Your Template for OMB M-26-15 Migration

The transition to Post-Quantum Cryptography (PQC) is not just a technical upgrade; it is a vital national security imperative that represents the most significant cryptographic reset in the history of the Federal Government. Driven by Executive Order 14412 and Office of Management and Budget (OMB) M-26-15, Federal Civilian Executive Branch (FCEB) agencies face a strict October 22, 2026 deadline to submit comprehensive PQC Migration Plans to OMB and the Office of the National Cyber Director (ONCD).

To take the heavy lifting off agency leaders facing this tight 120-day window, we developed a ready-to-use Template for OMB M-26-15 Readiness and OMB M-26-15 PQC Migration Plan Instructions. Precision-engineered to align directly with the White House mandates, this template serves as a "fast-track" for federal teams. Instead of spending limited cycles building complex compliance documentation from scratch, security leaders can leverage this template to rapidly map their transition pathways and shift their focus to active discovery and remediation.

Per M-26-15, each agency’s migration plan must contain, at a minimum, nine core elements, all of which are featured in the PQC Migration Plan Template:

• System prioritization strategy with risk-based justification.
• Timelines and milestones to achieve the first three migration phases.
• TLS 1.3 support milestones for the January 2, 2030, deadline.
• Methodologies and automated tools for cryptographic inventory.
• Cryptographic agile architecture implementation plan.
• Third-party coordination plan.
• Estimate of funding and personnel resources.
• Risk management strategy for the migration period.
• Governance roles and responsibilities definition.

Agencies must specifically prioritize high impact systems, High Value Assets (HVAs), and any systems vulnerable to cryptographically relevant quantum computer (CRQC) based attacks. This includes logical access control systems based in asymmetric encryption (such as PKI) and any data expected to remain mission-sensitive through 2030.

For most agencies, the core challenge of a migration plan is uncovering "cryptographic debt,” the years of hidden, legacy encryption buried in fractured IT systems. Because this debt creates unseen risks, establishing cryptographic visibility is the primary enabler for success. Once you can see your entire environment, the path to a quantum-safe future becomes clear and manageable.

A successful migration plan depends on an agency's ability to move quickly and accurately, requiring a fundamental shift in security architecture that prioritizes active discovery over passive lists. By deploying a structured and automated methodology, agencies gain the real-time visibility necessary to:

1. Discover their full cryptographic footprint with total clarity.
2. Protect critical assets against immediate and emerging threats.
3. Accelerate the rollout of quantum-safe resilience across the enterprise.

To maximize your team’s resources, our OMB M-26-15 PQC Migration Plan Instructions and Template for OMB M-26-15 Readiness are a practical "fast-track" for building a compliant transition plan. This template provides a clear implementation methodology and a detailed checklist to ensure all required elements are addressed.

I. Policy Foundation

The federal mandate is driven by two specific directives that agencies must operationalize:

• Executive Order 14412: Accelerates the Federal Government's transition to post-quantum cryptography to mitigate emerging quantum computing threats.
• OMB Memorandum M-26-15: Directs each agency to prioritize critical information technology for migration and develop a plan that integrates PQC readiness into existing governance structures.

While this specific policy targets federal agencies, the global trend is clear: critical infrastructure operators and private sector entities should view this mandate as a strategic blueprint.

II. Compliance Timeline & Milestones

M-26-15 establishes a multi-phased timeline for agency compliance. While initial efforts focus on prioritizing HVAs and high-impact systems to mitigate immediate risk, agencies are expected to complete migration across remaining systems by 2035.

III. Mandatory Elements of the PQC Migration Plan

Agency heads must ensure that their submitted plans address the following nine core elements:

1. System Prioritization Strategy: Risk-based justification addressing HVAs and PKI-based logical access control systems.
2. Timelines and Milestones: Phased migration plans within the initial planning horizon.
3. TLS 1.3 Support Milestones: Testing and deployment timelines for the 2030 deadline.
4. Methodologies and Automated Tools: Documentation of tools used for cryptographic inventory.
5. Cryptographic Agile Architecture: Strategy for algorithm rotation via configuration rather than code.
6. Third-Party Coordination Plan: Delineating the Shared Responsibility Model with cloud providers.
7. Resource & Personnel Allocation: Estimates for annual budget requests.
8. Risk Management Strategy: Specific to the migration period itself.
9. Governance Roles and Responsibilities: Defining implementation and risk acceptance accountability.

IV. Strategic Phasing: Multi-Year Transformation

• Discovery & Strategy (2026-2027): Inventory, assessment, and governance framework setup.
• Piloting (2027-2028): Early migration of prioritized systems.
• Prioritized Key Migration (2028-2030): HVAs and systems vulnerable to CRQC-based attacks.
• Signature Migration (2031): Digital signature protocols for prioritized systems.
• Full Enterprise Migration (2035): Completion for all remaining systems.

V. Operationalizing the Transition with QSS

Quantum-Safe Security (QSS), a FedRAMP Moderate authorized tool, helps agencies move from box-checking to real operational resilience.

Strategic alignment with M-26-15:

• Automated Discovery and CBOM Generation: Real-time visibility and generation of Cryptographic Bills of Materials (CBOM) to identify hidden dependencies.
• FedRAMP Authorized: Accelerates adoption by removing the need for a separate agency-level ATO for the discovery tool.
• Validation of Cryptographic Agility: Ensures systems can rotate to NIST standards (ML-KEM, ML-DSA) without hard-coded updates.
• Integration with Zero Trust: Secures the cryptographic roots of device attestation and inter-service communication.

VI. Conclusion

The transition to quantum-safe cryptography demands immediate leadership. Agencies cannot afford to delay while adversaries continue to archive sensitive data.

Don't start from scratch, fast-track your PQC strategy!

The post Fast-Track Your PQC Strategy: A Template for OMB M-26-15 Readiness appeared first on Palo Alto Networks Blog.

Palo Alto Networks has achieved FedRAMP Moderate authorization for Quantum-Safe Security (QSS), a turnkey Automated Cryptography Discovery and Inventory (ACDI) solution. With this certification, federal agencies can deploy QSS immediately.  The authorization demonstrates that QSS meets stringent security requirements, enabling federal agencies to adopt cutting-edge technologies while safeguarding sensitive, unclassified data. QSS removes operational roadblocks by making cryptographic discovery, risk assessment and transition both continuous and actionable.

Accelerating Mandates for PQC Transition

Executive Order 14412 and OMB Memorandum M-26-15 have moved federal transition milestones well ahead of the original 2035 target. Federal agencies must now transition High Value Assets (HVA) and  high  impact  systems to post-quantum cryptography (PQC) for:

• Key establishment: By December 31, 2030
• Digital signatures: By December 31, 2031

Meeting these compressed timelines demands upgrading from static, manual inventory methods to continuous, automated cryptographic visibility. Traditional, annual spreadsheet audits are point-in-time snapshots that become obsolete the moment they are completed.

As the largest standalone cybersecurity provider, Palo Alto Networks leverages existing federal firewalls as distributed sensors within an integrated platform turns the network into an automated, real-time cryptographic control point. Agencies using the QSS solution will achieve high-fidelity visibility into their network-wide cryptographic posture and active algorithms immediately on Day 0, without introducing operational friction or deployment delays. By utilizing the native cryptographic discovery capabilities built into already deployed firewalls, agencies can activate their PQC migration plans without demanding a net-new, capital-intensive hardware acquisition. This makes Palo Alto Networks solution a fiscally responsible and rapid path to PQC migration execution. 

Technical Architecture: Discovery to Remediation

QSS operationalizes the full PQC migration lifecycle through a unified control plane built on three technical pillars:

• Agentless Discovery: QSS transforms the existing Palo Alto Networks security fabric into a distributed sensor network, providing comprehensive  visibility into encrypted sessions, certificates, and tunnels. This approach identifies hidden cryptographic debt across diverse vendor ecosystems and IoT without forcing new agent rollouts or secondary hardware deployments.
• Prioritized Risk Intelligence: The platform fuses automated cryptographic discovery with rich enterprise context, correlating the mathematical strength of ciphers and certificates against asset criticality and data sensitivity categorization. This multidimensional risk engine enables teams to move beyond raw technical alerts and focus resources on protecting long-lived, high-value data against Harvest Now, Decrypt Later (HNDL) attacks and cryptographic debt.
• Active Inline Remediation: QSS moves beyond reporting to active risk reduction. For most legacy systems that cannot natively support PQC, Cipher Translation allows the firewall to translate weak classical encryption into quantum-safe standards at the network edge, shielding unpatchable assets without requiring application code changes.

Immediate Implementation

The Executive Order on Securing the Nation Against Advanced Cryptographic Attacks confirms that PQC is a national security imperative, not just a compliance requirement. For agencies, that means treating the shift to post-quantum cryptography as a strategic initiative that protects critical data today and safeguards it against tomorrow's threats. Our FedRAMP Moderate authorization reinforces that Palo Alto Networks is a proven partner in that effort, helping agencies build a cohesive posture that is "Secured in America" and made for the needs of the U.S. government. We're committed to helping the public sector modernize with confidence.

Get Ahead of the Mandate

Stop guessing which digital locks to change first. Quantum-Safe Security transforms your existing infrastructure into a high-fidelity sensor network to neutralize "harvest now, decrypt later" (HNDL) risks without new architectural complexity. Explore our FedRAMP Moderate authorized platform to see how you can achieve zero-downtime cryptographic resilience and bridge the gap for unpatchable legacy systems via in-line enforcement.

The post FedRAMP Moderate Authorization for Palo Alto Networks Quantum-Safe Security appeared first on Palo Alto Networks Blog.