Carahsoft Partner
Post-Quantum Cryptography Readiness for Government, Available Through Carahsoft
Accutive Security helps public sector and regulated organizations locate every certificate, key, and algorithm your missions depend on, then plans and delivers the move to quantum-resistant cryptography. Engage our team through the Carahsoft contract vehicles your agency already uses.
- Vendor-neutral services across the platforms you already own
- Certified engineers who implement, not only advise
- Proof of concept before any purchase decision
Built for Systems That Outlast Their Algorithms
Government cryptography has to outlive the systems, budgets, and standards around it. Four conditions make modernization slower in the public sector than in commercial environments, and none of them change from one fiscal year to the next.
Long system lifecycles
Mission systems often stay in service for decades, so cryptography deployed today must survive more than one algorithm transition.
Estates built program by program
Each program adds its own infrastructure, leaving certificates, keys, and libraries spread across environments that were never inventoried together.
Validation is mandatory
Every upgrade has to preserve validated cryptographic modules, so FIPS validation status shapes the plan as much as technical fit.
Scarce specialists
Cryptographic engineers are hard to hire and retain on public sector pay scales, so most agencies bring that expertise in from outside.
Accutive Security operates a Cryptography, Identity Security and Data Protection Center of Excellence designed around these conditions. We modernize the cryptography an agency already runs, across the platforms it already owns, without requiring it to standardize on a single vendor.
A Certificate List Is Not a Cryptographic Inventory
Most agencies can export a list of their TLS certificates. Far fewer can show where every key, algorithm, library, and trust anchor sits, which systems depend on it, and whether it still meets policy. That deeper layer is where migration work actually happens.
Asset layer
What agencies usually have
What a migration plan needs
- Certificates
- A list from a CA or monitoring tool
What agencies usually have
A list from a CA or monitoring tool
- Owner, issuing CA, algorithm, key size, expiry, and dependent services
What a migration plan needs
Owner, issuing CA, algorithm, key size, expiry, and dependent services
- Keys
- Partial records in an HSM or key manager
What agencies usually have
Partial records in an HSM or key manager
- Location, custodian, protection level, rotation status, and usage
What a migration plan needs
Location, custodian, protection level, rotation status, and usage
- Algorithms and protocols
- Assumed from configuration standards
What agencies usually have
Assumed from configuration standards
- Observed use of RSA, ECC, and legacy ciphers in live traffic and code
What a migration plan needs
Observed use of RSA, ECC, and legacy ciphers in live traffic and code
- Cryptographic libraries
- Rarely tracked
What agencies usually have
Rarely tracked
- Versions embedded in applications, firmware, and CI/CD pipelines
What a migration plan needs
Versions embedded in applications, firmware, and CI/CD pipelines
- Trust anchors
- Root stores managed separately per platform
What agencies usually have
Root stores managed separately per platform
- Every root and intermediate a system trusts, and why
What a migration plan needs
Every root and intermediate a system trusts, and why
The Federal Post-Quantum Timeline Is Set
Federal civilian agencies now have firm dates. OMB Memorandum M-26-15, issued June 24, 2026, directs agencies to mitigate as much quantum risk as feasible by December 31, 2030, and to complete migration by 2035.
The urgency comes from data lifetimes, not from when a quantum computer arrives. Encrypted records captured today can be stored and decrypted later, once a cryptographically relevant quantum computer exists. M-26-15 tells agencies to prioritize systems holding data expected to remain mission-sensitive in 2030, along with high value assets, high impact systems, and PKI-based logical access control.
The replacement algorithms are already standardized: ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. Agency plans must align with NIST IR 8547, which proposes deprecating RSA and elliptic curve algorithms after 2030 and disallowing them after 2035.
Where we support each phase of M-26-15
Key exchange migrates first, signatures in 2031, everything by 2035
OMB M-26-15 phases for federal civilian agencies, with the Accutive Security service for each
Years · 2026 to 2027
M-26-15 phase and expectation
1 · Strategy, planning, discovery
Inventory, risk assessment, and governance; plan due in 120 days
How Accutive Security supports it
Automated discovery and inventory Readiness assessment, plan inputs
Years · 2027 to 2028
M-26-15 phase and expectation
2 · Pilots and early migration
Pilot prioritized systems and refine the plan from lessons learned
How Accutive Security supports it
Automated discovery and inventory Proofs of concept and pilot builds PKI and HSM upgrade planning
Years · 2028 to 2030
M-26-15 phase and expectation
3 · Prioritized migration
Key establishment moves to PQC for HVAs, high impact, sensitive systems
How Accutive Security supports it
PKI, HSM, and TLS 1.3 migration Crypto-agile architecture design
December 31, 2030: mitigate as much quantum risk as feasible
Years · 2031
M-26-15 phase and expectation
4 · Signature migration
Digital signatures move to PQC for the same priority systems
How Accutive Security supports it
Certificate lifecycle and code signing migration
Years · By 2035
M-26-15 phase and expectation
5 · Full migration
Remaining systems migrate, based on risk and product availability
How Accutive Security supports it
Continuous inventory and ongoing support
Years
M-26-15 phase and expectation
How Accutive Security supports it
2026 to 2027
1 · Strategy, planning, discovery
Inventory, risk assessment, and
governance; plan due in 120 days
Automated discovery and inventory Readiness assessment, plan inputs
2027 to 2028
2 · Pilots and early migration
Pilot prioritized systems and refine
the plan from lessons learned
Proofs of concept and pilot builds
PKI and HSM upgrade planning
2028 to 2030
3 · Prioritized migration
Key establishment moves to PQC for
HVAs, high impact, sensitive systems
PKI, HSM, and TLS 1.3 migration
Crypto-agile architecture design
- December 31, 2030: mitigate as much quantum risk as feasible
2031
4 · Signature migration
Digital signatures move to PQC
for the same priority systems
Certificate lifecycle and code
signing migration
By 2035
5 · Full migration
Remaining systems migrate, based
on risk and product availability
Continuous inventory and
ongoing support
M-26-15 migration phases · 5 phases, 1 deadline
Cryptography Services Available Through Carahsoft
Seven service lines cover the full path from discovery to operation. Agencies can engage one service or combine several into a single program.
Cryptographic Discovery and Inventory
Automated discovery of certificates, keys, algorithms, and libraries across cloud, CI/CD pipelines, endpoints, and devices, maintained as a living cryptographic bill of materials.
Post-Quantum Readiness Assessment
A risk-ranked view of quantum-vulnerable cryptography, prioritized by mission criticality and data lifetime, and a sequenced migration roadmap aligned to NIST IR 8547.
PKI Design, Migration, and Modernization
New or consolidated PKI hierarchies built for crypto agility, including hybrid and post-quantum certificate profiles as vendor support matures.
Certificate Lifecycle Management
Discovery, ownership, renewal, and revocation automated end to end, so shrinking certificate lifespans do not become outages.
HSM Deployment and Root of Trust
Secrets Management and Code Signing
Sensitive Data Discovery and Masking
Test It in Your Environment Before You Commit
Cryptographic decisions tend to stay in place for a decade or more, so agencies should see a solution work against their own constraints before they buy. Our Center of Excellence is backed by a professional services team certified across the leading cryptography, identity security, and data protection platforms. The engineers who advise on a design are the same engineers who deploy it.
Before any purchase decision, we can provide:
- Proof of Concept Builds in a test or staging environment that mirrors your production constraints
- Technical Demonstrations focused on your use cases, not a generic product tour
- Architecture Advisory that compares options across the platforms you already own and any new capability you need
Once a direction is chosen, the same team moves into deployment, knowledge transfer, and ongoing support. One team from evaluation through operation means no handoff between a reseller, an integrator, and a support desk.
Vendor-Neutral Across the Platforms Agencies Already Run
We implement, migrate, and operate the leading cryptography and identity platforms, so an agency can modernize what it owns before it buys anything new.
Product availability through Carahsoft varies by vendor. Tell us which platforms your agency uses and we will confirm the purchasing path for each.
One Inventory,
Many Frameworks
Every framework below depends on the same foundation: knowing where cryptography is deployed and how it is configured. Our work produces evidence that supports these requirements; agencies retain responsibility for their own authorization decisions.
- Federal civilian
FRAMEWORKS WE ALIGN TO
- Defense and defense industrial base
FRAMEWORKS WE ALIGN TO
- State and local government
FRAMEWORKS WE ALIGN TO
- Healthcare
FRAMEWORKS WE ALIGN TO
- Payments and revenue systems
FRAMEWORKS WE ALIGN TO
Buying Through
Carahsoft
Agencies contract with Carahsoft, and Accutive Security delivers the work. Federal, state and local, education, and healthcare organizations can use the procurement paths they already have in place.
Accutive Security
Start a conversation.
Accutive Security
Scope the work.
A short scoping call defines objectives, environment, and constraints. A proof of concept can come first if you need one.
Carahsoft
Receive a quote from Carahsoft.
Carahsoft
Place the order with Carahsoft.
Accutive Security
We deliver.
Accutive Security team at Carahsoft
AccutiveSecurity@carahsoft.com · (571) 662-4771
FAQ
It requires each civilian agency to submit a PQC Migration Plan to OMB and the Office of the National Cyber Director, and to mitigate as much quantum risk as feasible by December 31, 2030. Migration runs in five phases, ending with full migration by 2035. Plans must align with NIST IR 8547 and prioritize high value assets, high impact systems, and long-lived sensitive data.
Yes. M-26-15 lists minimum plan contents, including a risk-based prioritization strategy, inventory methods and tools, a crypto-agile architecture plan, third-party coordination, and resource estimates. Our readiness assessment produces the technical inputs for each of those sections, and the plan can mature as discovery continues.
Often, yes. M-26-15 calls for key management systems and HSMs that can natively generate, store, and manage both classical and post-quantum keys. We assess firmware, validation status, and vendor roadmaps for what you run today, then recommend upgrade, migration, or replacement.
It depends on the system. M-26-15 describes hybrid key exchange and dual signatures as a useful risk-management stopgap, but also notes the added complexity and cost. We help agencies decide where hybrid is worth it, starting with TLS 1.3, which agencies must support by January 2, 2030.
Not at federal scale. M-26-15 states that manual discovery is often insufficient and directs agencies toward automated, continuously updated inventories that feed a cryptographic bill of materials. We deploy and tune discovery tooling across network, code, and infrastructure sources so the inventory stays current.
M-26-15 applies to federal civilian agencies, not to states or localities. State and local organizations that exchange data with federal systems should still plan ahead, because interoperability requirements tend to follow federal adoption.
Consult with an Expert
Prefer to work through Carahsoft?
Email: accutivesecurity@carahsoft.com
or call: (571) 662-4771.