OMB gives agencies 120 days to submit post-quantum migration plans
24 JUNE 2026, WASHINGTON
OMB issued memorandum M-26-15, "Execution of the Migration to Post-Quantum Cryptography," two days after Executive Order 14412. HSToday reports it was signed by OMB Director Russell Vought and serves as the operational roadmap that follows the order. It applies to civilian executive agencies.
HSToday says the memorandum covers approved algorithms, hybrid architectures (which combine a classical and a post-quantum algorithm), crypto agility and integration of post-quantum cryptography into zero trust, a security model that trusts no user or system by default.
Agencies must submit migration plans to OMB and the Office of the National Cyber Director within 120 days, about 22 October 2026. As of 2 October 2026 the plan deadline had not yet passed.
OpenSSL Corporation says the memorandum emphasizes folding post-quantum work into existing cloud and hardware refresh cycles and that agencies were to name migration leads by late July 2026. GovCIO Media reported on 19 June 2026, before issuance, that implementation was uneven across agencies.
Why it matters. The 22 October 2026 plan deadline is the nearest dated step in the federal migration. Vendors to civilian agencies should expect requests for roadmaps and technical details in the weeks before and after it. The emphasis on existing refresh cycles suggests organizations can reduce cost by timing post-quantum upgrades to planned hardware and cloud renewals.