Short answer: every US federal agency covered by OMB memorandum M-26-15 must submit a post-quantum cryptography (PQC) Migration Plan to OMB and the Office of the National Cyber Director (ONCD) by 22 October 2026, 120 days after the memorandum was issued on 24 June. Sixteen days before that deadline, on 6 October, the Government Accountability Office (GAO) published an audit of the 24 agencies covered by the Chief Financial Officer Act. It found that “none of the 24 selected agencies fully addressed” the three preparatory practices it assessed, and that only one had a complete inventory of its priority systems.
The audit is easy to misread. Its fieldwork ended in September 2025, it measured agencies against the 2022 guidance rather than M-26-15, and it says nothing about the plans now being written. What it does provide is the most detailed public baseline of where federal cryptographic inventories stood before the new deadlines. Set against the list of what the 22 October plan must contain, it shows which sections agencies will find hardest to write, and so which questions their suppliers are likely to be asked next.
This post builds on our earlier review of OMB M-26-15 and Executive Order 14412, which covers the order, the memorandum and the full timeline in detail.
What GAO measured, and when
The report is GAO-27-108740, “Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat”, addressed to the Ranking Member of the Joint Economic Committee. Three facts about it matter more than the headline:
- It is a public version of an older report. GAO states that it “is a public version of a sensitive report that we issued in September 2025”. The performance audit ran “from February 2024 to September 2025”. GAO then spent a year with the agencies agreeing what could be released.
- The yardstick is the 2022 memorandum. GAO built its framework of three practices and eight activities primarily from OMB M-23-02, “Migrating to Post-Quantum Cryptography”, issued in November 2022. Neither Executive Order 14412 nor M-26-15 existed during the audit.
- It was revised after release. The report was “Reissued with revisions on Oct. 14, 2026”. The errata statement says the revision clarifies how the highlights page and two pages of the report describe GAO’s coordination with agencies over removing sensitive information.
The audit covered the 24 Chief Financial Officer Act agencies. GAO checked inventories, funding assessments and planning documents at all 24, and selected six agencies for a closer look at whether the inventory data was supported by evidence. In the sensitive report it made 89 recommendations to CISA and 23 of the 24 agencies.
What GAO found, in numbers
GAO’s three practices were a prioritised inventory of systems with vulnerable cryptography, an assessment of the funding needed to migrate, and testing of PQC. The detail is more useful than the summary:
- Inventory of priority systems. One agency fully addressed it, 22 partially addressed it and one had not developed an inventory. Most inventories did not identify all high-impact systems or all high value assets.
- Accuracy. Of the six agencies examined in depth, none could fully support the vulnerable algorithms recorded in its inventory. Two partially supported them and four did not address the activity.
- The wrong algorithms. Several inventories “incorrectly included ‘symmetric key’ cryptographic algorithms as being vulnerable to a CRQC”. A cryptographically relevant quantum computer (CRQC) threatens public key algorithms such as RSA and elliptic curve cryptography, which is where migration effort is needed.
- Automation. Five agencies used automated tools to identify and verify inventory data. The other 19 did not, and officials from 15 agencies said it was too early or that they were waiting for CISA to identify appropriate tools.
- Expertise. Eighteen agencies reported a lack of expertise in cryptography and in developing the related inventories, and had not developed plans to fill those gaps.
- Keeping the inventory current. One agency had a documented inventory maintenance process. The other 23 did not.
- Funding. No agency fully addressed it. Twenty-one produced partial funding assessments, three produced none, and only one agency’s assessment rested on a complete inventory of priority systems. OMB used the assessments to give Congress an ONCD estimate of approximately $7.1 billion to migrate priority systems or replace legacy systems that cannot support PQC.
- Testing. One agency had done market research on candidate PQC implementations but had not tested PQC in its environment. The remaining 23 had done neither.
GAO traced the inventory gaps to a lack of “(1) cryptography expertise, (2) documented inventory maintenance processes, (3) automated tools, and (4) a plan for addressing the challenge of developing an inventory for one agency’s complex environment.”
The 22 October plan, set against the audit
Appendix B of M-26-15 lists what the initial plan “must contain, at a minimum”. Most of the items line up with a gap GAO recorded a year earlier:
| M-26-15 plan requirement | What GAO found (audit ending September 2025) |
|---|---|
| A system prioritization strategy with risk-based justification | Only one complete inventory of priority systems. Most inventories missed some high-impact systems and high value assets. |
| The methodologies and automated tools used for the cryptographic inventory | Five agencies used automated tools and 19 did not. None of the six agencies examined in depth could fully support its algorithm data. |
| An estimate of funding and personnel resources required | No agency fully assessed funding. Eighteen reported a lack of cryptography expertise without a plan to fill it. |
| Timelines and milestones for testing and deployment to meet the TLS 1.3 support deadline | No agency had tested PQC in its own environment. |
| A third-party coordination plan | Eleven agencies said a funding assessment was difficult because vendors had no PQC products to price. |
| A section defining governance roles and responsibilities | Twenty-three agencies had no documented inventory maintenance process. |
The remaining items are timelines and milestones for the migration phases, a plan for a cryptographically agile architecture and a risk management strategy for the migration period. GAO did not assess those directly, but each depends on the inventory.
None of this means the plans will fail. Agencies have had more than a year since the audit closed, and nearly four months with the new memorandum. M-26-15 also says the plan “should be treated as a dynamic document that will mature over time”. The comparison does show where the first versions are likely to be thinnest: inventory method, evidence and cost.
What changed between the audit and the memorandum
Three changes in M-26-15 respond directly to the weaknesses GAO describes.
- Automation moved from option to expectation. ONCD officials told GAO that “automated tools were never a requirement in policy for agencies to utilize”. M-26-15 says that “manual approaches to discovery and management of cryptography are often insufficient” and that “Automation is critical for inventory management, policy enforcement, and compliance reporting.” The plan must name the automated tools used for the inventory.
- The data-sensitivity horizon moved forward. Under M-23-02, as GAO describes it, the criterion covered data “that would still be considered mission-sensitive if decrypted by a cryptographically relevant quantum computer in 2035”. M-26-15 asks agencies to prioritise systems that “Contain data expected to remain mission-sensitive in 2030”. More systems qualify for priority treatment.
- The dates became fixed. Executive Order 14412 requires high value assets and high impact systems to use PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. These dates did not exist when GAO did its fieldwork.
One sentence in M-26-15 sits uneasily with the audit. It says: “Through their inventories, agencies have already identified legacy systems for which migration would be too difficult or costly.” The GAO evidence suggests that for most agencies those inventories were incomplete when the audit closed. The plans due on 22 October are the first test of how far that has changed.
What happens after 22 October
Agencies submit their plans to OMB by email. The memorandum does not say the plans will be published. It says OMB, in coordination with ONCD, “will assess agency-wide progress and release further guidance as needed”. The next dated steps come from Executive Order 14412, counted from its signature on 22 June 2026:
- About 19 December 2026 (180 days): the FAR Council must publish a proposed rule requiring covered contractors to comply with NIST’s FIPS, including the post-quantum standards, by 31 December 2030. NIST must start its own PQC migration pilot and revise the Cryptographic Module Validation Program processes to speed up validations. The NSA must report to the President on National Security Systems.
- About 19 March 2027 (270 days): CISA, with NIST, must publish guidance on “the minimum elements for a cryptographic bill of materials”. The FAR Council must publish a second proposed rule so that contractor vulnerability disclosure programmes accept reports of cryptographic vulnerabilities.
As of 16 October 2026, a search of the Federal Register for post-quantum documents published since the order finds no FAR proposed rule, and CISA has not published the CBOM minimum elements. Both remain future events. Any coverage that describes contractor obligations as already in force is ahead of the rulemaking.
What suppliers are likely to be asked next
Once a plan is filed, the gaps in it become work, and much of that work lands on vendors. M-26-15 gives the programme office or requirement owner the role of ensuring that “vendor requirements include PQC-readiness and cryptographic agility provisions”. It tells agencies to use CISA’s list of product categories for technologies that use PQC standards, and to agree PQC responsibilities with FedRAMP-authorised cloud providers under the shared responsibility model.
Read alongside the GAO findings, that points to five requests suppliers should prepare for. This is our reading of the documents rather than a published requirement:
- Which cryptography is in the product, and where. Agencies whose inventories could not be supported by evidence will ask vendors for algorithm-level detail. A machine-readable answer, such as a cryptographic bill of materials (CBOM), is easier to reuse than a questionnaire response.
- A dated roadmap to ML-KEM and ML-DSA. Agencies need it to set realistic milestones for key establishment by 2030 and signatures by 2031.
- Prices. GAO found that vendor cost data was missing and ONCD called it the biggest factor preventing a reliable funding assessment. Expect requests for upgrade and replacement costs.
- Whether the algorithm can be changed by configuration. The plan requires an architecture for cryptographic agility, and products that need a new release for every algorithm change will be harder to fit into it.
- TLS 1.3 support. Agencies must support TLS 1.3 or a successor “as soon as practicable, but not later than January 2, 2030”, and the plan must include testing and deployment milestones for it.
For UK suppliers, the pattern is familiar. The NCSC migration timeline expects discovery and an initial plan by 2028. Both programmes start with an inventory, and our guide to third-party cryptographic risk covers how to record vendor cryptography in a CBOM on either side of that relationship.
How this maps to the ECEM lifecycle
Enterprise Cryptographic Exposure Management (ECEM) describes post-quantum readiness as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. Most of GAO’s findings sit in the first four stages: agencies struggled to discover systems, record accurate algorithm data, assess it and prioritise on that basis. The missing maintenance processes are a Monitor problem, because an inventory with no process for keeping it current starts to go out of date as soon as it is finished. The testing gap belongs to Transition, the stage the deadlines are written for, and that stage depends on all the others.
Where Quantum Sentinel fits
Quantum Sentinel addresses the inventory gaps in the audit: automated discovery, evidence behind each finding, and a record that stays current.
- Automated discovery. Network scanning records the protocols, cipher suites, key exchange and certificates that endpoints negotiate, including TLS, SSH and IKEv2, and reports hybrid post-quantum key exchange by name. Source code assessment covers seventeen languages. Integrations cover key management and HSMs, cloud platforms and databases.
- Evidence. Every observation is scored against one classification, whether it was found on the network, in a key manager, in a database or in source code. Code findings report the algorithm, the file, the line and the enclosing function.
- A current record. Findings land in an Enterprise CBOM exported as CycloneDX 1.7. Policy is evaluated continuously, with drift detection and alerting, and reports export in PDF, Word, Excel and CSV.
Quantum Sentinel does not produce funding estimates, FIPS validation or FedRAMP authorisation. It supplies the inventory and prioritisation evidence that those processes, and a migration plan, depend on. The cryptographic coverage page lists what is covered.
Frequently asked questions
When are PQC migration plans due under OMB M-26-15?
Agencies must submit their PQC Migration Plans to OMB and the Office of the National Cyber Director no later than 120 days from the memorandum’s date of 24 June 2026, which is 22 October 2026. The memorandum does not apply to national security systems.
What did the GAO quantum computing report find?
GAO-27-108740, published on 6 October 2026, found that none of the 24 Chief Financial Officer Act agencies fully addressed three preparatory practices: a prioritised inventory of systems with vulnerable cryptography, a funding assessment and PQC testing. Only one agency had a complete inventory of priority systems, 19 did not use automated inventory tools and none had tested PQC in its own environment.
Does the GAO report assess agencies against M-26-15?
No. The report is a public version of a sensitive report issued in September 2025, and the audit ran from February 2024 to September 2025. GAO measured agencies mainly against OMB M-23-02 from November 2022. Executive Order 14412 and M-26-15 were issued in June 2026, after the audit closed.
Has the FAR rule on post-quantum cryptography for contractors been published?
Not as of 16 October 2026. Executive Order 14412 gives the FAR Council 180 days from 22 June 2026, about 19 December 2026, to publish a proposed rule requiring covered contractors to comply with NIST FIPS, including the post-quantum standards, by 31 December 2030. Who counts as a covered contractor will be set by that rulemaking.
Sources: GAO, GAO-27-108740, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat (6 October 2026, reissued with revisions 14 October 2026); OMB, M-26-15, Execution of the Migration to Post-Quantum Cryptography (24 June 2026); Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register, 25 June 2026); CISA, Product Categories for Technologies That Use Post-Quantum Cryptography Standards.
Further reading: OMB M-26-15 and EO 14412: what the US mandate means for suppliers, why post-quantum deadlines are really inventory deadlines and running a cryptographic discovery pilot in 30 days.