Find your quantum-vulnerable cryptography before someone else does.
OMB M-26-15 starts the federal migration to post-quantum cryptography. ZTASphere gives security and research teams the inventory, evidence and tracking to plan it, prove it and keep it current.
What M-26-15 asks agencies to do
- Plan and inventory. Submit a migration plan with a cryptographic inventory within 120 days, aligned with NIST IR 8547.
- Prioritize. High-impact systems and high-value assets first, mitigating as much quantum risk as feasible by the end of 2030.
- Automate discovery. Use automation to find cryptography and keep a continuously updated view of cryptographic posture.
- Move the zero trust plumbing. TLS and IPsec terminators need post-quantum key exchange, and TLS 1.3 becomes the baseline.
- Buy crypto-agile. Program offices should make PQC readiness and crypto agility part of vendor requirements.
The wider federal goal is to complete the migration by 2035.
How ZTASphere enables post-quantum research and migration
Discover
The built-in encryption-in-transit probe records protocol, cipher, certificate key type, key size and signature for every endpoint you list, so RSA and ECDSA dependencies surface automatically.
Inventory
A cryptographic inventory (CBOM) for ZTASphere itself shows each algorithm, its standard, whether it is quantum-resistant and how it migrates, as a worked model for your own systems.
Score
Traffic encryption (NW-03) and data encryption (DT-05) are scored to ZTMM stages. Optimal requires hybrid post-quantum key exchange where supported and a current crypto inventory.
Prioritize
Gap-to-goal roadmaps rank quantum-vulnerable paths by impact, so high-value assets move first, as the memo asks.
Track
Evidence older than 30 days stops counting, so your post-quantum posture stays a live measurement rather than a one-time report.
Stay agile
Every value ZTASphere encrypts carries a key id and format version, so algorithms rotate without a schema change. Hybrid ML-KEM TLS is preferred wherever the terminator supports it.
For research and lab teams
Post-quantum migration is part engineering, part research: which libraries, terminators and vendors negotiate ML-KEM today, which certificates still depend on RSA or ECC, and what breaks when you change them. ZTASphere gives research teams a shared, evidence-backed record of those findings across pilots, with probe results, exceptions with expiry dates and an audit trail that shows what changed and when.
| Algorithm family | Status against quantum attack | Replacement |
|---|---|---|
| RSA, DSA | Vulnerable (signatures, key transport) | ML-DSA (FIPS 204), SLH-DSA (FIPS 205) |
| ECDH, DH | Vulnerable (key exchange) | ML-KEM (FIPS 203), hybrid X25519MLKEM768 in TLS |
| ECDSA | Vulnerable (signatures) | ML-DSA (FIPS 204) |
| AES-256, SHA-256, HMAC | Considered resistant at current key sizes | Keep; prefer 256-bit keys |
The probe cannot yet confirm which key-exchange group was negotiated; hybrid ML-KEM is verified with an OpenSSL 3.5+ test, documented in the product.
Frequently asked questions
What is OMB M-26-15?
OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, was issued on June 24, 2026. It directs federal civilian agencies to plan and carry out their move to quantum-resistant cryptography.
What do agencies have to deliver first?
A migration plan, including a cryptographic inventory, to OMB and the Office of the National Cyber Director within 120 days of the memo, aligned with NIST IR 8547. High-impact systems and high-value assets come first.
Which standards apply?
NIST FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. RSA, ECDH, ECDSA, DH and DSA are the quantum-vulnerable algorithms to replace.
Why start now if quantum computers are years away?
Adversaries can record encrypted traffic today and decrypt it later. Data that must stay confidential for years is already at risk, and inventory and migration take years in large environments.
Does ZTASphere confirm hybrid post-quantum TLS?
Not yet from the built-in probe. It records protocol, cipher, certificate key type, size and signature, which identifies quantum-vulnerable endpoints. Confirming a hybrid ML-KEM key exchange currently needs an OpenSSL 3.5+ test, which we document.
Sources: OMB M-26-15 (24 June 2026) as reported by Nextgov/FCW and Boston Identity; NIST FIPS 203, 204 and 205. Read the memorandum for the authoritative text.
Make post-quantum progress measurable.
Bring your highest-value systems. We'll show what ZTASphere finds and how it tracks the migration.