QUANTUM-RESISTANT NETWORKING · COMPLIANCE

A PQC migration plan lands on the White House’s desk on Thursday, October 22, 2026, from every federal civilian agency, and the ripple will reach every vendor, managed service provider and contractor those agencies buy from. OMB Memorandum M-26-15 started the 120-day clock on June 24, 2026, two days after Executive Order 14412 ordered an accelerated move to post-quantum cryptography. Sixteen days earlier, the Government Accountability Office published an audit showing none of the 24 largest agencies had fully completed the preparation the plan depends on. The plan is federal. The questions it triggers are commercial.

At ibm/SEIMless, our Exodus QRN team sees a supply-chain moment. No agency can write a credible PQC migration plan without knowing which cryptography lives inside the products, networks and cloud services it buys, so customers are about to ask suppliers for evidence. Here is what the plan requires, what the audit exposed, and how to answer.

Why the October 22 PQC Migration Plan Deadline Matters Beyond Washington

The deadline is the first hard date in the federal post-quantum push. Executive Order 14412 gives civilian agencies until the end of 2030 to move high value assets and high impact systems to post-quantum key establishment, and until the end of 2031 for digital signatures. M-26-15 turned that mandate into an operating manual, and the October plan is its first deliverable. Homeland Security Today called it the first federal roadmap with a phased schedule through 2035.

Law firms Skadden, King & Spalding and the National Law Review expect federal purchasing rules to pull the requirement through supply chains. Trade outlets MeriTalk, FedScoop, ExecutiveGov and eWeek covered the audit, and vendors such as Zscaler and Quantum XChange published preparation guides, a sign that the market treats October 22 as a procurement event.

Our posts on the Executive Order 14412 deadline calendar and the 2026 enterprise PQC migration playbook cover policy and technical path. This one covers the supplier side.

What OMB M-26-15 Requires in Every PQC Migration Plan

Appendix B of the memo lists what the first PQC migration plan must contain. OMB calls it a dynamic document that will mature over time, so version one can be imperfect, but every section must exist. The nine elements follow, with the vendor angle.

The memo’s phases are worth memorizing: strategy, planning and discovery in 2026–2027; pilots and early migration in 2027–2028; prioritized migration of key establishment in 2028–2030; signature migration in 2031; and full migration of remaining systems by 2035. Phases three and four mirror the order’s 2030 and 2031 dates, so one plan can serve both documents.

What GAO Found: The Inventory Proof Gap

On October 6, 2026, GAO released GAO-27-108740, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat. It tested the 24 Chief Financial Officers Act agencies against three practices: a prioritized inventory of systems with vulnerable cryptography, an estimate of the funding needed to migrate, and testing of post-quantum algorithms. None of the 24 fully addressed all three. As MeriTalk and FedScoop reported, the details were stark:

• Inventory: one agency fully addressed it, 22 partly addressed it and one had no inventory.
• Automation: five agencies used automated discovery tools and 19 did not.
• Expertise: 18 reported a cryptography skills gap with no plan to fill it.
• Upkeep: only one agency had a documented process for keeping its inventory current.
• Funding: none fully assessed the cost. 21 produced partial estimates and three produced none, while ONCD gave Congress a figure of roughly $7.1 billion.
• Testing: no agency had tested post-quantum cryptography in its own environment.

Read the audit carefully. Fieldwork ran from February 2024 to September 2025, GAO measured agencies mostly against the 2022 guidance in OMB M-23-02 rather than M-26-15, and the report was reissued with revisions on October 14. It shows where agencies stood before the deadlines, not the quality of the plans filed now. Some inventories also wrongly listed symmetric algorithms as vulnerable, so accuracy matters as much as coverage.

We call the pattern the inventory proof gap: the distance between saying an organization knows where its vulnerable cryptography lives and showing evidence for every entry. Agencies that cannot close the gap internally will push the question outward, to vendors who can state which algorithms, key sizes, certificates and protocols their products use. Every PQC migration plan inherits that gap.

How a PQC Migration Plan Reaches Vendors, MSPs and Contractors

Each PQC migration plan carries three direct pulls on suppliers. First, agencies should consult CISA’s product categories list and make sure requirements for products in those categories include PQC integration. Second, they should engage FedRAMP-authorized cloud providers to divide PQC responsibilities under the shared responsibility model, while CISA and the Department of War, working with GSA, lead migration for services used at more than one agency. Third, Appendix B tells program offices to write PQC readiness and cryptographic agility into vendor requirements. GSA’s FICAM office is also testing PQC-ready access systems with interested agencies.

The Contractor Layer: EO 14412 and the FAR Rule

The contractor layer comes from the executive order itself. EO 14412 directs the FAR Council to propose, within 180 days of June 22 (about December 19, 2026), a rule requiring covered contractors to comply with NIST standards that include post-quantum algorithms by December 31, 2030. A second proposed rule, due at about 270 days, would make contractor vulnerability disclosure programs accept cryptographic flaws, and CISA and NIST owe cryptographic bill of materials elements in the same window. Who counts as a covered contractor is undefined. Encryption Consulting and OpsMx keep running calendars; use the table below as yours.

Treat anything beyond these dates as expectation. As CIO.com noted, security vendors, cloud providers, software developers and managed service providers may ultimately have to show compliance, and primes may ask subcontractors for evidence before any clause is final. Defense suppliers also follow a separate track under NSA’s CNSA 2.0 guidance.

Five Questions Your Agency Customers Will Ask Next

1. Which cryptography is in the product, and where? Expect requests for algorithm-level detail. A machine-readable answer, such as a cryptographic bill of materials modeled on SBOMs, beats a questionnaire reply.
2. When will you support ML-KEM and ML-DSA? Agencies need dates to set milestones for 2030 key establishment and 2031 signatures. NIST published FIPS 203, FIPS 204 and FIPS 205 in 2024.
3. What will it cost? Summaries of the GAO report note that cost estimates suffered partly because vendors had few post-quantum products to price. Have numbers ready.
4. Can the algorithm change by configuration, and do you support TLS 1.3? M-26-15 asks for configuration-driven cryptography, cipher-suite negotiation and key management systems that hold both classical and post-quantum keys. NIST CSWP 39 explains crypto-agility in depth.
5. Is the module validated, and when? The order directs NIST to speed validations through the CMVP, but validated post-quantum modules may lag demand.

Crypto-Agility, Hybrid Modes and TLS 1.3: The Technical Core

Appendix A of M-26-15 is the most specific federal cryptography guidance OMB has issued. It names ML-KEM for key establishment, ML-DSA and SLH-DSA for signatures, and lists RSA, Diffie-Hellman, ECDH, ECDSA and DSA as quantum-vulnerable. It describes hybrid key exchange and dual signatures, yet calls hybrid an intricate and resource-intensive stopgap, a sign that OMB expects pure post-quantum cryptography in the end. It also says symmetric-key-based protocols should be avoided, echoing the DoW PQC Strategy’s view that solutions lacking PQC authentication are not fully PQC.

Two consequences follow. A product hard-coded to one algorithm is a poor fit even if the algorithm is right today. And TLS 1.3 becomes the carrier: the memo shows hybrid key exchange inside the TLS 1.3 handshake and requires support by January 2, 2030. Cloudflare has raised the open question of whether “migrated” means supported, preferred or exclusive, since a system that still accepts a classical-only handshake stays exposed to downgrade. Certificate hygiene belongs here too; our guide to certificate lifecycle management covers shrinking validity periods and the FIPS 140-2 sunset. See also NIST IR 8547 and the NCCoE migration project.

Where the Network Layer Fits in Your PQC Migration Plan

M-26-15 calls post-quantum cryptography a foundational dependency for zero trust. It urges that TLS and IPsec terminators, including firewalls, VPN concentrators, cloud gateways and API proxies, support post-quantum key exchange and sit close to endpoints, using CISA’s Zero Trust Maturity Model as the framework. That is network architecture language, and it is where ibm/SEIMless works.

Exodus QRN, our quantum-resistant networking suite, protects data in motion and at rest with future-proof key management and encryption. Start with Exodus QRN, then review Exodus Key Management, Data in Motion and Data at Rest; our Exodus QRN overview explains the architecture. On the security side, the NxtGen Firewall, Zero Trust Content Security, Transparent Encryption and Exodus Aria ADR cover segmentation, content and detection, while EDR covers endpoints. For high-value links, dark fiber, wavelength services, SD-WAN and MPLS replacement designs give a cleaner perimeter to upgrade. Our dark fiber vs wavelength and network edge security posts explain the choices.

Caveat: network-layer protection does not replace an application-level cryptographic inventory. It reduces exposure for long-lived data while the inventory matures, the logic behind harvest now, decrypt later risk. For the physics-versus-math debate, read QKD vs PQC.

A 30-Day PQC Migration Plan Sprint for Commercial Organizations

Borrow the structure without the deadline. This PQC migration plan sprint mirrors the nine elements.

1. Days 1–5: Name an owner and a steering group across IT, security, procurement and finance.
2. Days 1–10: Start automated discovery: network scans for cipher suites, software composition analysis against SBOMs, code scanning and a certificate inventory.
3. Days 8–15: Prioritize by data lifespan and business impact, flagging anything confidential past 2030.
4. Days 10–20: Send a short cryptography questionnaire to your top 25 vendors using the five questions above.
5. Days 15–22: List systems that cannot support PQC or TLS 1.3 and queue them for replacement.
6. Days 20–28: Protect the highest-value links and data stores at the network layer while applications wait on vendors, including backup and recovery
7. Days 25–30: Estimate funding and staffing, set milestones for 2028, 2030 and 2031, and brief leadership.

The same discipline powers risk-based vulnerability management, and the “replace” theme of Cybersecurity Awareness Month 2026 applies to systems that cannot be upgraded.

Industry Lens: Financial Services, Healthcare and Insurance

Banks, hospitals and insurers rarely appear in OMB memos, yet regulators lean on NIST and their data lives long, which makes them targets for collection today and decryption later. Hospitals face a lifespan gap in devices that outlast their encryption; see medical device cybersecurity in the quantum era. Financial firms adopting AI agents face identity questions covered in agentic AI security meets Q-Day. Cyber insurers may follow the federal lead by asking for cryptographic inventories.

Frequently Asked Questions

When is the PQC migration plan due?

Every covered federal civilian agency must submit its plan to OMB and ONCD no later than 120 days after June 24, 2026, which is October 22, 2026. M-26-15 does not apply to national security systems.

Who has to submit a PQC migration plan?

Executive departments and agencies submit under M-26-15. Vendors do not file a PQC migration plan, but agency plans include a third-party coordination section that depends on suppliers.

What must a PQC migration plan include?

A prioritization strategy, phase milestones, TLS 1.3 milestones, inventory methods and tools, a crypto-agile architecture, a third-party plan, resource estimates, a risk strategy and governance roles.

Does the GAO audit assess agencies against M-26-15?

No. GAO-27-108740 reports on work that ended in September 2025 and measured agencies mainly against OMB M-23-02. It is a baseline, not a review of the October plans.

Are contractors bound by the plan today?

Not directly. EO 14412 directs a FAR rule, due about December 19, 2026, requiring covered contractors to meet NIST post-quantum standards by December 31, 2030. No proposed rule had appeared by mid-October.

How can my organization prepare now?

Assign an owner, automate cryptographic discovery, prioritize long-lived data, question your vendors, and protect critical links at the network layer. The 30-day PQC migration plan sprint above gives a practical order of work.

Build Your PQC Migration Plan With ibm/SEIMless

Whether you supply agencies, serve a regulated industry or run a large network, ibm/SEIMless and Exodus QRN can help turn the nine plan elements into network architecture. Explore our services, read our FAQs or learn about us. This article is educational, not legal advice; confirm contract obligations with counsel.