Post-Quantum Cryptography Roles Designation Memorandum

Approval #

Revision History #

Review cycle: Every year with the post-quantum cryptography (PQC) Migration Plan, and whenever a designee changes.

Mandate. Executive Order (EO) 14412, Securing the Nation Against Advanced Cryptographic Attacks, signed June 22, 2026, requires each agency head to identify a post-quantum cryptography (PQC) migration lead. Within 30 days of the order, by July 22, 2026, the agency head must send that person’s name and contact details to the Office of Management and Budget (OMB) and the National Cyber Director. OMB M-26-15 requires a governance structure with defined roles for the migration. OMB M-23-02 requires a cryptographic inventory and migration lead.

The agency head signs this memorandum, or the Chief Information Officer (CIO) signs it under a written delegation from the agency head. Before signature, the person who prepares it fills in the sender, keeps the delegation sentence only when the CIO signs, and fills in the signer’s title. The Chief Information Security Officer (CISO) keeps the signed memorandum with the Post-Quantum Cryptography Migration Plan.

---

Memorandum #

Date: [Date]

For: Chief Information Security Officer; Chief Financial Officer; System Owners; Information System Security Officers; program office directors; Senior Agency Official for Privacy

From: [Agency head, or Chief Information Officer under a written delegation]

Subject: Designation of Post-Quantum Cryptography Migration Roles

Purpose #

This memorandum names the people who lead the Organization’s migration to PQC. The designations meet three requirements. EO 14412 requires each agency to name a PQC migration lead to OMB and the Office of the National Cyber Director (ONCD). OMB M-26-15 requires a governance structure with defined roles. OMB M-23-02 requires a cryptographic inventory and migration lead.

Designations #

EO 14412 assigns this designation to the agency head. [Keep the next sentence only when the CIO signs, and delete it when the agency head signs.] The agency head delegated this designation to the CIO in writing on [date of the delegation]. [The agency head / The CIO] designates the following people, effective on the date of this memorandum:

Responsibilities #

• PQC Migration Lead. An employee or detailee who reports to the CIO, as EO 14412 defines the role. Coordinates the migration across the Organization. Keeps the cryptographic inventory and the PQC Migration Plan current. Reports status to the CIO and the CISO every quarter. Serves as the Organization’s contact for OMB, ONCD, and the Cybersecurity and Infrastructure Security Agency (CISA).
• PQC Technical Lead. Oversees inventory scans, algorithm selection, testing, and deployment of PQC and hybrid cryptography. Keeps the Organization’s approved algorithm list.
• Security Architect. Builds PQC into the Organization’s zero trust architecture and plans for interoperability between systems.

The CIO and the CISO stay accountable for migration priorities, risk acceptance, and resources. The Chief Financial Officer (CFO) includes PQC costs in the annual budget request. System Owners carry out the migration for their systems. Information System Security Officers record each system’s cryptographic inventory in its System Security and Privacy Plan. They also record each missed milestone as a plan of action and milestones item. The Senior Agency Official for Privacy confirms which systems hold personally identifiable information that must stay protected in 2030 and later. Program offices include PQC requirements in their requirements documents. The Contracting Officer and the Contracting Officer’s Representative put those requirements into contracts. The full list of duties is in the Post-Quantum Cryptography Migration Plan.

Notice to OMB and ONCD #

The CISO sends the name and contact details of the PQC Migration Lead to OMB and ONCD at PQC@omb.eop.gov. EO 14412 set this notice for July 22, 2026, 30 days after the President signed the order. If the Organization has not sent it yet, the CISO sends it with the PQC Migration Plan. The PQC Migration Lead tells OMB and ONCD whenever a designee changes.

Records #

The CISO keeps this memorandum with the PQC Migration Plan in the policy library in the document management system.

References #

These are the sources this document cites, with a link to each official text.

• Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• OMB M-23-02: Migrating to Post-Quantum Cryptography, November 18, 2022.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.