The Signal
Federal PQC Plan Deadline Passes, Compliance Still Unclear
Federal agencies were due to submit post-quantum cryptography migration plans by October 22, but the deadline alone does not reveal whether they filed on time. An earlier requirement in the same memorandum tasked GSA with establishing an in
Quantum.world Team · Written with AI · fact-checked ·
The October 22 deadline for agencies to send post-quantum cryptography migration plans to the Office of Management and Budget and the Office of the National Cyber Director has passed. It was not the first federal deadline in the government’s accelerated program: a June memorandum also required the General Services Administration to establish an interagency working group within 60 days. The plan requirement calls for a roadmap, not completed conversion to quantum-resistant encryption. The deadline’s passing does not, by itself, establish whether agencies filed on time; OMB’s memorandum publishes no government-wide submission tally.
M-26-15 put the first plans on a 120-day clock
OMB Director Russell T. Vought issued Memorandum M-26-15 on June 24, directing agencies to prepare for post-quantum cryptography, or PQC. The memo says: “Each agency must develop and submit a PQC Migration Plan to OMB and ONCD no later than 120 days from the date of this memorandum.” Counting 120 days from June 24 sets the deadline at October 22. Separately, the memo gives GSA 60 days from its publication to establish an interagency working group on modernizing Federal Identity, Credential, and Access Management to support PQC.
“Each agency must develop and submit a PQC Migration Plan to OMB and ONCD no later than 120 days from the date of this memorandum.”
Russell T. Vought, Director, Office of Management and Budget
The requirement applies to executive departments and agencies, but the memo expressly excludes national security systems. It orders agencies to prioritize high-impact systems, high-value assets and other systems holding highly sensitive data or judged particularly vulnerable to attacks by a cryptographically relevant quantum computer. Those systems are the focus of the early work; the deadline is not a requirement to replace every vulnerable algorithm by this week.
Nine elements turn a plan into a migration program
M-26-15 requires plans to include a risk-based system-prioritization strategy, migration timelines and milestones, and plans for testing and deployment to support TLS 1.3. Agencies must also describe how they will inventory cryptography, including the methods and automated tools they will use; build cryptographic agility into their systems; coordinate with third parties; estimate funding and staffing; manage migration risks; and assign governance roles.
The inventory is more than a list of encryption products. The memo calls for agencies to identify where cryptographic systems and algorithms operate across their networks and applications, and recommends automation to maintain a continuously updated view. It also directs agencies to account for vendors and cloud providers, and to incorporate upgrades into planned software, cloud and hardware changes. The practical challenge is discovering systems that rely on vulnerable cryptography before deciding what to replace or update.
The filing deadline is only the start of the schedule
The memorandum sets out five phases, beginning with strategy, planning and discovery during 2026–27, followed by pilots and early migrations in 2027–28. Prioritized migration of key establishment for high-value and high-impact systems follows during 2028–30; signature migration comes in 2031, with the remaining systems scheduled for completion by 2035. Separately, agencies are directed to mitigate as much quantum risk as feasible by December 31, 2030.
That timetable makes the October submission a planning checkpoint, not evidence that systems have changed. Agencies’ plans are meant to develop over time, and OMB says it will assess government-wide progress with the National Cyber Director and issue more guidance as standards, risks and implementation mature. A plan can set milestones and resources, but it cannot establish that agencies have already found every vulnerable system or met a future migration target.
GAO’s review found gaps before the deadline
A public Government Accountability Office report released October 6 adds a warning about readiness, but its findings do not measure whether agencies met the October 22 filing deadline. GAO evaluated cryptography inventories, funding assessments and other planning documents at 24 Chief Financial Officer Act agencies. The public report is a version of a sensitive report GAO issued in September 2025. From September 2025 through September 2026, GAO coordinated with the agencies to obtain concurrence that sensitive information had been appropriately removed; those dates describe the clearance process, not the evaluation period.
GAO found none of the 24 agencies had fully addressed the three preparatory practices in its evaluation framework. It identified shortfalls in cryptography expertise, processes for building inventories and identifying migration funding, and plans for testing PQC. The report also notes that 12 agencies agreed with its recommendations, two partially agreed, seven neither agreed nor disagreed, and one disagreed with three of its four recommendations. Those findings cannot be treated as a tally of submissions or a verdict on agencies’ compliance after October 22. The next concrete measure is whether the plans lead to funded inventories, tests and migration work against the schedule M-26-15 sets.