Plan generator
Migration plan generator
A migration plan drafted against every element M-26-15 requires, with your details filled in.
How this works
OMB M-26-15 requires agency plans to carry risk-based prioritization, phased timelines, an automated inventory methodology, a crypto-agility architecture plan, third-party coordination, resource estimates and named governance roles. This produces a draft structured against exactly those elements, with your organization and dates filled in.
Q-Watch NetworkHow much time is left? Sister site QSense Watch has a Q-Day clock you can adjust.See the QSense Q-Day clock
Preview
POST-QUANTUM CRYPTOGRAPHY MIGRATION PLAN [Organization] Prepared for submission: 2026-10-22 Accountable official: [Accountable official], Chief Information Security Officer Governing authority: Executive Order 14412 (June 22, 2026) and OMB Memorandum M-26-15 (June 24, 2026). Key establishment migrated for prioritized systems by 2030, digital signatures by 2031, remaining systems by 2035. 1. SCOPE AND MISSION CONTEXT ---------------------------- [Organization] operates [n] in-scope information systems, of which [n] are designated High Value Assets or FIPS 199 high-impact. [One paragraph describing the mission the cryptography protects, the data types held, and the confidentiality horizon of that data.] Systems holding data that must remain confidential beyond 2035 are treated as already exposed to harvest-now-decrypt-later collection and are prioritized accordingly, independent of their impact rating. 2. RISK-BASED PRIORITIZATION ---------------------------- Tier 1: High Value Assets, FIPS 199 high-impact systems, and any system whose data remains mission-sensitive in 2030. Tier 2: systems using asymmetric cryptography for logical access control, including PKI, identity federation and privileged access. Tier 3: remaining systems, sequenced against hardware refresh and cloud migration schedules. Systems incapable of supporting post-quantum or hybrid cryptography are identified in Phase 1 and given priority for replacement or decommissioning rather than being carried to the end of the schedule. [Sections 3 through 9 are included in the full generated plan.] Remaining sections: automated inventory methodology, crypto-agility architecture, phased timeline with dates, third-party and supply chain coordination, resource and funding estimate, governance and accountable roles, measurement and reporting, and an appendix of authorities.
Unlock the full plan
Professional generates all ten sections, the phased timeline with your dates, the vendor and funding language, and a downloadable, versioned draft you can edit and file.