What does Section 6(d) of EO 14412 require?

It requires the FAR Council to publish, within 270 days of the order's signing, a proposed rule amending FAR requirements so covered contractors implement vulnerability disclosure policies that include testing for missing encryption and non-FIPS approved algorithms.

When is the proposed rule due under EO 14412 Section 6(d)?

The proposed rule is due March 19, 2027, which is 270 days after the order was signed on June 22, 2026.

Does EO 14412 set a compliance deadline for contractors' vulnerability disclosure policies?

No. The order only sets a deadline for the FAR Council to publish a proposed rule. The date contractors must actually comply depends on the standard rulemaking process that follows and is not yet fixed.

Federal Acquisition Regulation

EO 14412's Contractor Vulnerability Disclosure Rule: Key Dates for 2027

A provision inside EO 14412 requires the FAR Council to propose a federal contractor vulnerability disclosure rule by March 19, 2027 — separate from, and years earlier than, the order's 2030 post-quantum compliance deadline. Here's what's confirmed and what remains undefined.

💡

TL;DR:
EO 14412 quietly sets a March 2027 deadline for a new federal contractor vulnerability disclosure rule — years ahead of its better-known 2030 encryption deadline. Here's what's confirmed, what's still undefined, and what to track before the proposed rule lands.

What you need to know

The change: EO 14412 Section 6(d) requires the FAR Council, within 270 days, to propose a rule amending FAR requirements so covered contractors implement vulnerability disclosure policies (VDPs) incorporating cryptographic vulnerability reporting — testing for lack of encryption and non-FIPS algorithm use.
Who is affected: Federal contractors not currently subject to any governmentwide FAR VDP requirement, likely scoped along lines similar to pending legislation, though EO 14412 itself does not define "covered contractor."
Why it matters: This is a new obligation category, not an extension of the more widely-covered PQC migration deadline.
What to do first: Assign ownership for tracking this rulemaking separately from whoever owns the 2030 PQC compliance timeline.
Key date or trigger: Proposed rule due March 19, 2027 — 270 days from signing.

The signal is public. The implications are not.

Members receive deeper analysis and early warnings inside the PolicyEdge AI Intelligence Terminal.

Upgrade to Founding Member

Medicaid work requirements move along parallel pathways through three review points on a dark policy-intelligence grid.

Medicaid Work Requirements: What the Court Ruling Changes—and What It Doesn’t

A federal court declined to block three CMS provisions governing Medicaid work requirements. The ruling leaves the implementation timeline in place for now without resolving the legal merits.

EU AI Act Article 50 shown as linked data paths separating system marking from public disclosure.

EU AI Act Article 50: What the Transparency Rules Require

EU AI Act Article 50 is now applicable, but it does not require one universal AI label. Learn how duties differ by organizational role, system, content type and exception.

June 2026 JOLTS report visual showing subtle labor-market signals without a clear hiring trend.

June 2026 JOLTS Report: Why the Data Do Not Show a Hiring Rebound

BLS reported job openings as little changed at 7.4 million and hires as unchanged at 5.3 million in June. The data did not establish a hiring rebound—and national estimates alone cannot determine whether a company’s critical roles are becoming easier to fill.

Trump generic-drug tariffs shown as cyan supply-chain paths crossing an amber threshold and branching into uncertain routes.

Trump Generic-Drug Tariffs: What Businesses Can—and Cannot—Plan For

Trump’s announced generic-drug tariffs could reshape supply chains beginning in 2028. Here is what manufacturers, healthcare purchasers and boards can assess now—and which unanswered policy questions prevent reliable forecasts.