US No‑Exceptions Mandate Accelerates Post‑Quantum Crypto Migration for Federal Agencies
OMB Memorandum M‑26‑15 requires federal agencies to submit risk‑prioritized post‑quantum migration plans, identify legacy systems that cannot be upgraded, and place those systems on a replacement or decommission budget line. The guidance highlights the need for continuous cryptographic inventory and documented risk acceptance, a key control‑assurance focus for audit readiness.
ADTP Breach Watch· October 23, 2026· DataBreachToday
SeverityMedium
Type🏛️ Advisory
ConfidenceHigh
ReportedOct 23, 2026
Government & Public SectorFederal civilian agenciesGovernment contractors handling federal dataPrivate‑sector firms with legacy systems that process government informationUnknown
What happened
The Office of Management and Budget issued Memorandum M‑26‑15, obligating all federal civilian agencies to file a risk‑prioritized post‑quantum cryptography migration plan, inventory cryptographic assets, set milestones, and identify legacy systems that cannot support quantum‑safe algorithms. Those systems must be earmarked for replacement or decommissioning, with any exceptions requiring senior‑leader‑owned risk acceptance.
Why it matters for trust and compliance
The memo forces organizations to prove continuous control over cryptographic agility and legacy risk, providing the evidence needed for a defensible audit trail across multiple frameworks.
Enables continuous evidence collection for cryptographic‑agility controls, satisfying audit‑readiness requirements.
Provides a structured risk‑acceptance and budgeting process that demonstrates due diligence to regulators.
Who is affected
Federal civilian agenciesGovernment contractors handling federal dataPrivate‑sector firms with legacy systems that process government information
Recommended actions
Conduct a comprehensive cryptographic asset inventory and classify systems for PQC readiness.
Map inventory results to the cryptographic‑management control objective and capture supporting evidence.
Implement a formal risk‑acceptance workflow with senior‑owner sign‑off and dedicated budget lines for legacy exceptions.
Leverage a continuous control‑mapping platform to keep evidence up‑to‑date and audit‑ready.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.