Your Template for OMB M-26-15 Migration
The transition to Post-Quantum Cryptography (PQC) is not just a technical upgrade; it is a vital national security imperative that represents the most significant cryptographic reset in the history of the Federal Government. Driven by Executive Order 14412 and Office of Management and Budget (OMB) M-26-15, Federal Civilian Executive Branch (FCEB) agencies face a strict October 22, 2026 deadline to submit comprehensive PQC Migration Plans to OMB and the Office of the National Cyber Director (ONCD).
To take the heavy lifting off agency leaders facing this tight 120-day window, we developed a ready-to-use Template for OMB M-26-15 Readiness and OMB M-26-15 PQC Migration Plan Instructions. Precision-engineered to align directly with the White House mandates, this template serves as a "fast-track" for federal teams. Instead of spending limited cycles building complex compliance documentation from scratch, security leaders can leverage this template to rapidly map their transition pathways and shift their focus to active discovery and remediation.
Per M-26-15, each agency’s migration plan must contain, at a minimum, nine core elements, all of which are featured in the PQC Migration Plan Template:
- System prioritization strategy with risk-based justification.
- Timelines and milestones to achieve the first three migration phases.
- TLS 1.3 support milestones for the January 2, 2030, deadline.
- Methodologies and automated tools for cryptographic inventory.
- Cryptographic agile architecture implementation plan.
- Third-party coordination plan.
- Estimate of funding and personnel resources.
- Risk management strategy for the migration period.
- Governance roles and responsibilities definition.
Agencies must specifically prioritize high impact systems, High Value Assets (HVAs), and any systems vulnerable to cryptographically relevant quantum computer (CRQC) based attacks. This includes logical access control systems based in asymmetric encryption (such as PKI) and any data expected to remain mission-sensitive through 2030.
For most agencies, the core challenge of a migration plan is uncovering "cryptographic debt,” the years of hidden, legacy encryption buried in fractured IT systems. Because this debt creates unseen risks, establishing cryptographic visibility is the primary enabler for success. Once you can see your entire environment, the path to a quantum-safe future becomes clear and manageable.
A successful migration plan depends on an agency's ability to move quickly and accurately, requiring a fundamental shift in security architecture that prioritizes active discovery over passive lists. By deploying a structured and automated methodology, agencies gain the real-time visibility necessary to:
- Discover their full cryptographic footprint with total clarity.
- Protect critical assets against immediate and emerging threats.
- Accelerate the rollout of quantum-safe resilience across the enterprise.
To maximize your team’s resources, our OMB M-26-15 PQC Migration Plan Instructions and Template for OMB M-26-15 Readiness are a practical "fast-track" for building a compliant transition plan. This template provides a clear implementation methodology and a detailed checklist to ensure all required elements are addressed.
I. Policy Foundation
The federal mandate is driven by two specific directives that agencies must operationalize:
- Executive Order 14412: Accelerates the Federal Government's transition to post-quantum cryptography to mitigate emerging quantum computing threats.
- OMB Memorandum M-26-15: Directs each agency to prioritize critical information technology for migration and develop a plan that integrates PQC readiness into existing governance structures.
While this specific policy targets federal agencies, the global trend is clear: critical infrastructure operators and private sector entities should view this mandate as a strategic blueprint.
II. Compliance Timeline & Milestones
M-26-15 establishes a multi-phased timeline for agency compliance. While initial efforts focus on prioritizing HVAs and high-impact systems to mitigate immediate risk, agencies are expected to complete migration across remaining systems by 2035.
III. Mandatory Elements of the PQC Migration Plan
Agency heads must ensure that their submitted plans address the following nine core elements:
- System Prioritization Strategy: Risk-based justification addressing HVAs and PKI-based logical access control systems.
- Timelines and Milestones: Phased migration plans within the initial planning horizon.
- TLS 1.3 Support Milestones: Testing and deployment timelines for the 2030 deadline.
- Methodologies and Automated Tools: Documentation of tools used for cryptographic inventory.
- Cryptographic Agile Architecture: Strategy for algorithm rotation via configuration rather than code.
- Third-Party Coordination Plan: Delineating the Shared Responsibility Model with cloud providers.
- Resource & Personnel Allocation: Estimates for annual budget requests.
- Risk Management Strategy: Specific to the migration period itself.
- Governance Roles and Responsibilities: Defining implementation and risk acceptance accountability.
IV. Strategic Phasing: Multi-Year Transformation
- Discovery & Strategy (2026-2027): Inventory, assessment, and governance framework setup.
- Piloting (2027-2028): Early migration of prioritized systems.
- Prioritized Key Migration (2028-2030): HVAs and systems vulnerable to CRQC-based attacks.
- Signature Migration (2031): Digital signature protocols for prioritized systems.
- Full Enterprise Migration (2035): Completion for all remaining systems.
V. Operationalizing the Transition with QSS
Quantum-Safe Security (QSS), a FedRAMP Moderate authorized tool, helps agencies move from box-checking to real operational resilience.
Strategic alignment with M-26-15:
- Automated Discovery and CBOM Generation: Real-time visibility and generation of Cryptographic Bills of Materials (CBOM) to identify hidden dependencies.
- FedRAMP Authorized: Accelerates adoption by removing the need for a separate agency-level ATO for the discovery tool.
- Validation of Cryptographic Agility: Ensures systems can rotate to NIST standards (ML-KEM, ML-DSA) without hard-coded updates.
- Integration with Zero Trust: Secures the cryptographic roots of device attestation and inter-service communication.
VI. Conclusion
The transition to quantum-safe cryptography demands immediate leadership. Agencies cannot afford to delay while adversaries continue to archive sensitive data.
Don't start from scratch, fast-track your PQC strategy!
