The Federal Acquisition Regulatory Council has 180 days to propose a rule requiring covered contractors to meet NIST FIPS including PQC algorithms by December 31, 2030, and 270 days to propose a rule on cryptographic flaws in vulnerability disclosure programs.