PQC Governance Digest: Cut-off 23 October 2026

By Brian Couzens, SITG-Consulting

Five verified signals this week. The OMB M-26-15 deadline landed. IETF advanced constrained-device PQC guidance. Singapore and the UK signalled convergence on quantum-safe supervision. ETSI convened its 20th Security Conference with a dedicated quantum readiness track. ENISA examined Estonia's national PQC roadmap.

OMB M-26-15: The Migration Plan Deadline Has Arrived

On 22 October 2026, the 120-day compliance window under OMB Memorandum M-26-15 closed. Executive departments and agencies (excluding national security systems) were required to submit a comprehensive PQC Migration Plan to OMB and the Office of the National Cyber Director.

The plans must cover cryptographic inventory, risk-based prioritisation, phased migration milestones, TLS 1.3 deployment timelines, crypto-agility architecture, third-party coordination, and resource estimates. The memo, issued 24 June 2026, gave agencies 120 days to produce submissions that would shape the federal government's transition to post-quantum cryptography.

The Government Accountability Office published GAO-27-108740 on 6 October (reissued with revisions 14 October), finding that none of the 24 CFO Act agencies it reviewed had fully addressed all three preparatory practices: developing cryptographic inventory processes, identifying funding needed for migration, and planning PQC testing in agency environments.

GAO's findings predate the October 2026 deadline and do not establish whether agencies subsequently closed those gaps. The governance lesson extends beyond US federal agencies: a submission deadline is not evidence of operational readiness. A PQC readiness assessment is the starting point for any organisation that has not yet begun.

Source: OMB M-26-15

IETF Advances PQC Guidance for Constrained Devices

On 20 October 2026, the IETF PQUIP (Post-Quantum Use in Protocols) working group published version 09 of its Internet-Draft, "Adapting Constrained Devices for Post-Quantum Cryptography" (draft-ietf-pquip-pqc-hsm-constrained-09).

The draft addresses how to deploy PQC algorithms on devices with tight constraints on processing power, RAM, and flash memory. It covers seed-based key generation, ML-DSA optimisation for low-resource environments, key rotation under constrained conditions, and PQC firmware authentication.

The authors span Nokia, Citrix, the UK's National Cyber Security Centre, and PQShield. The draft was scheduled for the 22 October IESG telechat but was deferred to 5 November 2026; a DISCUSS position is outstanding.

For organisations with IoT estates, operational technology environments, or hardware security modules in scope, the discovery sprint is where constrained-device exposure typically surfaces.

Source: IETF Datatracker

MAS and UK Treasury Signal Convergence on Quantum-Safe Supervision

On 20 October 2026, the Monetary Authority of Singapore and HM Treasury held their 11th UK-Singapore Financial Dialogue in Singapore. The media release included a substantive exchange on quantum security.

Both sides discussed "supervisory expectations for financial institutions transitioning to quantum-safe technologies." MAS shared "lessons learnt from MAS' Quantum Key Distribution sandbox with industry partners." The UK shared "the UK National Cyber Security Centre's post-quantum cryptography migration guidance."

The reference to "supervisory expectations" signals convergence in how quantum-safe transition is being discussed. It does not establish a common supervisory framework, but it places migration firmly within the financial-supervision agenda.

The Cyber Security Agency of Singapore's 14 October 2026 announcement reinforced its quantum-safe migration timetable, advising critical information infrastructure owners to put quantum-safe migration plans in place by 2027 and complete CII migration by 2031. Other organisations are encouraged to complete migration by 2035. The NCSC UK updated its TLS guidance on 15 October to incorporate PQC configurations.

Source: MAS Media Release

ETSI Security Conference: PQC in Production

ETSI held its 20th annual Security Conference at Sophia Antipolis, France, from 19 to 22 October 2026. The conference featured a full track on "Cryptography & Quantum Readiness" on 21 October, chaired by Colin Whorlow of the NCSC and Matthew Campagna of AWS (ETSI QSC Chair).

The programme included:

Google presented lessons learned from deploying PQC in production. DigiCert examined whether Merkle tree certificates could serve as a quantum-safe PKI solution. Sectigo addressed PQC alongside the 47-day certificate lifecycle. NCSC UK and EigenQ covered post-quantum PKI migration. Huawei presented IETF progress on PQC migration for IPsec/IKEv2. IRT-SystemX covered quantum-safe hybrid signatures in V2X communications. Toshiba provided status updates on ETSI ISG QKD and TC QT.

Source: ETSI Security Conference 2026

ENISA Examines Estonia's PQC Transition

On 22 October 2026, ENISA held a webinar as part of its PQC Webinar Series examining how Estonia is approaching the post-quantum cryptography transition.

Estonia's national PQC roadmap has three phases: cryptographic inventory, transition planning, and implementation. The session included a European Commission presentation on the Roadmap for the Transition to PQC and a presentation from Estonia's RIA (Information System Authority) on their national approach. ENISA states it is organising the webinar series to support national PQC efforts across EU member states.

Estonia's phased structure aligns with what the Quantum Cryptographic Assurance Standard prescribes: inventory before planning, planning before implementation.

Source: ENISA PQC Webinar

Nil Returns

The following regions and categories returned no verified signals within the scan window: India and South Asia (12 bodies checked), Latin America (12 bodies), Africa and Middle East (15 bodies), hyperscaler vendor announcements and technical publications (20 vendors), and central bank speeches (20+ speeches reviewed). One unverified secondary report was excluded per standing editorial policy.

Prior Editions

• PQC Governance Digest: Cut-off 16 October 2026 (Singapore migration timeline, German national PQC guideline, IETF ML-KEM)

• PQC Governance Digest: 9 Oct 2026 (GAO PQC audit, Europol HNDL report, Microsoft TLS pilot)

• PQC Governance Digest: Cut-off 2 October 2026 (BSI advises against Classic McEliece, NSA restates 2027)

SITG-Consulting provides PQC assurance and advisory services across cryptographic governance, migration readiness, and post-quantum transformation. For organisations beginning their transition, the FAQ covers the foundational questions.