OMB M-26-15 and EO 14412: What the US Post-Quantum Mandate Means for Suppliers

OMB M-26-15 is the US Office of Management and Budget memorandum that tells federal agencies how to migrate to post-quantum cryptography (PQC). It implements Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, which was signed on 22 June 2026. The memorandum followed two days later, on 24 June 2026. Together they set the first dated federal deadlines for post-quantum migration in the United States.

The first deadline is close. M-26-15 gives each agency 120 days to submit a PQC Migration Plan, which falls on 22 October 2026. This review covers what the order and the memorandum each require, what the memorandum says about automated cryptographic inventory and the cryptographic bill of materials (CBOM), the points that are easy to misread, and what reaches suppliers, including UK suppliers that sell into the US public sector.

The dates at a glance

The order states most of its deadlines as a number of days from signature. Dates marked “about” below are counted from 22 June 2026 and are not printed in the order itself.

• 22 June 2026: EO 14412 signed. It was published in the Federal Register on 25 June 2026.
• 24 June 2026: OMB issues M-26-15, “Execution of the Migration to Post-Quantum Cryptography”.
• 22 October 2026: agency PQC Migration Plans due to OMB and the Office of the National Cyber Director, 120 days from the memorandum.
• About 19 December 2026: 180-day deadline in the order. The FAR Council must publish a proposed rule on contractor compliance with NIST FIPS, NIST must start a PQC migration pilot and revise the Cryptographic Module Validation Program to speed up validations, and the NSA must report on National Security Systems.
• About 19 March 2027: 270-day deadline. CISA, with NIST, must publish guidance on the minimum elements of a CBOM, and the FAR Council must publish a second proposed rule on contractor vulnerability disclosure.
• 31 December 2027: the NIST pilot must be complete.
• 2 January 2030: agencies must support TLS 1.3 or a successor, a requirement from Executive Order 14306 that M-26-15 restates.
• 31 December 2030: high value assets (HVAs) and high impact systems must use PQC for key establishment. This is also the compliance date the FAR proposed rule must set for covered contractors.
• 31 December 2031: HVAs and high impact systems must use PQC for digital signatures.
• 2035: the memorandum’s final phase, completing migration of the remaining systems.

What Executive Order 14412 orders

The order frames the threat in two parts: a future large-scale quantum computer, and the present risk of adversaries “collecting United States information now, and decrypting it later”. That second risk is the harvest now, decrypt later model, and it is the reason the order acts before such a computer exists. Its main provisions are:

• A named lead in every agency. Within 30 days, each agency names a PQC migration lead who reports to its chief information officer and is responsible for “overseeing agency-wide cryptographic inventory management”.
• Hard dates for the most important systems. Within 90 days, OMB must issue guidance requiring agencies to review their HVAs and high impact systems, move them to PQC key establishment by 31 December 2030 and to PQC signatures by 31 December 2031, and submit a plan. M-26-15 is that guidance.
• A NIST pilot. NIST must run a PQC migration pilot on a subset of its own systems, to be completed by 31 December 2027.
• Critical infrastructure. Sector Risk Management Agencies must work with CISA to help critical infrastructure owners and operators develop their own PQC migration plans.
• Foreign governments. The Secretary of State is directed to engage foreign governments and industry groups in key countries “to encourage their transition to PQC algorithms standardized by NIST”.
• A CBOM definition. CISA, in coordination with NIST, must publish guidance on “the minimum elements for a cryptographic bill of materials”. Those elements “shall enable the automated assessment of the cryptographic assets utilized by a hardware or software element”.
• Procurement. OMB, the Department of War, NASA and the General Services Administration must look for savings such as “shared procurement of PQC tools”. The FAR Council must propose two rules: one requiring covered contractors to comply with NIST FIPS, including the PQC standards, by 31 December 2030, and one requiring contractor vulnerability disclosure programmes to accept reports of cryptographic vulnerabilities, “including testing for lack of encryption and the use of non-FIPS approved algorithms”.

The 2030 and 2031 dates exclude National Security Systems. For those, the NSA must report to the President on migration status within 180 days and annually after that.

What M-26-15 requires of agencies

The memorandum is addressed to the heads of federal executive departments and agencies and states that it “does not apply to national security systems”. It sets two actions. Action One is a prioritised migration, with “the objective of mitigating as much quantum risk as feasible by December 31, 2030”. Action Two is the PQC Migration Plan, due 120 days from the memorandum’s date. The memorandum says the plan “should be treated as a dynamic document that will mature over time”.

Prioritisation. Agencies must put three kinds of system first: high impact systems, HVAs, and other systems with highly sensitive data or particular vulnerability to attack by a cryptographically relevant quantum computer. Within that third group, the memorandum names logical access control systems that rely on public key infrastructure, and systems that “Contain data expected to remain mission-sensitive in 2030”.

Legacy systems. “Systems incapable of supporting PQC or hybrid cryptography must be identified and given priority for replacement or decommissioning.” PQC upgrades are to be folded into planned cloud migrations, development lifecycles and hardware refreshes.

Vendors and cloud. Agencies should use CISA’s list of product categories for technologies that use PQC standards, published on 23 January 2026, and make sure requirements for products in those categories include PQC. They should agree PQC responsibilities with FedRAMP-authorised cloud providers under the shared responsibility model. CISA and the Department of War, with the General Services Administration, will lead the work for FedRAMP-authorised providers and for SaaS, PaaS and IaaS services used by more than one agency.

Five phases. The plan must treat migration as a multi-year programme in phases:

• Phase 1, Strategy, Planning, and Discovery (2026 to 2027): inventory, including HVAs and high impact systems, assessment, strategy, training, governance and relative risk.
• Phase 2, Pilots and Early Migration (2027 to 2028): pilots, early migration of prioritised systems and refinement of the plan.
• Phase 3, Prioritized Migration (2028 to 2030): PQC key establishment for HVAs, high impact systems and other prioritised systems, with all systems made cryptographically agile.
• Phase 4, Signature Migration (2031): PQC digital signatures for the same group.
• Phase 5, Full Migration (2035): the remaining systems, based on risk and on what commercial products are available.

Plans must align with NIST IR 8547, the draft transition plan that proposes deprecating some quantum-vulnerable algorithms after 2030 and disallowing all of them after 2035. Appendix A lists the algorithms agencies must treat as quantum-vulnerable: ECDH, MQV, ECDSA, finite-field Diffie-Hellman, RSA for signatures and for key establishment, and DSA. Its footnote goes further: “Agencies are encouraged to treat as quantum-vulnerable any asymmetric algorithm that is not definitively known to be quantum-resistant.”

The inventory requirement: automated, continuous and central

The memorandum is direct about how agencies should find their cryptography. In the main text it says that “manual approaches to discovery and management of cryptography are often insufficient” and that “Automation is critical for inventory management, policy enforcement, and compliance reporting.” Appendix A then describes an Automated Cryptographic Inventory as “a dynamic, continuously updated inventory of all cryptographic assets”, built with three kinds of tool:

• Software Composition Analysis (SCA) to analyse software bills of materials.
• Static and dynamic application security testing “to find cryptographic functions in code”.
• Network scanners “to detect protocols and cipher suites”.

That data “should populate a central Cryptographic Bill of Materials (CBOM) to provide a real-time view of the agency’s cryptographic posture”. The inventory and policy checks should then feed dashboards that “track migration progress against agency timelines”.

Appendix B makes the point enforceable at plan level. The initial plan must contain, at a minimum, “The methodologies and automated tools used for the cryptographic inventory”, alongside a risk-based prioritisation strategy, a plan for a cryptographically agile architecture, “A third-party coordination plan”, funding and staffing estimates, a risk management strategy and governance roles. An agency that cannot name its inventory method and tooling cannot complete the plan.

Points that are easy to misread

• The CBOM is recommended, not mandated. Some coverage describes M-26-15 as a CBOM mandate. The memorandum’s wording is “should populate a central Cryptographic Bill of Materials”. The binding plan requirement is to state the methods and automated tools used for the inventory. The CBOM minimum elements themselves are not yet defined: CISA’s guidance is due about 270 days after the order, around 19 March 2027. Until then, CycloneDX is the established published format for a CBOM.
• NIST IR 8547 is still a draft. The memorandum requires alignment with “NIST Internal Report (IR) 8547, Transition to Post-Quantum Cryptography Standards, or successor document”. NIST’s publication page still lists the initial public draft of 12 November 2024, and no final version had been published by the time of writing.
• Three phases or five. The main text sets out five phases. Appendix B asks for “Timelines and milestones to achieve all three migration phases”. The five-phase structure is the detailed one, and plans that cover all five also cover any three.
• The 2030 objective differs by system. For HVAs and high impact systems, PQC key establishment by 31 December 2030 is a firm date set by the order. For other systems, Action One sets an objective of mitigating “as much quantum risk as feasible” by that date.
• The contractor rule does not exist yet. The order directs the FAR Council to propose a rule within 180 days, about 19 December 2026. Which contractors count as “covered contractors” will be set by that rulemaking. No proposed rule had been published at the time of writing.

What reaches suppliers, including UK suppliers

Neither document places a direct legal obligation on a UK company. Both create requirements that reach suppliers through procurement:

• Agency plans must cover third parties. Every plan needs a third-party coordination plan. The memorandum’s sample role allocation gives the programme office or requirement owner the job of making sure vendor requirements include “PQC-readiness and cryptographic agility provisions”.
• Product requirements follow the CISA categories. Products in categories such as networking, cloud services, collaboration software, identity and access management, and endpoint security can expect PQC integration to appear in requirements.
• Cloud and SaaS providers will be asked to share the work. The shared responsibility model is named explicitly, and multi-agency SaaS, PaaS and IaaS services are a central workstream.
• The FAR rule will set a contractor date. The order fixes 31 December 2030 as the date by which covered contractors must comply with NIST FIPS, including the PQC standards. The detail, including scope and any flow-down to subcontractors, will come with the proposed rule.
• Weak algorithms become reportable. Under the second proposed rule, contractor vulnerability disclosure programmes must accept reports that include “the use of non-FIPS approved algorithms”.

In practice, a supplier should expect four questions from US public sector customers: which algorithms its products use and where, what its roadmap to ML-KEM (FIPS 203) and ML-DSA (FIPS 204) is, whether algorithms can be changed by configuration rather than by a new release, and whether it can describe its product’s cryptography in a machine-readable form such as a CBOM. Each question is answered from an inventory.

For UK organisations, the US timetable sits alongside the NCSC’s post-quantum migration timeline: discovery, assessment and an initial plan by 2028, the highest-priority migration activities by 2031, and migration complete by 2035. The two programmes have the same shape. Both start with discovery and end in 2035. The US dates for key establishment on its most important systems are earlier, at the end of 2030. A UK supplier that sells to both markets will meet the stricter of the two schedules, and both schedules start from the same inventory.

How the requirements map to the ECEM lifecycle

Enterprise Cryptographic Exposure Management (ECEM) describes post-quantum readiness as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. M-26-15 maps onto it closely:

• Discover and Inventory correspond to the Automated Cryptographic Inventory and the central CBOM, the core of Phase 1.
• Assess and Prioritise correspond to the risk-based prioritisation of HVAs, high impact systems, long-lived sensitive data and systems that cannot support PQC.
• Transition corresponds to Phases 2 to 5: pilots, key establishment, signatures and full migration.
• Monitor corresponds to the continuously updated inventory and the dashboards that track progress against agency timelines.

As with the NCSC timeline, the early stages carry the weight. The 22 October plan is mostly a Discover, Inventory and Prioritise document. Every later phase reads from it.

Where Quantum Sentinel fits

Quantum Sentinel is built around the ECEM lifecycle, and its discovery covers two of the three tool types the memorandum names, plus the central record it describes:

• Network scanning. Scanning workers inside the network record the protocol versions, cipher suites, key exchange and certificates that endpoints negotiate, including TLS, SSH and IKEv2. Hybrid post-quantum key exchange is reported by name.
• Cryptography in code. Source code assessment across seventeen languages reports the algorithm, file, line and enclosing function for each finding.
• Beyond the network and the code. Read-only integrations cover key managers and HSMs, five cloud platforms, nine database engines and network security appliances, and report the cryptographic libraries present on endpoints with their versions.
• A central CBOM. Every finding lands in a living Enterprise CBOM, exported as CycloneDX 1.7, with risk classification and harvest-now-decrypt-later exposure informed by how long data must stay confidential.
• Unknown algorithms. An algorithm the platform does not recognise is recorded and marked for review rather than ignored, which supports the memorandum’s instruction to treat unknown asymmetric algorithms as quantum-vulnerable.
• Monitoring. Policy is evaluated continuously with drift detection and alerting, and evidence exports as reports in PDF, Word, Excel and CSV.

Quantum Sentinel is not a software composition analysis tool and does not analyse SBOMs. It re-assesses findings from third-party scanners and existing inventories against the same classification, so SCA output can sit in the same inventory. It does not provide FIPS validation or FedRAMP authorisation, which remain separate processes. It supplies the inventory, prioritisation and monitoring evidence those processes and the migration plan depend on. The cryptographic coverage page lists what is covered in detail.

What to have ready before the FAR rule

For a supplier to the US public sector, or any organisation using the memorandum as a template, five items cover most of what the next two deadlines will ask for:

• An inventory of cryptographic assets across network services, code, key stores and cloud, with the method and tools used to produce it written down.
• A list of the quantum-vulnerable algorithms in that inventory, using the memorandum’s Appendix A as the reference.
• A prioritisation that ranks systems by data lifetime and impact, and names the systems that cannot support PQC or hybrid cryptography.
• A product cryptography statement for customers, ideally in a machine-readable CBOM format, ready to update once CISA’s minimum elements are published.
• A view of TLS 1.3 support and of where algorithm choice is fixed in code rather than set in configuration.

Frequently asked questions

What is OMB M-26-15?

OMB M-26-15, “Execution of the Migration to Post-Quantum Cryptography”, is a memorandum issued by the US Office of Management and Budget on 24 June 2026. It implements Executive Order 14412 and requires federal agencies to carry out a prioritised migration to post-quantum cryptography and to submit a PQC Migration Plan within 120 days. It does not apply to national security systems.

When are agency PQC migration plans due under M-26-15?

Plans are due to OMB and the Office of the National Cyber Director no later than 120 days from the memorandum’s date of 24 June 2026, which is 22 October 2026. The memorandum treats the plan as a dynamic document that will mature over time.

What deadlines does Executive Order 14412 set?

High value assets and high impact systems must use post-quantum cryptography for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Within 180 days the FAR Council must propose a rule requiring covered contractors to comply with NIST FIPS, including the post-quantum standards, by 31 December 2030. Within 270 days CISA must publish guidance on the minimum elements of a cryptographic bill of materials.

Does M-26-15 require a cryptographic bill of materials?

The memorandum says an automated cryptographic inventory should populate a central CBOM, which is a recommendation rather than a mandate. What the plan must contain is the methodologies and automated tools used for the cryptographic inventory. CISA’s guidance on CBOM minimum elements, required by Executive Order 14412, is due around March 2027.

Does EO 14412 apply to UK companies?

Not directly. It applies to US federal agencies and, once the FAR rule is made, to covered federal contractors. UK companies that supply US agencies, directly or through cloud and software services, should expect PQC readiness, cryptographic agility and algorithm inventory questions in procurement. UK organisations also have the NCSC’s own timeline, with discovery and an initial plan expected by 2028.

Sources: The White House, Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register Vol. 91, No. 121, 25 June 2026); OMB, M-26-15, Execution of the Migration to Post-Quantum Cryptography (24 June 2026). Supporting references: CISA, Product Categories for Technologies That Use Post-Quantum Cryptography Standards (23 January 2026); NIST, IR 8547 initial public draft (12 November 2024).

Further reading: why post-quantum deadlines are really inventory deadlines, what Enterprise Cryptographic Exposure Management is and the Quantum Sentinel approach to PQC migration planning.