The US Federal CBOM Mandate: What OMB M-26-15 Requires, and Who It Leaves Out

Federal civilian agencies have twenty-one days to submit a post-quantum migration plan, and the plan has to be built on a Cryptographic Bill of Materials.

That requirement comes from OMB Memorandum M-26-15, "Execution of the Migration to Post-Quantum Cryptography," signed by OMB Director Russell T. Vought on 24 June 2026. It implements Executive Order 14412 of 22 June and OMB's guidance duty under the Quantum Computing Cybersecurity Preparedness Act. Plans are due within 120 days of the memo, to OMB and the Office of the National Cyber Director, which puts the date at 22 October 2026.

Why this one is different

Most cryptographic-inventory requirements describe the substance and leave the artefact open. SEBI tells securities-market entities to maintain an inventory of cryptographic assets. IRDAI asks insurers whether they maintain one. Neither names a format, and neither says "CBOM."

M-26-15 does. It requires the migration plan to rest on "a dynamic, continuously updated automated cryptographic inventory," feeding a central Cryptographic Bill of Materials, as its foundation. Three words in that phrase do work: dynamic and continuously updated rule out a one-time scan filed as evidence, and automated rules out a spreadsheet maintained by hand.

That makes it the clearest CBOM mandate currently tracked on this site.

The five phases

M-26-15 sets a sequence rather than a single date:

Phase	Scope	Window
1	Strategy, planning and discovery	2026–2027
2	Pilots and early migration	2027–2028
3	Prioritized migration	2028–2030
4	Signature migration	2031
5	Full migration	2035

Separately, the memo sets an objective to mitigate as much quantum risk as feasible by 31 December 2030. That is an objective, not a phase boundary, and the distinction matters when an agency is deciding what to fund in which budget cycle.

Appendix A names crypto-agility as an architectural principle in its own right, alongside algorithm selection under FIPS 203, 204 and 205, hybrid architectures, TLS 1.3 and zero-trust integration. An agency that migrates to ML-KEM without becoming able to change algorithm again has met the letter and missed the point.

Executive Order 14412 sets harder dates for less

The EO that M-26-15 implements carries its own deadlines, and they are tighter: 31 December 2030 for key establishment and 31 December 2031 for digital signatures.

They also apply to far less. Those dates bind designated federal high-value assets and high-impact systems, not the federal civilian estate as a whole, and the EO states no enforcement penalties. An agency reading both documents is working to the M-26-15 phases for everything and to the EO dates for a named subset.

The EO does one more thing worth marking in a calendar: it directs CISA and NIST to publish CBOM minimum-elements guidance within 270 days, which falls on 19 March 2027. The US does not yet have a published answer to what belongs inside a CBOM. It has an instruction to produce one.

What is explicitly out of scope

M-26-15 excludes national security systems. They sit under NSA's CNSA 2.0 suite, on a separate timeline, under a separate authority.

This is the most common error in summaries of US policy: CNSA 2.0 dates get quoted as though they apply to civilian agencies, or M-26-15's 2035 gets quoted as though it covers NSS. Neither is true, and an agency that follows the wrong one is building to the wrong schedule.

The gap: US banks have no requirement

If you work in US financial services, the honest position is that none of your federal regulators requires a cryptographic inventory today.

Federal Reserve. No Supervision and Regulation letter addresses PQC or cryptographic inventory. The only Fed-hosted document on the topic is a FEDS staff research paper, explicitly disclaimed as not representing Board views or guidance.

OCC. No bulletin addresses it. A claim that the OCC issued PQC guidance in December 2022 circulates widely and could not be traced to any actual bulletin or rule. If someone cites it, ask for the number.

SEC. Neither the 2023 cybersecurity disclosure rule nor its accompanying guidance mentions post-quantum cryptography or cryptographic inventory.

FFIEC. Co-hosted a non-public forum with CISA on PQC in September 2022. No published guidance resulted.

FDIC is the one moving. Its 2025 Report on Cybersecurity and Resilience discusses harvest-now-decrypt-later directly, and discloses that FDIC's 2024 horizontal examinations of significant service providers evaluated "risks associated with developments in quantum computing." That is dated supervisory activity rather than a standard, but examiners asking about something is usually how a standard starts. We cover that report separately.

We list the four that have published nothing rather than omitting them, because for a compliance team "we checked and found nothing" is the answer, and it is a different answer from silence.

What to do with this

If you are a federal civilian agency, the plan is due 22 October 2026 and the inventory is its foundation, not an annex.

If you are a federal contractor, the mandate reaches you through procurement before it reaches you directly, and agencies in Phase 1 discovery through 2027 will be asking what you ship.

If you are a US bank, you have no requirement, a watching FDIC, and a CISA/NIST minimum-elements publication due March 2027 that will become the reference point whenever your regulator does move. Building the inventory now is a judgement call about timing, not a compliance obligation.

The United States country page tracks each instrument with its primary source.