* [Blog](https://www.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/) * [Critical Infrastructure](https://www.paloaltonetworks.com/blog/network-security/category/critical-infrastructure/) * Fast-Track Your PQC Strat... # Fast-Track Your PQC Strategy: A Template for OMB M-26-15 Readiness [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2026%2F10%2Ffast-track-your-pqc-strategy-a-template-for-omb-m-26-15-readiness%2F) [](https://twitter.com/share?text=Fast-Track+Your+PQC+Strategy%3A+A+Template+for+OMB+M-26-15+Readiness&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2026%2F10%2Ffast-track-your-pqc-strategy-a-template-for-omb-m-26-15-readiness%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2026%2F10%2Ffast-track-your-pqc-strategy-a-template-for-omb-m-26-15-readiness%2F&title=Fast-Track+Your+PQC+Strategy%3A+A+Template+for+OMB+M-26-15+Readiness&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2026/10/fast-track-your-pqc-strategy-a-template-for-omb-m-26-15-readiness/&ts=markdown) \[\](mailto:?subject=Fast-Track Your PQC Strategy: A Template for OMB M-26-15 Readiness) Link copied By [Matt Marsden](https://www.paloaltonetworks.com/blog/author/matt-marsden/?ts=markdown "Posts by Matt Marsden") Oct 16, 2026 5 minutes [Critical Infrastructure](https://www.paloaltonetworks.com/blog/network-security/category/critical-infrastructure/?ts=markdown) [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [Quantum Security](https://www.paloaltonetworks.com/blog/network-security/category/quantum-security/?ts=markdown) ## Your Template for OMB M-26-15 Migration The transition to Post-Quantum Cryptography (PQC) is not just a technical upgrade; it is a vital national security imperative that represents the most significant cryptographic reset in the history of the Federal Government. Driven by [Executive Order 14412](https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/) and [Office of Management and Budget (OMB) M-26-15](https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf), Federal Civilian Executive Branch (FCEB) agencies face a strict **October 22, 2026** deadline to submit comprehensive PQC Migration Plans to OMB and the Office of the National Cyber Director (ONCD). To take the heavy lifting off agency leaders facing this tight 120-day window, we developed a ready-to-use [Template for OMB M-26-15 Readiness](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-template-fillable.pdf?ts=markdown) and [OMB M-26-15 PQC Migration Plan Instructions](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-instructions.pdf?ts=markdown). Precision-engineered to align directly with the White House mandates, this template serves as a "fast-track" for federal teams. Instead of spending limited cycles building complex compliance documentation from scratch, security leaders can leverage this template to rapidly map their transition pathways and shift their focus to active discovery and remediation. Per M-26-15, each agency's migration plan must contain, at a minimum, nine core elements, all of which are featured in the PQC Migration Plan Template: * System prioritization strategy with risk-based justification. * Timelines and milestones to achieve the first three migration phases. * TLS 1.3 support milestones for the January 2, 2030, deadline. * Methodologies and automated tools for cryptographic inventory. * Cryptographic agile architecture implementation plan. * Third-party coordination plan. * Estimate of funding and personnel resources. * Risk management strategy for the migration period. * Governance roles and responsibilities definition. Agencies must specifically prioritize high impact systems, High Value Assets (HVAs), and any systems vulnerable to cryptographically relevant quantum computer (CRQC) based attacks. This includes logical access control systems based in asymmetric encryption (such as PKI) and any data expected to remain mission-sensitive through 2030. For most agencies, the core challenge of a migration plan is uncovering "cryptographic debt," the years of hidden, legacy encryption buried in fractured IT systems. Because this debt creates unseen risks, establishing cryptographic visibility is the primary enabler for success. Once you can see your entire environment, the path to a quantum-safe future becomes clear and manageable. A successful migration plan depends on an agency's ability to move quickly and accurately, requiring a fundamental shift in security architecture that prioritizes active discovery over passive lists. By deploying a structured and automated methodology, agencies gain the real-time visibility necessary to: 1. **Discover** their full cryptographic footprint with total clarity. 2. **Protect** critical assets against immediate and emerging threats. 3. **Accelerate** the rollout of quantum-safe resilience across the enterprise. To maximize your team's resources, our [OMB M-26-15 PQC Migration Plan Instructions](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-instructions.pdf?ts=markdown) and [Template for OMB M-26-15 Readiness](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-template-fillable.pdf?ts=markdown) are a practical "fast-track" for building a compliant transition plan. This template provides a clear implementation methodology and a detailed checklist to ensure all required elements are addressed. *** ** * ** *** ### I. Policy Foundation The federal mandate is driven by two specific directives that agencies must operationalize: * **Executive Order 14412:** Accelerates the Federal Government's transition to post-quantum cryptography to mitigate emerging quantum computing threats. * **OMB Memorandum M-26-15:** Directs each agency to prioritize critical information technology for migration and develop a plan that integrates PQC readiness into existing governance structures. While this specific policy targets federal agencies, the global trend is clear: critical infrastructure operators and private sector entities should view this mandate as a strategic blueprint. ### II. Compliance Timeline \& Milestones M-26-15 establishes a multi-phased timeline for agency compliance. While initial efforts focus on prioritizing HVAs and high-impact systems to mitigate immediate risk, agencies are expected to complete migration across remaining systems by 2035. | Deadline | Policy Requirement \& Milestone | |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------| | **July 22, 2026** | PQC Migration Lead Designation: Agencies must formally identify a PQC migration lead. | | **Oct 22, 2026** | Submittal of PQC Migration Plan: Deadline for agencies to deliver a dynamic migration roadmap to OMB and ONCD. | | **Jan 2, 2030** | TLS 1.3 Implementation: Agencies must support TLS 1.3 (or a successor version) to enable the extensible handshake needed for hybrid-PQC key exchange models. | | **Dec 31, 2030** | Key Establishment Deadline: Agencies must transition all HVAs and high impact systems to PQC (FIPS 203 ML-KEM) for key establishment. | | **Dec 31, 2031** | Digital Signature Deadline: Transition all HVAs and high impact systems to PQC for digital signatures using FIPS 204 (ML-DSA) or FIPS 205 (SLH-DSA). | ### III. Mandatory Elements of the PQC Migration Plan Agency heads must ensure that their submitted plans address the following nine core elements: 1. **System Prioritization Strategy:** Risk-based justification addressing HVAs and PKI-based logical access control systems. 2. **Timelines and Milestones:** Phased migration plans within the initial planning horizon. 3. **TLS 1.3 Support Milestones:** Testing and deployment timelines for the 2030 deadline. 4. **Methodologies and Automated Tools:** Documentation of tools used for cryptographic inventory. 5. **Cryptographic Agile Architecture:** Strategy for algorithm rotation via configuration rather than code. 6. **Third-Party Coordination Plan:** Delineating the Shared Responsibility Model with cloud providers. 7. **Resource \& Personnel Allocation:** Estimates for annual budget requests. 8. **Risk Management Strategy:** Specific to the migration period itself. 9. **Governance Roles and Responsibilities:** Defining implementation and risk acceptance accountability. ### IV. Strategic Phasing: Multi-Year Transformation * **Discovery \& Strategy (2026-2027):** Inventory, assessment, and governance framework setup. * **Piloting (2027-2028):** Early migration of prioritized systems. * **Prioritized Key Migration (2028-2030):** HVAs and systems vulnerable to CRQC-based attacks. * **Signature Migration (2031):** Digital signature protocols for prioritized systems. * **Full Enterprise Migration (2035):** Completion for all remaining systems. ### V. Operationalizing the Transition with QSS [Quantum-Safe Security (QSS)](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown), a [FedRAMP Moderate authorized tool](https://www.paloaltonetworks.com/blog/2026/09/fedramp-moderate-authorization-for-palo-alto-networks-quantum-safe-security/?ts=markdown), helps agencies move from box-checking to real operational resilience. #### Strategic alignment with M-26-15: * **Automated Discovery and CBOM Generation:** Real-time visibility and generation of Cryptographic Bills of Materials (CBOM) to identify hidden dependencies. * **FedRAMP Authorized:** Accelerates adoption by removing the need for a separate agency-level ATO for the discovery tool. * **Validation of Cryptographic Agility:** Ensures systems can rotate to NIST standards (ML-KEM, ML-DSA) without hard-coded updates. * **Integration with Zero Trust:** Secures the cryptographic roots of device attestation and inter-service communication. ### VI. Conclusion The transition to quantum-safe cryptography demands immediate leadership. Agencies cannot afford to delay while adversaries continue to archive sensitive data. **Don't start from scratch, fast-track your PQC strategy!** [Download Instructions (PDF)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-instructions.pdf?ts=markdown)[Download Fillable Template (PDF)](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/10/pqc-migration-plan-template-fillable.pdf?ts=markdown) [Request a demo and learn how QSS can automate your discovery journey today](https://www.paloaltonetworks.com/network-security/quantum-demo?ts=markdown) *** ** * ** *** ## Related Blogs ### [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### FedRAMP Moderate Authorization for Palo Alto Networks Quantum-Safe Security](https://www.paloaltonetworks.com/blog/2026/09/fedramp-moderate-authorization-for-palo-alto-networks-quantum-safe-security/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown), [Quantum Security](https://www.paloaltonetworks.com/blog/network-security/category/quantum-security/?ts=markdown) [#### NIST and PQC Readiness: Managing the Quantum-Safe Shift](https://www.paloaltonetworks.com/blog/network-security/nist-and-pqc-readiness-managing-the-quantum-safe-shift/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### Securing Canada's Digital Future: Why PBMM Matters Beyond Government](https://www.paloaltonetworks.com/blog/2026/06/securing-canadas-digital-future-why-pbmm-matters-beyond-government/) ### [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown), [Vertical](https://www.paloaltonetworks.com/blog/category/vertical/?ts=markdown) [#### Idira Identity Security Platform Reaches FedRAMP High Milestone](https://www.paloaltonetworks.com/blog/identity-security/idira-identity-security-platform-reaches-fedramp-high-milestone/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown) [#### Securing the UK's Digital Future](https://www.paloaltonetworks.com/blog/2026/04/securing-uks-digital-future/) ### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Public Sector](https://www.paloaltonetworks.com/blog/category/public-sector/?ts=markdown), [Vertical](https://www.paloaltonetworks.com/blog/category/vertical/?ts=markdown) [#### Closing the Gap by Enhancing Visibility and Mitigating Risks](https://www.paloaltonetworks.com/blog/2026/04/enhancing-visibility-and-mitigating-risks/) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language