Within a 48-hour span in late June 2026, the federal government put out three documents: Executive Order 14412, OMB memorandum M-26-15, and the Department of War’s first enterprise-wide post-quantum cryptography strategy. The commentary since has split into two predictable camps: “finally, real deadlines,” or “we’ve heard this before.” Neither take is wrong exactly. Both skip past the detail that matters, which isn’t the dates but the beliefs underneath them.
I’ve spent enough hours in migration planning to know that dates rarely sink a program. It’s the assumptions baked in below the dates that do.
EO 14412 mandates federal agencies to move high-value assets to post-quantum key establishment by December 31, 2030, and to post-quantum digital signatures by December 31, 2031. That pulls the previous 2035 horizon forward by five years. A forthcoming FAR rule will extend the same requirement to contractors.
M-26-15 is the machinery underneath the order, even though it hasn’t drawn nearly as many headlines. It turns the mandate into a five-phase operational plan for civilian agencies, with migration plans due to OMB in 120 days.
The DoW strategy is the sharpest of the three. Support PQC or retire the system by 2030. Use PQC everywhere “unless otherwise noted” by 2031. That covers even the hardest cases: legacy PKI, operating systems, cloud, constrained edge devices.
Three coordinated documents. One shared narrative. What they don’t do is resolve the seams between them, and that’s where the operational risk collects.
M-26-15 calls the cryptographic inventory the foundation of the whole migration plan: dynamic, continuously updated, covering every algorithm, key, and certificate in use. Every later phase, from pilots to prioritized migration, assumes that foundation already exists and keeps updating itself. Most organizations don’t have anything close to it today.
The memo is unusually direct about how that inventory needs to get built, too. In its section on automation, it states plainly:
“Manual processes are often inadequate for a migration of this scope. Agencies should take advantage of automation for discovery, policy enforcement, and compliance.”
— OMB Memorandum M-26-15, “Leveraging Automation for Discovery and Enforcement”
Read that next to the process most agencies are actually running today. M-23-02, the memo M-26-15 replaces, required an annual manual inventory, which in practice meant someone on staff going system by system, researching each piece of hardware and software by hand to figure out what cryptography it used, then writing it down somewhere that probably wasn’t kept current past the reporting deadline.
M-26-15 doesn’t carry that forward. It treats manual discovery as insufficient on its own and expects agencies to build the inventory with tooling instead: Software Composition Analysis against software bills of materials, SAST/DAST scanning for cryptographic functions in code, network scanners for protocols and cipher suites, all of it feeding into a central Cryptographic Bill of Materials. It’s a good idea on paper. Whether most agencies have the budget, the staff, or the vendor maturity to pull it off in 120 days is a separate question, and one the memo doesn’t really address.
For a lot of agencies and contractors, that’s a bigger lift than the deadline math suggests. If your inventory today lives in spreadsheets and institutional memory, the guidance is telling you, in writing, that it won’t hold up.
Federal PQC guidance has run two separate tracks since 2022. Civilian systems fall under OMB. National Security Systems fall under NSA’s CNSA 2.0. EO 14412 pulled the civilian deadline five years forward, closing much of the gap with CNSA 2.0’s own dates but not all of it. A defense prime now has to track both: a 2030 FIPS compliance date likely coming via the FAR rule, and CNSA 2.0’s category-specific dates, where software signing and networking gear hit exclusive PQC use by 2030, but operating systems, browsers, cloud, and legacy equipment get until 2033.
Then there’s the validation bottleneck, which is coming for everyone at the same time regardless of which clock they’re on. FIPS 140-2 certificates move to historical status in September 2026. Every organization trying to validate ML-KEM and ML-DSA implementations is heading into the same CMVP queue at once. Political urgency and NIST’s validation throughput are not the same clock. None of the three documents grapples with that mismatch directly. You mostly notice it once you try to schedule the work for real.
If you run security for a large enterprise, a defense prime, or a federal program office, the next four months matter more than the next four years.
These three documents make the quantum risk hard to ignore. What they don’t do is settle the seams between them: civilian versus defense, the EO versus CNSA 2.0, political urgency versus validation throughput. That’s where the work sits for the next four years.
Skip the vendor evaluation and the algorithm debate for now. Ask your team one question this week: can we produce a cryptographic inventory today? If the answer is no, the follow-up is who owns getting one built in the next 90 days.
Most organizations will spend the next few months arguing about 2030. The more useful number is however long the inventory takes, and right now almost nobody knows what that number is.