On June 24, 2026, the Office of Management and Budget issued Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography. It gives civilian federal agencies a concrete planning requirement: submit a PQC Migration Plan to OMB and the Office of the National Cyber Director within 120 days, and execute a prioritized migration with the objective of mitigating as much quantum risk as feasible by December 31, 2030.
The memorandum is important beyond its dates. It describes PQC migration as an agency-wide governance and asset-management problem. That framing offers a useful checklist for any organization building a serious cryptographic modernization program.
The two headline actions
- Execute a prioritized migration of cryptographic systems used in agency-owned or operated information systems, aiming to mitigate as much quantum risk as feasible by December 31, 2030.
- Develop and submit a PQC Migration Plan within 120 days of the memorandum.
These are federal agency requirements, not a universal private-sector deadline. Contractors and technology providers should nevertheless expect agency plans to influence procurement questions, technical roadmaps, contract deliverables, and requests for migration evidence.
What a credible migration plan needs
M-26-15 calls for governance that reaches beyond the CIO and CISO. Effective migration requires defined responsibilities across mission owners, acquisition, finance, legal, privacy, enterprise architecture, and system operations. A plan should identify the migration lead, decision forums, escalation paths, funding assumptions, and the evidence used to report progress.
The inventory must connect cryptography to system and mission context. At minimum, teams need the affected system, use case, algorithm or protocol, implementation or product, data sensitivity and required protection lifetime, owner, supplier, remediation option, dependency, and supporting evidence. Without those relationships, prioritization becomes guesswork.
Prioritize quantum risk, not just upgrade convenience
The fastest upgrade is not always the most important migration. Priority should account for long-lived sensitive data exposed to harvest-now-decrypt-later risk, authentication and signing dependencies, high-value and high-impact systems, externally exposed services, hardware replacement cycles, and supplier readiness.
That makes discovery coverage a first-class program metric. Coverage should show which environments and evidence sources have been assessed, where visibility is partial, and when observations were made. A discovery gap is not proof that vulnerable cryptography is absent.
Procurement becomes a control point
New purchases can either shrink or enlarge the future migration backlog. Acquisition teams should ask vendors which NIST standards and protocol profiles they implement, whether implementations are validated, how legacy compatibility is controlled, when vulnerable modes can be disabled, how keys and certificates are rotated, and what evidence can be exported.
A useful vendor answer names versions, configurations, dependencies, validation status, dates, and limitations. A marketing statement that a product is “quantum safe” is not enough.
From the 120-day plan to continuous proof
A plan submitted once will age quickly. The operating model should continuously reconcile discovery, canonical inventory, evaluation, accountable action, and proof. That is the model behind Vista Platform. Vista helps teams govern cryptographic state and migration evidence; it does not generate PQC keys or execute every technology change.
For a practical starting point, read why post-quantum migration begins with inventory, review Vista’s PQC readiness approach, or evaluate Vista Platform Core.