Determination tool
Am I a covered contractor?
Ten questions, then a reasoned determination, the clocks that apply to you, and a dated memo.
How this works
Executive Order 14412 started a 180-day clock for a proposed Federal Acquisition Regulation rule requiring covered contractors to meet NIST post-quantum FIPS standards by December 31, 2030. The rule is proposed, not final, so no one can state the exact boundary. This tool applies the facts the order and the memo do settle, and tells you which clock to plan against.
Q-Watch NetworkSelling quantum sensing to DoD or DARPA? Sister site QSense Watch tracks those awards and SBIR topics.Track DoD quantum contracts on QSense Watch
Do you hold a prime contract, task order, BPA call or GSA Schedule order with a US federal agency?
Includes civilian agencies, defense components and federally funded research and development centers.
Do you supply a prime contractor, reseller or integrator that sells into US federal contracts?
FAR requirements typically flow down through subcontracts and purchase orders, so indirect revenue counts.
Do you deliver software, hardware, firmware or a hosted service that performs or depends on cryptography?
Encryption, key exchange, digital signatures, code signing, TLS termination and certificate handling all count.
Does your product or service store, process or transmit federal data, CUI or agency credentials?
Controlled Unclassified Information, PII held on behalf of an agency, or authentication material for agency systems.
Do you support a National Security System, DoW component or intelligence community customer?
If yes, CNSA 2.0 governs your algorithm set and it moves earlier and is stricter than the civilian track.
Is what you sell offered commercially to the public in substantially the same form?
Commercial products are often acquired under FAR Part 12, which limits, but does not eliminate, clause flow-down.
Do you hold, or are you pursuing, a FedRAMP authorization?
FedRAMP baselines inherit FIPS validation requirements, so the module transition reaches you through the authorization boundary.
Do you rely on a FIPS 140 validated cryptographic module to satisfy a customer or contract requirement?
FIPS 140-2 validations moved to the historical list on September 21, 2026.
Is all of your federal revenue below the micro-purchase threshold, with no written contract or flow-down clause?
Occasional card purchases with no contract clauses are a different posture from an awarded contract.
Do you have a current cryptographic inventory or CBOM for the products you deliver?
Both proposed FAR rules assume you can state which algorithms your products contain.