COLUMBIA, Md., September 4, 2026. Every executive branch agency owes the Office of Management and Budget and the Office of the National Cyber Director a post quantum cryptography migration plan by October 22, 2026. Agencies that have not yet inventoried where their cryptography lives have under seven weeks to produce one. LEXX will run a 60 minute working session, The Race to Quantum Readiness, on Wednesday, October 7 at 1 p.m. ET on what the memorandum actually asks for and how to assemble a submission that holds up.
Registration is open at $49 per attendee through September 15, after which the price returns to $95. Every registrant receives live access, the full recording, and a plan outline mapped to the memorandum's requirements. Details and registration are at https://lexx.com/webinars/the-race-to-quantum-readiness-what-every-organization-needs-to-know-before-october-22/
The deadline, and who it lands on In June, the Office of Management and Budget issued Memorandum M-26-15, "Execution of the Migration to Post-Quantum Cryptography," implementing the executive order "Securing the Nation Against Advanced Cryptographic Attacks" signed on June 22, 2026. The memorandum directs each agency to develop and submit a post quantum cryptography migration plan to OMB and the Office of the National Cyber Director no later than 120 days from the date of the memorandum. That window closes on October 22, 2026. The memorandum states that it does not apply to national security systems.
The memorandum sets out what the initial submission must contain at a minimum, and the list is longer than most teams expect. It runs to nine items. They are a system prioritization strategy with risk based justification, timelines and milestones for the migration phases, separate timelines for testing and deployment against the memorandum's TLS 1.3 support deadline, the methodologies and automated tools used for the cryptographic inventory, a plan for implementing a cryptographic agile architecture, a third party coordination plan, an estimate of funding and personnel resources, a risk management strategy, and a section defining governance roles and responsibilities.
The requirement does not stop at the agencies. Each plan must include a third party coordination plan, and the memorandum tells agencies they should ensure that requirements for the products they buy include post quantum integration. Contractors and subcontractors selling into the federal government should expect those provisions to reach them through their contracts.
Why the exposure is already there The threat behind the deadline does not wait for a working quantum computer. Adversaries are collecting encrypted traffic today on the expectation of decrypting it once a cryptographically relevant quantum computer exists, a pattern the field calls harvest now, decrypt later. Data with a long confidentiality life, regulated records, personnel files, and anything with a multi year retention requirement, is exposed the moment it crosses the wire rather than years from now when the decryption becomes practical.
That is the argument for treating October 22 as a starting line rather than a filing date. An agency that submits a plan built on a real cryptographic inventory knows what it is protecting. One that submits a plan assembled to meet the date does not.
Any organization can begin that inventory now, without waiting for a vendor or a budget cycle. Listing the systems that use asymmetric cryptography, noting which of them hold data that must stay confidential past 2030, and identifying the third parties who would have to move in step is work that requires no procurement and produces the spine of a submittable plan.
What the session covers The session is built for the people who owe OMB a document, not for the engineers who will later implement the migration. It covers what M-26-15 requires in a submitted plan, how to recognize whether an organization's data is already exposed to harvest now, decrypt later, and a cryptographic inventory approach that does not require a two year discovery project before it produces anything usable. It also gives attendees a working definition of crypto agility to bring to leadership and a plan outline mapped to the memorandum's required components.
Fifteen minutes of the hour are reserved for live questions.
LEXX built the session for agency post quantum migration leads, the chief information officer and chief information security officer staff supporting a submission, and government contractors preparing for the requirements expected to follow. Anyone else is welcome, though the material is organized around that deadline.
The session may qualify for continuing education credit. Attendees should confirm eligibility with their own organization or credentialing provider.
Who is presenting The session is led by Boyko Antonov, Ph.D., a post quantum cryptography subject matter expert with more than thirty years of technology leadership across federal agencies, IBM, and PwC, who now works on post quantum cryptography full time at Techyon, a consultancy dedicated to that work. Ben Tchoubineh, chief executive officer of LEXX, hosts. The session is part of a working session series LEXX runs with Techyon.
Registration Seats are limited and early pricing ends September 15, 2026. Registration and full session details are at https://lexx.com/webinars/the-race-to-quantum-readiness-what-every-organization-needs-to-know-before-october-22/
About LEXX LEXX is a cybersecurity and IT certification training provider with a training center in Columbia, Maryland. Its instructor-led arm, LEXX Live, is trusted by government agencies and Fortune 500 companies and works with more than four hundred certified expert instructors across cybersecurity, cloud, networking, artificial intelligence, and IT service management, reporting pass rates above ninety percent. LEXX also delivers self-paced online courseware through its learning platform.