Core campus switching
Critical gap · 83/100
What to do: Hold the vendor to the published date in writing. Add crypto-agility language to the next renewal and set a checkpoint 90 days before the announced release.
Dependency gap
Vendor readiness and dependency gap register
Turn "the vendor is not ready" into a dated, defensible artifact.
How this works
Most organizations cannot migrate their routers, switches, HSMs, OT controllers or embedded systems today, because the vendor has not shipped a post-quantum option. OMB M-26-15 does not require the impossible. It requires an inventory, a risk-based priority, a third-party coordination plan and a resource estimate. Record each dependency, the compensating control you applied and the refresh date, then generate an exception memo an auditor will accept.
1
Systems with no vendor path
1
Critical residual risk
1
High risk, no compensating control
Exception memo
A dated memorandum for the record listing every system with no vendor path, the compensating control applied, the residual risk, and the acquisition action. This is the artifact an auditor or an OMB reviewer asks for when the honest answer is "not available yet."
Preview
MEMORANDUM FOR THE RECORD
Date: 2026-10-16
Organization: Your organization
Prepared by: Prepared by
Subject: Post-quantum cryptography dependency exceptions and compensating controls
1. PURPOSE
This memorandum records systems in the organization's cryptographic inventory for which no vendor-supported post-quantum path is currently available, the compensating controls applied in the interim, and the planned remediation trigger for each. It is intended to satisfy the third-party dependency and risk-based prioritization elements of OMB M-26-15 and to serve as audit evidence that unremediated items are tracked rather than unknown.
2. AUTHORITIES
a. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
b. OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
c. NIST IR 8547, Transition to Post-Quantum Cryptography Standards. RSA and ECC deprecated after 2030 and disallowed after 2035.
d. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), August 13, 2024.
e. CNSA 2.0 for national security systems, where applicable.
3. SCOPE AND METHOD
1 inventoried system were assessed against vendor published post-quantum roadmaps as of 2026-10-16. Each entry was scored on vendor roadmap status, planned hardware or contract refresh date relative to the December 31, 2030 deprecation point, the sensitivity lifetime of the data the system protects, and mission criticality. Entries with an available vendor path are excluded from the exception list below and are tracked as ordinary remediation.
4. EXCEPTIONS (1)
4.1 Core campus switching (Cisco)
Category: Network infrastructure
Crypto dependency: MACsec key agreement, SSH and TLS management plane
Vendor PQC status: Roadmap announced
Roadmap source: Not recorded
Roadmap requested: Not recorded
Planned refresh: 2031-06-30
Data sensitivity life: 10 years
[Sections 4 through 7, the per-system dispositions, the acquisition action and the signature block are included with Professional.]Unlock the filed artifact
Professional generates the complete dated memorandum with every exception, the compensating controls, the residual risk scores, the acquisition language and a signature block, plus a saved register you can re-issue each quarter.