The text of the IPv6 Transition Procedure
Approval #
The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.
| Role | Name | Signature |
|---|---|---|
| Chief Information Officer (CIO) | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy.
Mandate. The Chief Information Officer (CIO) issues this procedure to carry out the Internet Protocol Version 6 (IPv6) Policy (POL-IPV6-001). It gives the steps for the IPv6 transition that Office of Management and Budget (OMB) M-21-07 and Federal Acquisition Regulation (FAR) 11.002(g) require. It applies the USGv6 Profile (National Institute of Standards and Technology (NIST) SP 500-267B Rev. 1) and NIST SP 800-119. It also applies Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 23-01 to IPv6 asset discovery. The IPv6 Transition Lead runs this procedure with the IPv6 Integrated Project Team.
1. Purpose and Scope #
Use this procedure to measure IPv6 readiness, keep the IPv6 integration plan, buy IPv6-capable products, move systems to IPv6-only, keep security monitoring equal for IPv6, handle waivers, and report progress. It covers every networked system and Internet Protocol (IP)-enabled asset in the scope of the IPv6 Policy.
2. Roles #
The roles are defined in the IPv6 Policy. In the step tables below, each step names the person who acts. The IPv6 Transition Lead coordinates the steps and keeps their records.
3. Definitions #
| Term | Meaning in this procedure |
|---|---|
| IP-enabled asset | Any hardware, software, or service in a system that has an IP address or uses IP to communicate. |
| IPv6-enabled | IPv6 is turned on for production use (OMB M-21-07). |
| IPv6-capable | The product has a complete, correct set of IPv6 capabilities, as the USGv6 Profile describes for its product type (OMB M-21-07). |
| IPv6-only | IPv4 addressing and packet forwarding are not in use (OMB M-21-07). |
| Native IPv6 | The system supports IPv6 directly, without IPv4 for basic communications (OMB M-21-07). |
| Dual stack | An asset runs IPv4 and IPv6 at the same time (NIST SP 800-119). |
| USGv6 Profile | NIST SP 500-267B Rev. 1, which lists the IPv6 capabilities a buyer can require for each product type, including IPv6-only capabilities. |
| USGv6 Test Program | NIST’s program in which accredited laboratories test products, and suppliers declare conformance, against the USGv6 Profile. |
4. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The asset inventory tool | The inventory of IP-enabled assets, with each asset’s IPv4 and IPv6 addresses and IPv6 status | Asset records and readiness status |
| The vulnerability scanner | Asset discovery across the IPv4 and IPv6 address space in use | Discovery results |
| The security information and event management (SIEM) system | Collection and alerting on IPv6 traffic and events | Logs and alerts |
| The zero trust network access (ZTNA) service and the secure web gateway | Access and web traffic for users over IPv6 | Configuration records |
| The ticketing system | Change requests and waiver requests | Change and request records |
| The governance, risk, and compliance (GRC) system | System security plans, authorization records, and plans of action and milestones (POA&M) for IPv6 gaps | Authorization records |
| The document management system | This policy and procedure, the IPv6 integration plan, and the published copy of the policy | Approved versions and history |
5. Measure IPv6 Readiness #
The IPv6 Transition Lead measures readiness every quarter and before each yearly plan update.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| IPv6 Transition Lead | 1. Pull the list of IP-enabled assets for each system, with their IPv4 and IPv6 addresses. | The asset inventory tool | Inventory extract | CM-8 |
| Network Engineering Team | 2. Confirm that discovery covers every IPv6 address range in use, and add any range it misses. | The vulnerability scanner | Discovery scope record | CM-8, RA-5 |
| System Owners | 3. Record each asset’s status: IPv6-only, dual stack, IPv4-only but IPv6-capable, or not IPv6-capable. | The asset inventory tool | Status per asset | CM-8 |
| IPv6 Transition Lead | 4. Compute the share of assets in each status, by system and for the whole Organization. | The asset inventory tool | Quarterly readiness report | PM-5 |
| IPv6 Transition Lead | 5. List systems with assets that are not IPv6-capable and ask each System Owner for a replacement or retirement date. | The ticketing system | Request and answer | SA-22 |
Evidence: the quarterly readiness report, the inventory extract it came from, the discovery scope record, and each System Owner’s answer.
6. Keep the IPv6 Integration Plan #
The IPv6 Transition Lead updates the plan every year and when a major change to the network, a new OMB requirement, or a missed milestone calls for it.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| IPv6 Transition Lead | 1. Update the plan with the latest readiness measures and the progress against each milestone. | The document management system | Draft plan | PM-9 |
| IPv6 Integrated Project Team | 2. Set dated steps for each system to move to IPv6-only, starting with systems that already support IPv6 (OMB M-21-07). | The document management system | Transition schedule | PL-2, SA-3 |
| IPv6 Transition Lead | 3. List each system that cannot convert, with its reason and its replacement or retirement date (OMB M-21-07). | The document management system | Exception list | SA-22 |
| IPv6 Transition Lead | 4. Check that every shared service the Organization offers supports IPv6-only operation with the same features as IPv4 (OMB M-21-07). | The document management system | Shared service review | SA-9 |
| IPv6 Transition Lead | 5. Coordinate the plan with the zero trust plan, so that network changes serve both (OMB M-22-09). | The document management system | Coordination record | PM-7 |
| Chief Information Officer (CIO) | 6. Approve the plan and set the Organization’s next IPv6-only target. Update the Information Resources Management (IRM) Strategic Plan where needed. | The document management system | Signed plan | PM-9 |
The CIO records in the plan the Organization’s target after fiscal year (FY) 2025: [CIO target: share of IP-enabled assets IPv6-only, and the date].
Evidence: the signed plan with its transition schedule, the exception list, the shared service review, and the coordination record.
7. Put IPv6 Requirements into Acquisitions #
Each acquisition of information technology that uses IP follows these steps.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Program Office | 1. Name the product types being bought and the USGv6 Profile capabilities each one needs, including IPv6-only capability (FAR 11.002(g); OMB M-21-07). | The ticketing system | Requirements document | SA-4 |
| IPv6 Transition Lead | 2. Review the IPv6 requirements before the solicitation is issued. | The ticketing system | Review record | SA-4 |
| Contracting Officer (CO) | 3. Require each offeror to show USGv6 Test Program evidence for the named capabilities: a laboratory test report or the supplier’s declaration of conformity. | The ticketing system | Solicitation text | SA-4 |
| Contracting Officer’s Representative (COR) | 4. Check the evidence of the selected offeror before award. | The ticketing system | Evaluation record | SA-4 |
| Network Engineering Team | 5. Test integration, performance, and security that the USGv6 Test Program does not cover (OMB M-21-07). | The ticketing system | Test results | SA-11 |
When a requirement would place an undue burden on the acquisition, the Program Office asks for a waiver as described in Handle Waivers and Systems That Cannot Convert.
Evidence: the requirements document with its USGv6 capabilities, the review record, the solicitation text, the offeror’s USGv6 evidence, and the test results.
8. Move Systems to IPv6-Only #
The IPv6 Integrated Project Team moves each system on the dates in the integration plan.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| IPv6 Integrated Project Team | 1. Pick a pilot system that already supports IPv6 and define success measures for running it IPv6-only (OMB M-21-07). | The document management system | Pilot plan | SA-3 |
| Network Engineering Team | 2. Assign IPv6 addresses from the addressing plan and set up routing, Domain Name System (DNS), and address assignment for the system. | The ticketing system | Approved change request | CM-3, SC-20 |
| System Owner | 3. Turn off IPv4 for the system in a test window, then in production, through change control. | The ticketing system | Change records | CM-3 |
| Information System Security Officer (ISSO) | 4. Confirm that filtering, monitoring, and logging work for the system over IPv6 before and after the change. | The SIEM system | Test results | SI-4, AU-2 |
| IPv6 Transition Lead | 5. Record the results and lessons learned, and report pilot results to OMB on request (OMB M-21-07). | The document management system | Pilot report | PM-9 |
| System Owner | 6. Update the system security plan to show IPv6-only operation. | The GRC system | Updated plan | PL-2 |
Evidence: the pilot plan and report, the approved change requests, the security test results, and the updated system security plan.
9. Keep Security Monitoring Equal for IPv6 #
The Network Engineering Team and the Security Operations Center (SOC) check security parity every quarter and after each network change.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Network Engineering Team | 1. Compare the IPv6 rules with the IPv4 rules on every firewall and filter, and fix any gap (NIST SP 800-119). | The secure web gateway | Rule comparison | SC-7 |
| Network Engineering Team | 2. Block or monitor IPv6 traffic on networks meant to carry only IPv4, including tunneled IPv6, so that no device uses IPv6 unseen (NIST SP 800-119). | The secure web gateway | Configuration record | SC-7, CM-7 |
| Security Operations Center (SOC) | 3. Confirm that intrusion detection sees IPv6 traffic and that the SIEM system receives IPv6 addresses in every log source (OMB M-26-14). | The SIEM system | Parity check | SI-4, AU-3 |
| Network Engineering Team | 4. Confirm that asset discovery covers the IPv6 address space every 7 days (CISA BOD 23-01). | The vulnerability scanner | Discovery results | RA-5, CM-8 |
| CISO | 5. Confirm that each assessment plan tests the system’s IPv6 traffic and settings (OMB M-21-07). | The GRC system | Assessment plan | CA-2 |
| ISSO | 6. Open a POA&M item for each gap the checks find. | The GRC system | POA&M items | CA-5 |
Evidence: the rule comparisons, the configuration records, the SOC’s parity checks, the discovery results, the assessment plans, and the POA&M items.
10. Handle Waivers and Systems That Cannot Convert #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| System Owner or Program Office | 1. Ask for a waiver with the reason, the risk, and the planned end date. For an acquisition, show the undue burden (OMB M-21-07). | The ticketing system | Waiver request | PM-9 |
| IPv6 Transition Lead | 2. Review the request with the IPv6 Integrated Project Team and recommend a decision. | The ticketing system | Recommendation | PM-9 |
| Chief Information Officer (CIO) | 3. Approve or deny the waiver and set its expiration date. | The ticketing system | Signed decision | PM-9 |
| Contracting Officer (CO) | 4. For an approved acquisition waiver, get the vendor’s dated plan to add the missing IPv6 capabilities (OMB M-21-07). | The ticketing system | Vendor plan | SA-4 |
| IPv6 Transition Lead | 5. Add the waiver to the exception list in the integration plan, and review each waiver with the CIO every year. | The document management system | Exception list | PM-9 |
Evidence: each waiver request with its recommendation and signed decision, the vendor plans, and the yearly waiver review.
11. Report Progress and Publish the Policy #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| IPv6 Transition Lead | 1. Report the readiness measures, milestones, and waivers to the CIO each quarter. | The document management system | Quarterly report | PM-6 |
| Chief Information Officer (CIO) | 2. Answer OMB requests for IPv6 progress and pilot results (OMB M-21-07). | The document management system | Submissions | PM-6 |
| Chief Information Officer (CIO) | 3. Post each approved version of the IPv6 Policy on the Organization’s public website (OMB M-21-07). | The document management system | Web page and date | PM-9 |
Evidence: the quarterly reports, the submissions to OMB, and the posted policy with its posting date.
12. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Measure IPv6 readiness | Every quarter | IPv6 Transition Lead |
| Check security parity for IPv6 | Every quarter and after each network change | Network Engineering Team and SOC |
| Report progress to the CIO | Every quarter | IPv6 Transition Lead |
| Update and approve the integration plan | Every year | IPv6 Transition Lead and CIO |
| Review open waivers | Every year | CIO |
| Review USGv6 requirements in acquisitions | Before each solicitation | IPv6 Transition Lead |
13. Records #
The IPv6 Transition Lead keeps the integration plan, the readiness reports, the waivers, and the pilot reports in the document management system. System Owners keep IPv6 items in their system security plans and POA&M items in the GRC system. The Contracting Officer keeps USGv6 evidence in the contract file. Each record is kept under the records schedule that applies to it.
Evidence: the records listed above, retrievable for each system and each acquisition.
14. Related Documents #
15. References #
These are the sources this document cites, with a link to each official text.
- CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
- Federal Acquisition Regulation (FAR), current text.
- NIST SP 500-267B Rev. 1: USGv6 Profile, November 12, 2020.
- NIST SP 800-119: Guidelines for the Secure Deployment of IPv6, December 2010.
- OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
- OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
- OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.