The text of the Internet Protocol Version 6 (IPv6) Policy
Approval #
The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.
| Role | Name | Signature |
|---|---|---|
| Chief Information Officer (CIO) | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy.
Mandate. The Office of Management and Budget (OMB) issued memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (IPv6), on November 19, 2020. It requires each agency to publish an agency-wide IPv6 policy on its public website. The policy must require every new networked federal information system to have IPv6 turned on when it is deployed. It must also state the agency’s intent to phase out Internet Protocol version 4 (IPv4) for all systems. M-21-07 remains in force. OMB has not replaced its milestones, and the last one fell on September 30, 2025, the end of fiscal year (FY) 2025. M-21-07 does not apply to national security systems.
This policy also carries out the IPv6 acquisition rule in Federal Acquisition Regulation (FAR) 11.002(g) and the security steps in M-21-07. It follows OMB M-22-09, which tells agencies to coordinate IPv6 with their move to zero trust. The Chief Information Officer (CIO) owns this policy. The steps are in the IPv6 Transition Procedure (PROC-IPV6-001).
1. Policy Statement #
The Organization intends to phase out IPv4 for all of its systems and to operate its networks and services using only IPv6. The CIO leads the transition through an IPv6 Integrated Project Team. Every new networked system has IPv6 turned on when it is deployed. Every acquisition of networked information technology names the IPv6 capabilities it needs. Network operations and security systems support IPv6 as fully as IPv4. Only the CIO may waive a requirement in this policy.
2. Scope #
This policy applies to:
- Every networked information system the Organization owns or operates, and every system a contractor, cloud service provider, or another agency operates for it.
- Every Internet Protocol (IP) enabled asset in those systems, on premises or in the cloud.
- Every acquisition of information technology that uses IP, including services.
- The retirement of systems and assets that can use only IPv4.
For a commercial cloud or shared service, the policy applies to the interfaces the provider exposes to the Organization, not to the provider’s internal network (OMB M-22-09). This policy does not apply to national security systems (OMB M-21-07).
3. Requirements #
3.1 Governing the transition #
- The CIO must keep an agency-wide IPv6 Integrated Project Team with acquisition, policy, and technical members (OMB M-21-07).
- The CIO must name an IPv6 Transition Lead to run the team and keep the IPv6 integration plan (OMB M-21-07).
- The CIO must post this policy on the Organization’s public website and keep the posted copy current (OMB M-21-07).
- The IPv6 Transition Lead must coordinate the IPv6 work with the Organization’s zero trust work whenever either changes the enterprise network (OMB M-22-09).
3.2 Planning and measuring the move to IPv6-only #
- The IPv6 Transition Lead must keep an IPv6 integration plan that describes how every networked system, and every IP-enabled asset in it, moves to native IPv6 (OMB M-21-07).
- The plan must measure the share of IP-enabled assets that run in IPv6-only environments. M-21-07 set these milestones: at least 20 percent by the end of FY 2023, 50 percent by the end of FY 2024, and 80 percent by the end of FY 2025 (OMB M-21-07).
- Where the Organization has not met the 80 percent milestone, the plan must give dated steps to reach it (OMB M-21-07). The CIO sets the next target in the plan: [CIO target: share of IP-enabled assets IPv6-only, and the date].
- The plan must list each system that cannot move to IPv6, with the reason and a dated schedule to replace or retire it (OMB M-21-07).
- The plan must require every shared service the Organization offers to support IPv6 fully, including IPv6-only operation, with the same features and performance as IPv4 (OMB M-21-07).
- The IPv6 Transition Lead must update the plan every year, and the CIO must approve each update. The CIO must update the Information Resources Management (IRM) Strategic Plan to match where needed (OMB M-21-07).
- The IPv6 Integrated Project Team must run IPv6-only pilots on operational systems and report pilot results to OMB on request (OMB M-21-07).
3.3 Deploying new and changed systems #
- System Owners must turn on IPv6 for production use in every new networked system when it is deployed (OMB M-21-07).
- The Authorizing Official must not authorize a new system, or a major change to a system, until the System Owner records the system’s IPv6 readiness against the integration plan (OMB M-21-07).
- System Owners must upgrade public-facing servers and services, such as web, email, Domain Name System (DNS), and internet access services, to use native IPv6 (OMB M-21-07).
- System Owners must work with external partners whose systems connect to the Organization’s systems, and plan to move each of those connections to IPv6 (OMB M-21-07).
3.4 Buying information technology #
- The Program Office must name, in each requirements document for information technology that uses IP, the IPv6 capabilities it needs from the USGv6 Profile (FAR 11.002(g); OMB M-21-07). The USGv6 Profile is National Institute of Standards and Technology (NIST) SP 500-267B Rev. 1. Only the CIO may waive this requirement.
- The Program Office must require, in each such requirements document, hardware and software that can operate in an IPv6-only environment (OMB M-21-07).
- Contracting Officers must require offerors to show that their products meet those capabilities through the USGv6 Test Program (OMB M-21-07; FAR 11.002(g)).
- When a waiver is granted, the Contracting Officer must get a vendor’s written plan, with dates, to add the missing IPv6 capabilities (OMB M-21-07).
- The Organization’s own testing must cover integration, performance, and security that the USGv6 Test Program does not cover (OMB M-21-07).
3.5 Keeping security equal for IPv6 #
- System Owners must include full support for production IPv6 in system security plans, architectures, and acquisitions (OMB M-21-07).
- The CIO must make sure that every system that supports network operations or enterprise security can operate in an IPv6-only environment. These include identity and access management, firewalls, intrusion detection and prevention, endpoint security, logging and event management, and policy enforcement (OMB M-21-07).
- The CISO must make sure that assessment, authorization, and continuous monitoring cover the production use of IPv6 (OMB M-21-07).
- The Network Engineering Team must be able to detect and examine IPv6 traffic on every network, including networks meant to carry only IPv4 (NIST SP 800-119).
- The Network Engineering Team must apply the same filtering, intrusion detection, and logging to IPv6 traffic as to IPv4 traffic (NIST SP 800-119; OMB M-26-14).
- The asset inventory must record every IPv6 address of each networked asset, and asset discovery must cover the IPv6 address space in use (CISA BOD 23-01; NIST SP 800-53 CM-8).
4. Roles and Responsibilities #
| Role | Responsibilities |
|---|---|
| Chief Information Officer (CIO) | Owns this policy and approves the IPv6 integration plan. Keeps the IPv6 Integrated Project Team and names its lead. Decides every waiver. Posts this policy on the public website. |
| IPv6 Transition Lead | Runs the IPv6 Integrated Project Team. Keeps the integration plan, the inventory measures, and the list of systems that cannot convert. Reports progress to the CIO. |
| IPv6 Integrated Project Team | Includes acquisition, policy, and technical members. Plans the transition, picks and runs pilots, and reviews IPv6 readiness for new systems. |
| Network Engineering Team | Designs the IPv6 addressing plan and routing. Moves network segments to IPv6-only. Keeps filtering and monitoring equal for IPv6. |
| Chief Information Security Officer (CISO) | Concurs on this policy. Makes sure assessments, authorizations, and continuous monitoring cover IPv6. |
| Security Operations Center (SOC) | Watches IPv6 traffic with the same tools and alerts as IPv4 traffic. |
| System Owners | Turn on IPv6 in new systems. Record IPv6 readiness and plan each system’s move. Ask for a waiver when a system cannot convert. |
| Information System Security Officers (ISSOs) | Check that each system’s security plan and monitoring cover IPv6. |
| Contracting Officers (COs) and Contracting Officer’s Representatives (CORs) | Put USGv6 requirements into solicitations and contracts. Check offerors’ USGv6 evidence. Get vendor plans when a waiver applies. |
| Authorizing Officials | Check IPv6 readiness before authorizing a new system or a major change. |
5. How Waivers Are Approved #
Only the CIO may waive a requirement in this policy. A System Owner asks through the IPv6 Transition Lead. For an acquisition, the CIO may waive the USGv6 requirement only when it would place an undue burden on that acquisition, and decides each case on its own facts (OMB M-21-07). For a system that cannot move to IPv6, the waiver records the reason and the date the system will be replaced or retired. The IPv6 Transition Lead records each waiver in the integration plan. The CIO reviews each waiver at least every year.
6. How the CIO Measures Progress #
Each quarter, the IPv6 Transition Lead reports these measures to the CIO:
- The share of IP-enabled assets that run in IPv6-only environments.
- The share of IP-enabled assets with IPv6 turned on.
- Public-facing services that do not yet use native IPv6.
- Systems that cannot convert, with their replacement or retirement dates.
- New systems deployed without IPv6 turned on (the target is zero).
- Acquisitions of networked technology without USGv6 requirements or a waiver (the target is zero).
- Open waivers and their expiration dates.
7. M-21-07 Requirements and Where to Find Them #
| M-21-07 requires the agency to | Where this policy covers it |
|---|---|
| Designate an agency-wide IPv6 integrated project team | Governing the transition |
| Publish an agency-wide IPv6 policy on its public website | Governing the transition |
| Turn on IPv6 in all new networked systems at deployment and state the intent to phase out IPv4 | Policy Statement; Deploying new and changed systems |
| Pilot IPv6-only operational systems and report results to OMB on request | Planning and measuring the move to IPv6-only |
| Keep an IPv6 implementation plan with IPv6-only milestones, and list systems that cannot convert | Planning and measuring the move to IPv6-only |
| Require full IPv6 support in shared services the agency offers | Planning and measuring the move to IPv6-only |
| Move public-facing services to native IPv6 and plan external partner connections | Deploying new and changed systems |
| Use the USGv6 Profile and Test Program in acquisitions, with a CIO waiver process | Buying information technology; How Waivers Are Approved |
| Cover IPv6 in security plans, security systems, assessment, authorization, and monitoring | Keeping security equal for IPv6 |
8. References #
These are the sources this document cites, with a link to each official text.
- CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
- Federal Acquisition Regulation (FAR), current text.
- NIST SP 500-267B Rev. 1: USGv6 Profile, November 12, 2020.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 800-119: Guidelines for the Secure Deployment of IPv6, December 2010.
- OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
- OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
- OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.