spicelabs.io#team" data-astro-cid-sz7xmlte>Team & Advisors</a></li> <li data-astro-cid-sz7xmlte><a href="https://www.spicelabs.io#contact" data-astro-cid-sz7xmlte>Contact</a></li> <li data-astro-cid-sz7xmlte><a href="https://www.spicelabs.io#careers" data-astro-cid-sz7xmlte>Careers</a></li> <li data-astro-cid-sz7xmlte><a href="https://www.spicelabs.io#resources" data-astro-cid-sz7xmlte>
237Resources</a></li> </ul> <ul data-astro-cid-sz7xmlte> <li data-astro-cid-sz7xmlte><a href="https://www.linkedin.com/company/spice-labs-inc" data-astro-cid-sz7xmlte>LinkedIn</a></li> <li data-astro-cid-sz7xmlte><a href="https://documents.spicelabs.io/privacy/" data-astro-cid-sz7xmlte>Privacy Policy</a></li> <li data-astro-cid-sz7xmlte><a href="https://documents.spicelabs.io/terms/" data-astro-cid-sz7xmlte>Terms of Service</a></li> <li data-astro-cid-sz7xmlte> <a href="/feed.xml" class="rss-link" data-astro-cid-sz7xmlte> <svg xmlns="http://www.w3.org/2000/svg" height="16" viewBox="0 0 24 24" width="16" fill="currentColor" data-astro-cid-sz7xmlte> <path d="M0 0h24v24H0z" fill="none" data-astro-cid-sz7xmlte></path> <circle cx="6.18" cy="17.82" r="2.18" data-astro-cid-sz7xmlte></circle> <path d="M4 4.44v2.83c7.03 0 12.73 5.7 12.73 12.73h2.83c0-8.59-6.97-15.56-15.56-15.56zm0 5.66v2.83c3.9 0 7.07 3.17 7.07 7.07h2.83c0-5.47-4.43-9.9-9.9-9.9z" data-astro-cid-sz7xmlte></path> </svg> 238RSS Feed 239</a> </li> </ul> </div> <div class="copyright" data-astro-cid-sz7xmlte> 240© 2026 Spice Labs. All rights reserved. 241</div> </section> </footer> </div>
241<script type="module">function a(){const c=document.createElement("div");c.className="copy-toast",c.textContent="Copied!",document.body.appendChild(c);function l(){c.classList.add("show"),setTimeout(()=>{c.classList.remove("show")},2e3)}async function p(s){try{return await navigator.clipboard.writeText(s),!0}catch{const e=document.createElement("textarea");e.value=s,e.style.position="fixed",e.style.opacity="0",document.body.appendChild(e),e.focus(),e.select();try{return document.execCommand("copy"),document.body.removeChild(e),!0}catch{return document.body.removeChild(e),!1}}}function r(){document.querySelectorAll("pre, .astro-code").forEach(o=>{if(o.querySelector(".copy-button"))return;const e=document.createElement("div");e.className="code-block-wrapper",e.style.position="relative",o.parentNode.insertBefore(e,o),e.appendChild(o);const n=document.createElement("div");n.className="copy-btn-fixed",n.innerHTML='<svg xmlns="http://www.w3.org/2000/svg" height="18px" viewBox="0 -960 960 960" width="18px" fill="currentColor"><path d="M360-240q-33 0-56.5-23.5T280-320v-480q0-33 23.5-56.5T360-880h360q33 0 56.5 23.5T800-800v480q0 33-23.5 56.5T720-240H360Zm0-80h360v-480H360v480ZM200-80q-33 0-56.5-23.5T120-160v-560h80v560h440v80H200Zm160-240v-480 480Z"/></svg>',n.style.cssText=` 242 position: absolute; 243 top: 8px; 244 right: 8px; 245 width: 32px; 246 height: 32px; 247 background: rgba(241, 241, 241, 0.3); 248 border: 1px solid rgba(241, 241, 241, 0.2); 249 color: #f1f1f1; 250 border-radius: 6px; 251 cursor: pointer; 252 z-index: 10; 253 display: flex; 254 align-items: center; 255 justify-content: center; 256 transition: all 0.2s ease; 257 `,e.appendChild(n);const t=document.createElement("button");t.className="copy-button",t.innerHTML="ð",t.title="Copy code",t.style.display="none",t.addEventListener("click",async()=>{const d=o.cloneNode(!0),i=d.querySelector(".copy-button");i&&i.remove();const u=d.textContent||"";await p(u)&&(t.innerHTML="â",t.classList.add("copied"),l(),setTimeout(()=>{t.innerHTML="ð",t.classList.remove("copied")},2e3))}),n.addEventListener("click",async()=>{t.click()}),o.appendChild(t)})}r(),new MutationObserver(()=>{r()}).observe(document.body,{childList:!0,subtree:!0})}document.readyState==="loading"?document.addEventListener("DOMContentLoaded",a):a();</script>
257 </body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.