Federal agencies must plan their move to post-quantum cryptography, and the first deadline is close.

OMB Memorandum M-26-15, issued June 24, 2026, requires agencies to submit a PQC migration plan within 120 days of that date. That puts the submission deadline at October 22, 2026, as Zscaler’s analysis notes. Plans go to OMB and the Office of the National Cyber Director. The memo does not apply to national security systems.

The memo implements Executive Order 14412, signed two days earlier on June 22, which made government-wide PQC migration binding policy. The EO also required each agency head to name a PQC Migration Lead within 30 days, a deadline that passed in July 2026. Agencies that missed it are currently out of compliance.

M-26-15 lays out a five-phase timeline: strategy and discovery in 2026 to 2027, pilots in 2027 to 2028, prioritized migration through 2030, digital signatures in 2031, and full migration of remaining systems by 2035. The hard dates carry over from the executive order: PQC key establishment on high-value assets and high-impact systems by December 31, 2030, and PQC digital signatures by December 31, 2031. The technical basis is NIST’s first three finalized standards from August 2024: FIPS 203, 204, and 205.

The most time-sensitive work is discovery. Building a cryptographic bill of materials that catalogs every key, certificate, and algorithm is the essential first step, and the memo expects it to cover applications, network infrastructure, SaaS, cloud services, and on-premises systems. The mandate also reaches contractors: the FAR Council must publish a proposed contractor compliance rule by December 19, 2026.

Security leaders should read the OMB memo directly to review the nine required elements for these plans.

The near-term action is inventory. Organizations should begin the discovery phase now rather than waiting for the FAR rule to finalize.

Sources: OMB M-26-15, Zscaler