OMB Memorandum M-26-15, "Execution of the Migration to Post-Quantum Cryptography", was issued on June 24, 2026, two days after Executive Order 14412. It gives every executive agency a calendar: a PQC migration plan to OMB within 120 days, by October 22, 2026; post-quantum key establishment on high-value assets and high-impact systems by December 31, 2030; post-quantum digital signatures by the end of 2031; cryptographic agility at every phase; and completion across the enterprise by 2035. The memorandum binds civilian agencies, and its calendar is the one contractors, critical infrastructure and regulated industries are being measured against too. This is a plan for meeting it that starts where the memorandum does: with the inventory.
The calendar, phase by phase
Phase 1 (2026 to 2027): inventory, governance and the migration plan. The plan due October 22, 2026 has to state the methodologies and automated tools used for the cryptographic inventory.
Phase 2 (2027 to 2028): prioritized systems enter migration, and plans are refined from what the first migrations teach.
Phase 3 (2029 to 2030): key establishment migrated to post-quantum algorithms (FIPS 203, ML-KEM) on high-value assets and high-impact systems by December 31, 2030.
Phase 4 (2031): digital signatures migrated (FIPS 204, ML-DSA or FIPS 205, SLH-DSA) by December 31, 2031.
Phase 5 (2035): completion across the federal enterprise, the year the draft NIST IR 8547 transition schedule disallows quantum-vulnerable public-key algorithms.
Two things about the calendar shape the plan. The deadlines are system-scoped, so the plan needs to know which systems are high-value or high-impact and what cryptography each one depends on. And agility is required at every phase, so the plan cannot be a one-time swap; it has to leave each system able to change algorithms again.
Phase one is an inventory, and the inventory is the bottleneck
The memorandum's first phase is the one most migrations stall on. OMB M-23-02 defined the record in 2022: nine data items per quantum-vulnerable cryptographic system. CISA's strategy for automated discovery and inventory tools was candid that only three of the nine could be collected by the automated tooling then available. The practical answer is to automate what can be observed and to be explicit about what cannot.
Automated cryptographic discovery and inventory (ACDI) tooling collects the observable items: the algorithm, the cryptographic service it provides and the key length, observed on the wire and at rest; software-package provenance; the operating system and its version. QuantaView automates those in full and partially automates hosting and data lifecycle, where cloud key-store and Kubernetes connectors know their provider but a complete answer still needs the agency's confirmation. The FISMA system identifier, the FIPS 199 categorization and the high-value-asset identifier are administrative and stay with the agency. An inventory that says which of its fields were observed and which were supplied is one an assessor can use.
The output of phase one is a Cryptography Bill of Materials (CBOM) in CycloneDX 1.7, the machine-readable form the reporting assumes, with evidence on every component and explicit unknowns. How to read one is the subject of a companion article.
Prioritize from the inventory, not from a list of systems
With the CBOM in hand, the first sort is the quantum security level of the key-exchange and signature algorithms each system negotiates, and the second is what the system protects. Harvest-now, decrypt-later is the reason key establishment comes first in the calendar: traffic recorded today over RSA or elliptic-curve key exchange becomes readable once a cryptographically relevant quantum computer exists, so systems carrying long-lived sensitive data over quantum-vulnerable key exchange lead the plan. Expiring certificates, weak keys and legacy algorithms still being negotiated follow. QuantaView scores each asset out of 100 on exactly those factors and keeps the score moving as the estate changes, which is what makes the plan's priority order defensible in 2028 as well as in 2026.
Remediate one approved change at a time
The memorandum requires migration; it does not require it to be reckless. The remediation model that survives an audit is the one where every change to production cryptography is prepared by the platform, reviewed and approved by a person, applied with a rollback point and a validation check, and recorded in an attestation. In QuantaView that is literal: one recommendation at a time, an Approve step, a job that runs from pending to applying to applied, and a signed attestation afterward. Remediation is one-click, human-approved and fully reversible, and there is no automatic path.
Agility at every phase follows from the same discipline. A migration that moves a service from X25519 key exchange to a hybrid of X25519 and ML-KEM-768, retaining classical interoperability while adding post-quantum key establishment, has made the next change easier, not harder: the service is now known to be able to change its cryptography under control. EnQuanta's QuantaCrypt core is built for that hybrid step as an OpenSSL 3.x provider; its module is FIPS 140-3 validated (CMVP #5312, Active, software-only), with the NIST PQC algorithms delivered through a CAVP-validated provider and module-boundary PQC validation in process.
Measure against the dates with a live inventory
A plan is measured by the inventory it started from. If the CBOM was generated once, progress is reported from a tracker that drifts from reality. If it is live, re-derived every discovery cycle, each applied change shows up as a changed quantum security level, a changed risk score and a changed compliance posture, and a fix that did not hold shows up as the asset returning with evidence. The 2030 and 2031 dates then have a measurement behind them: the share of high-value and high-impact systems whose key establishment and signatures are post-quantum today, read from the document itself.
The calendar is tight for a reason. EnQuanta's research paper on quantum and AI-accelerated risk to TLS 1.3, "A Scenario-Based Evaluation of CRQC+AI Vulnerability Spectrum for TLS 1.3 Cryptographic Dependencies" (Grover, Haile, Pedersen, Uner and Erickson, arXiv:2608.23785), models RSA-2048 crossing a 50 percent feasibility line between 2030 and 2032 on hardware-only assumptions, finds no known break of ML-KEM, ML-DSA, SLH-DSA or AES-256, and concludes that migration on the federal dates, with hybrid deployment and crypto-agility, is the defensible course. The deadline and the modeled crossover occupy the same window.
A 2030 plan in five lines
2026: deploy ACDI discovery on-premise, including air-gapped enclaves, and produce the CBOM the October plan has to describe.
2027: prioritize from quantum-risk scores; migrate the first high-value systems' key establishment to hybrid post-quantum, one approved change at a time.
2028: refine from the first migrations; extend post-quantum key establishment across the prioritized systems.
2029 to 2030: complete post-quantum key establishment on high-value assets and high-impact systems; begin signatures.
2031: complete post-quantum signatures; keep the inventory live so the 2035 completion is measured, not declared.
Sources: OMB M-26-15 · Executive Order 14412 · OMB M-23-02 · FIPS 203, FIPS 204 and FIPS 205 · NIST IR 8547 (draft) · CycloneDX CBOM · arXiv:2608.23785.