FEDQUANTUM SIGNAL 008
FEDERAL PQC READINESS · OCTOBER 2026
Washington’s quantum deadline has arrived. Now comes the harder part.
Federal agencies face an October 22 deadline to submit their post-quantum cryptography migration plans to the Office of Management and Budget. But a newly released Government Accountability Office assessment reveals substantial gaps in federal preparedness, raising a more consequential question: whether agencies have the visibility, resources and operational capabilities needed to turn those plans into action.
THE SIGNAL · WHY IT MATTERS · WHAT TO WATCH · FEDQUANTUM VIEW
THE SIGNAL
The federal government has reached its first major PQC planning milestone.
October 22 marks an important milestone in the federal government's transition to post-quantum cryptography. Under OMB Memorandum M-26-15, agencies must submit migration plans outlining how they intend to identify vulnerable cryptography, prioritize critical systems and transition toward quantum-resistant protections.
The memorandum establishes a phased approach extending through 2035, with priority given to high-value assets, high-impact systems and sensitive information that could remain vulnerable to future quantum-enabled attacks. It also emphasizes cryptographic inventories, risk-based prioritization, governance, automation and the ability to change cryptographic algorithms with minimal operational disruption.
The deadline arrives alongside a sobering assessment of federal readiness. In a report reissued with revisions on October 14, the Government Accountability Office found that none of the 24 major federal agencies examined had fully addressed the preparatory practices evaluated for the post-quantum transition. GAO identified gaps involving cryptographic expertise, inventory processes, funding assessments and testing plans.
The federal government now faces a defining implementation challenge: converting policy requirements into executable modernization programs across some of the nation's most complex technology environments.
WHY IT MATTERS
A migration plan is only as credible as the infrastructure knowledge behind it.
Post-quantum cryptography is frequently discussed in terms of algorithms and deadlines. Yet the operational challenge extends much further. Cryptographic protections are embedded throughout applications, networks, identity systems, hardware, cloud platforms and third-party technologies, often in ways that organizations do not fully understand.
That visibility problem is becoming increasingly difficult to ignore.
During a recent ACT-IAC discussion, federal technology practitioners described the complexity of discovering cryptography across interconnected systems and the importance of maintaining mission continuity during migration. Customs and Border Protection discussed a measured approach to early implementation, while GSA described experimentation involving quantum-resistant identity credentials and public-key infrastructure.
OMB's guidance recognizes these challenges. Agencies must account for legacy technologies, coordinate with vendors and cloud providers, estimate funding and personnel requirements, and incorporate crypto-agility into their modernization strategies.
The implications extend beyond federal CIO and cybersecurity offices. Technology suppliers, systems integrators, cloud providers and contractors will increasingly be expected to explain how their products support quantum-resistant cryptography and how those capabilities can evolve without requiring disruptive system replacements.
October 22 is therefore more than a planning deadline. It is an early test of whether quantum readiness is becoming an enterprise-wide operational priority.
WHAT TO WATCH
The next measure of progress will be execution, not submission.
The immediate question is whether agencies can translate their initial migration plans into measurable implementation activity.
OMB's framework anticipates continued discovery and planning through 2027, followed by pilots and early migrations during 2027–2028. Priority systems are expected to transition to post-quantum key establishment by the end of 2030, with digital-signature migration following in 2031 and broader completion targeted for 2035.
Several developments will help indicate whether the transition is gaining operational momentum.
First, watch how agencies improve cryptographic inventories and identify dependencies across applications, devices and third-party systems. Without reliable visibility, migration priorities and resource estimates will remain difficult to validate.
Second, watch for funded pilot programs, procurement requirements and reusable technical architectures. Early implementations should begin revealing the performance, interoperability and operational challenges that cannot be resolved through policy guidance alone.
Finally, watch how OMB, CISA, NIST and other federal organizations respond to the findings of GAO and the lessons emerging from agency implementation efforts. Additional technical guidance, shared resources and coordinated acquisition approaches could materially influence the pace of adoption.
The most important evidence of progress will not necessarily be the number of plans submitted. It will be whether agencies begin demonstrating repeatable methods for modernizing cryptography across mission-critical environments.
FEDQUANTUM VIEW
The quantum transition is entering its accountability phase.
For several years, the federal post-quantum discussion has focused on the emerging threat, the development of standards and the need for agencies to prepare. Those efforts have established the foundation for a national transition, but they have not resolved the practical difficulties of implementation.
October 22 represents a shift in emphasis. Agencies are now expected to articulate how they will manage the transition, which systems they will prioritize, what resources they will require and how they intend to address the risks associated with changing cryptography across complex environments.
The GAO findings suggest that significant work remains. That should not obscure the importance of the deadline. Initial migration plans are intended to evolve as agencies improve their inventories, conduct pilots and gain implementation experience.
The larger question is whether federal leadership, funding, acquisition and technology modernization can remain aligned over a transition extending across multiple years and generations of computing infrastructure.
The deadline for planning has arrived. The measure of federal quantum readiness will now be the government's ability to execute.Y
SOURCES & FURTHER READING
This Signal draws primarily on OMB Memorandum M-26-15, which establishes the federal government's post-quantum cryptography migration requirements and October 22, 2026, planning deadline, together with the Government Accountability Office's recent assessment of federal agency preparedness. Additional context comes from recent federal cybersecurity discussions and reporting on the operational challenges of cryptographic modernization. FedQuantum's analysis examines the implications for federal quantum readiness, agency implementation, procurement and the transition toward crypto-agile infrastructure. FedQuantum's analysis and conclusions are independent.
OFFICE OF MANAGEMENT AND BUDGET
Execution of the Migration to Post-Quantum Cryptography (M-26-15) — June 24, 2026
Primary authority for the October 22 submission deadline, required plan elements, migration phases, crypto-agility and interagency responsibilities.
U.S. GOVERNMENT ACCOUNTABILITY OFFICE
Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat — Reissued with revisions October 14, 2026
GAO's assessment of 24 major federal agencies, identifying deficiencies in cryptographic inventories, resource planning and migration testing. The report includes 89 recommendations to 23 agencies.
FEDERAL NEWS NETWORK
In Preparing for PQC, Agencies Must Ensure Integration with Smart Identity Cards — October 2026
Recent reporting on agency migration plans, CISA's emphasis on cryptographic discovery and the operational challenges surrounding federal identity modernization.
BIOMETRIC UPDATE
GAO Finds US Agencies Unprepared for Quantum Threats to Digital Identity — October 17, 2026
Additional reporting connecting GAO's findings to the approaching federal planning deadline and the implications for digital identity systems.