October 22 deadline: US agencies must submit their post-quantum migration plans

One hundred twenty days. That is the deadline the Office of Management and Budget (OMB), the White House budget office, gave federal agencies on June 24, 2026, to submit their plan for migrating to post-quantum cryptography. Counted from that date, it expires this Thursday, October 22.

Memo M-26-15, signed by OMB Director Russell Vought, implements a June 22 executive order on protection against advanced cryptographic attacks. It does not cover national security systems, which are governed by other texts. The risk it targets is well known: a sufficiently powerful quantum computer could decrypt data protected by many forms of cryptography in common use today and bypass authentication mechanisms. The memo states that no such computer is known to exist today, but that one could emerge within the decade.

What the plan must contain

The memo is specific, which is what makes it useful beyond the United States. Each plan must include, at a minimum:

• a risk-based strategy for prioritizing systems;
• a timeline and milestones for each phase;
• the method and automated tools for the cryptographic inventory;
• a "crypto-agile" architecture plan, able to switch algorithms;
• a vendor coordination plan, a budget and staffing estimate, risk management and a division of roles.

Priorities are set: high-impact systems, high-value assets, access systems based on public key infrastructure, and data that will still need to be sensitive in 2030. Systems unable to move to post-quantum cryptography must be identified, then replaced or retired first.

Five phases through 2035

The timeline runs from the inventory (2026-2027) to pilot projects (2027-2028), then to the migration of key exchanges for priority systems (2028-2030). Digital signatures follow in 2031, and everything else in 2035. The stated goal is to reduce quantum risk "as much as possible" by December 31, 2030. Agencies must also support TLS 1.3 by January 2, 2030 at the latest and align their plans with NIST report IR 8547.

These are obligations for US federal agencies, not for companies. But the timeline matches Europe's, which also targets 2030 for high-risk systems and 2035 for the rest, as the German roadmap recently reminded us. For an organization just starting out, the memo's list is a good baseline, to be complemented by our six-step guide.

It remains to be seen whether every agency met the deadline. The OMB has not yet published anything about the plans received.