“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years

 

@ 2025 Charles Sun. All rights reserved.

Author’s Original Manuscript | Republished for Archival Access

This article was originally published by Homeland Security Today (HSToday), a platform dedicated to advancing national security dialogue and innovation. The version below reflects the author’s original manuscript, submitted prior to editorial review.

It is republished here to preserve the author’s full voice, intent, and strategic framing - anchored in over a decade of advocacy for secure digital infrastructure, IPv6 modernization, and universal computing.

🔗 Read the full text published on HSToday

A Deadline Passed, A Mission Unfinished

In early 2019, as Technology Co-Chair of the Federal IPv6 Task Force, I participated in intensive policy discussions with federal cybersecurity leadership about a critical national security imperative: transitioning federal networks to IPv6-only operations. The rationale was technically clear and strategically urgent. Operating dual-stack IPv4 and IPv6 networks doesn't just add complexity—it fundamentally doubles the protocol attack surfaces. Every device running both protocols creates two parallel, protocol-specific vectors for exploitation, forcing defenders to secure and monitor twice the network-layer exposure. By contrast, single-stack IPv6 operations immediately halve the protocol attack surface, sharply reducing the federal government’s exposure to network-based cyber threats. This conclusion is not speculative; it is explicitly confirmed by RFC 7381, reinforced by peer‑reviewed security research. Federal guidance, including CISA’s IPv6 Security Guidance and NIST’s Zero Trust publications, reinforces this analysis—dual-stack complexity directly increases attack surface exposure.

Every day spent dual‑stacked is a day spent with a doubled attack surface.

Federal cyber leadership has consistently emphasized enterprise defense, resilience, and modernization as top priorities. Those priorities cannot be fully realized while agencies remain dual‑stack, defending two protocols at once. Transitioning to single‑stack IPv6 is therefore not just a technical upgrade but a direct enabler of the resilience federal leaders have long demanded.

These discussions helped lay the groundwork for formal policy action the following year. In November 2020, the Office of Management and Budget issued Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” establishing that by fiscal year (FY) 2025, at least 80 percent of IP-enabled assets on federal networks must operate in IPv6-only environments. The memorandum was aligned with the framework we developed: firm deadlines, IPv6-only objectives, and cybersecurity-focused implementation.

That deadline — September 30, 2025 — has now passed. Yet, despite years of effort, many federal agencies remain noncompliant with the mandate. This is not a partisan issue. It is a technical and strategic imperative that transcends political considerations. The threat landscape does not pause for transitions of power. Attack surfaces do not shrink because of electoral outcomes. IPv6-only adoption is a national security necessity driven by mathematical realities, architectural requirements, and the demands of emerging technologies.

The question is no longer whether we will achieve it—but how much longer we are willing to tolerate the vulnerabilities that delay sustains.

“If Not Now, When?”—A Question Still Unanswered

Over the past decade, I have consistently advocated for a full transition to IPv6. In 2015, I highlighted in “IPv6, If Not Now, When?!” that the explosive growth of IoT devices and exhaustion of IPv4 addresses made adoption inevitable, warning that the digital infrastructure of the future could not rely on IPv4. Building on that foundation, in February 2020, I published “Adopting and Enforcing an IPv6-only Policy: If Not Now, When?” and urged the federal government to lead by example by establishing a firm IPv6-only implementation deadline—a critical step to secure cyberspace and protect the nation’s infrastructure.

Five years later, that question remains incompletely answered. As of October 2025, no federal agency has publicly announced achieving the 80% IPv6-only compliance mandated by M-21-07. Given that such compliance would represent a significant achievement worthy of recognition, the absence of any such announcements strongly indicates that implementation has fallen well short of requirements. This conclusion is reinforced by federal IT community assessments, industry observations, and the documented technical and organizational challenges facing agencies—particularly the largest agencies with the most complex legacy infrastructure. We are not merely behind schedule; we are watching a critical national security initiative struggle to achieve traction despite clear policy direction and realistic timelines.

As someone who helped shape the policy framework and has publicly championed IPv6-only adoption for more than a decade, I share responsibility for these implementation challenges. Perhaps we underestimated organizational resistance to architectural change. Perhaps we overestimated agencies’ technical readiness. Perhaps we failed to adequately communicate the urgency beyond the cybersecurity community.

Yet the technical and strategic analysis was — and remains — correct. Incremental adoption is no longer sufficient. The federal government must finalize and enforce IPv6-only policies immediately to ensure interoperability, security, and resilience. The time is now.

The Technical Imperative: Why IPv6-only Matters

IPv6-only adoption is not a policy preference for debate; it is a technical necessity set by realities that transcend government administrations.

1.    Address Exhaustion and Architectural Limitations

IPv4’s 4.3 billion addresses were exhausted more than a decade ago—top-level depletion in 2011 and North American depletion in 2015. Reliance on Network Address Translation (NAT) and other workarounds creates complexity, breaks end-to-end connectivity, and introduces security vulnerabilities. IPv6’s 340 undecillion addresses eliminate these constraints and enable architectures impossible in IPv4.

2.    Attack Surface Reduction

The IPv4 and IPv6 dual stack mode of operation sustains vulnerability landscapes for both protocols. Adversaries exploit both IPv4 and IPv6 vulnerabilities, often leveraging transition mechanisms as additional vectors. Security researchers and federal guidance detail active exploitation during dual-stack operations — every day spent dual-stacked is a day spent with a doubled attack surface.

3.    Emerging Technology Requirements

IoT, industrial control, smart infrastructure, and most new emerging technologies depend on IPv6. IPv4’s address exhaustion makes it fundamentally unfit for mass-scale deployments. Agencies delaying IPv6-only adoption cannot effectively secure or manage expanding technology landscapes.

4.    Zero Trust Architecture Dependencies

Zero Trust Architecture (ZTA) initiatives rely on explicit trust verification and micro‑segmentation. IPv6’s abundant address space enables granular controls, facilitating robust ZTA architectures more easily than IPv4’s constraints. Dual‑stack systems, by contrast, create management complexity and additional security risk, as controls and inspections must be configured and maintained for both protocols. This is fully documented in NIST SP 800‑207 (Zero Trust Architecture) and reinforced by the NSA/DoD IPv6 Security Guidance, which emphasizes that IPv6-only environments simplify boundary filtering and strengthen ZTA implementation.

5.    Strategic Positioning and Peer Adoption

The United States has never been the global leader in IPv6 adoption. While federal mandates began as early as 2005, actual deployment lagged. Countries such as Belgium, India, France, and Germany surged ahead, with adoption rates exceeding 70–80 percent in recent years. By contrast, U.S. adoption hovers closer to 50 percent, ranking only around 17th worldwide as of March 2025, according to CircleID.

The disparity is clear in APNIC Labs IPv6 Measurement Data and corroborated by industry analyses from CircleID and Cisco. Nations that embraced IPv6 early now operate closer to IPv6-only environments, reducing dual‑stack complexity and shrinking their attack surfaces. The United States, by remaining heavily dual‑stack, is most likely less secure than peers who have already consolidated on the single-stack of IPv6.

This is not just a matter of optics or international benchmarking. It is a matter of resilience. Countries with higher IPv6 penetration enjoy simplified architectures, lower operational costs, and stronger security postures. The U.S., by delaying, sustains the burden of dual‑stack operations—a burden adversaries can and do exploit.

While the United States lags, many other nations have advanced rapidly in IPv6 adoption. Belgium became the first country to surpass 50% capability in 2016, leading global adoption from 2014 through 2018. As of October 7, 2025, fifteen countries rank ahead of the U.S. in IPv6 adoption — including France, India, and Germany, each with adoption rates above 75%, according to public data. In recent years, India has accelerated its IPv6 deployment dramatically, pulling far ahead of the U.S. and many other nations.

According to APNIC Labs, as of October 2025, India’s IPv6 adoption rate exceeds 77%. This figure translates to more than 600 million active IPv6 users, placing India among the top two nations worldwide in IPv6 deployment. Independent confirmations drawing on APNIC’s measurement data reinforce this position. For example, Network World highlighted India’s rapid acceleration in IPv6 capability, noting that its scale and growth outpaced most of the Asia‑Pacific region. Earlier in 2025, The Register reported India’s adoption at approximately 73-74%, confirming its leadership alongside France and other top‑tier nations.

As the accompanying chart shows, the U.S. stands only at number 16, trailing nations such as Vietnam. Unless this gap is closed, the United States risks ceding technological leadership in the very protocol that will define the next generation of Internet infrastructure.

These are material facts. The physics of networking and the mathematics of address space don't change with political leadership. IPv6-only adoption is as inevitable as the historical transition from analog to digital communications. The question is whether we transition proactively and strategically, or reactively after security incidents force emergency change.

Why Implementation Has Lagged: An Honest Assessment

Understanding why federal agencies have struggled to meet the FY2025 deadline requires honest examination of technical, organizational, and cultural challenges—challenges I observed throughout my federal career and which I anticipated but perhaps underestimated.

1. Technical Debt and Legacy Systems

Federal IT infrastructure carries decades of accumulated technical debt. Systems built on IPv4 assumptions and applications with hard-coded IPv4 dependencies create additional challenges and make the IPv6-only transition take significantly longer, even if fundamental re-architecture isn’t strictly necessary.

Many agencies discovered their "IPv6-capable" systems were capable in name only—able to pass IPv6 traffic, but with security tools, monitoring systems, and operational procedures that remained IPv4-centric. True IPv6-only operation required replacing or substantially upgrading core infrastructure at scale and cost beyond initial estimates.

2. Budget Constraints and Priority Competition

IPv6 transition competes against every other IT modernization priority in constrained budgets. Agencies prioritize immediate operational needs even when delayed transitions actually increase long‑term risk – a choice that may seem practical in the short-term but is strategically misguided.

3. IPv6 Expertise Gap

The federal workforce, like the broader IT industry, lacks sufficient IPv6 expertise. Network engineers trained primarily on IPv4 face steep learning curves when adapting to IPv6’s distinct address structures, routing protocols, security models, and operational procedures.

Many agencies lacked the internal expertise to plan and execute large‑scale transitions and struggled to find contractors with the necessary skills. In many cases, long‑tenured contract staff assigned to agencies did not possess the required IPv6 capabilities, and even when contracts changed, much of the contractor workforce remained the same. As a result, technical debt has accumulated, and the shortage of qualified IPv6 skills needed to implement the transition remains severe.

This creates a vicious cycle: agencies delay IPv6 adoption because they lack expertise, which prevents them from developing expertise, which further delays adoption. Breaking this cycle requires dedicated training programs, knowledge transfer initiatives, and sustained commitment to workforce development.

4. Vendor Readiness Inconsistencies

While major network equipment vendors have supported IPv6 for years, the broader software ecosystem remains inconsistent and often lacks true feature and performance parity. Critical applications, security tools, and operational management systems still have incomplete or inadequate IPv6 support. In many cases, agencies discovered vendor IPv6 implementations were incomplete (e.g., missing management hooks, differences in logging, limited feature support). Some vendors treated IPv6 as a checkbox feature rather than a fully equal protocol, creating situations where systems technically support IPv6 but with reduced functionality or performance.

Agencies remained constrained by vendor roadmaps, and vendor delays cascaded into agency delays. This is a market failure—insufficient customer demand for full IPv6 parity creates insufficient vendor incentive to invest in complete implementations.

5. Cultural Resistance and Risk Aversion

Perhaps most challenging is cultural resistance. IPv4 is known, understood, and comfortable. IPv6 is different, requires learning, and carries a perceived risk of disruption. In risk-averse government cultures, the tendency is to delay change until forced, particularly when existing systems appear to function adequately.

The irony is that maintaining IPv4 dual-stack operations carries far greater security risk than transitioning to IPv6-only. But that risk is familiar, normalized, and distributed across the entire federal government. The risk of transition—potential disruption, service interruptions, implementation challenges—is immediate, visible, and owned by individual agency leaders making decisions.

6. Accountability and Enforcement

Federal policy established requirements but provided limited accountability mechanisms for non-compliance. Without meaningful consequences for missing deadlines, agencies could deprioritize IPv6 transition in favor of initiatives with more immediate political or operational visibility. The mandate had ambition but lacked enforcement mechanisms.

Taken together, these six factors explain why the FY2025 mandate faltered. Technical debt and legacy systems slowed progress from the start. Budget pressures pushed IPv6 behind more immediate priorities. A persistent expertise gap left agencies unable to build confidence or momentum. Vendor inconsistencies compounded delays, while cultural resistance reinforced the instinct to postpone change. Finally, the absence of strong accountability mechanisms allowed deadlines to slip without consequence. The lesson is clear: success requires more than policy—it demands resources, skills, vendor alignment, cultural resolve, and enforceable accountability. Without addressing all six dimensions together, the cycle of delay will repeat.

The Security Cost of Delay

Every day spent dual‑stacked is a day spent with a doubled attack surface. While agencies grappled with implementation challenges, the threat environment did not pause. The security justification for IPv6-only adoption has only become more urgent.

1.    Expanded Attack Surfaces

Every day, federal networks operate in dual-stack mode, adversaries have twice the protocol landscape to exploit. Vulnerabilities in IPv4 implementations, IPv6 implementations, and the complex interaction between them create numerous attack vectors. Recent high-profile cyber incidents have demonstrated that sophisticated adversaries exploit complexity and inconsistency—precisely what dual-stack operations provide.

2.    Adversary Capabilities Evolving

Potential adversaries have not stood still while we delayed. Their IPv6 capabilities, offensive cyber tools, and understanding of dual-stack vulnerabilities have evolved. Every month we delay IPv6-only adoption is a month adversaries gain relative advantage in understanding and exploiting the very transition mechanisms and dual-stack complexities we continue operating.

3.    IoT and Critical Infrastructure Vulnerabilities

The explosive growth of Internet of Things devices, industrial control systems, and smart infrastructure creates expanding attack surfaces that IPv4 architectures cannot adequately secure. Federal agencies delaying IPv6 adoption find themselves unable to effectively manage these environments, creating critical infrastructure vulnerabilities with potential cascading consequences.

4.     Zero Trust Implementation Gaps

Federal Zero Trust Architecture (ZTA) initiatives are undermined by continued IPv4 dependency. ZTA principles are more effectively implemented in IPv6 environments, and dual‑stack operations complicate implementation while reducing effectiveness. Agencies should develop their IPv6 and Zero Trust implementation plans simultaneously because the two work in tandem to improve network cybersecurity. With the proper IPv6 addressing architecture, it’s possible to have cleaner, less‑complicated boundary filters and more granular filtering for Zero Trust. Currently, dual‑stack systems create management complexity and additional security risk, as controls and inspections must be configured and maintained for both protocols, often reducing Zero Trust effectiveness. Every delay in IPv6-only adoption is a delay in achieving robust Zero Trust security, as full ZTA benefits require IPv6’s scale and segmentation.

Renewed Commitment to Execution

The Billington Cybersecurity Summit in Washington, D.C., in September 2025 provided a timely backdrop for reflection. With the September 2025 milestone now behind us, it was clear that the policy framework established in 2019 through OMB Memo M‑21‑07 remained sound: the analysis was correct, and the timelines were realistic. What has been lacking is not the framework, but the organizational will to execute it with urgency and accountability.

The mission is not finished. But it can succeed.

What Must Happen Next: A Path Forward

The path forward is not uncertain. The standards are written, the research is conclusive, and the policy framework is already in place. What remains is execution. Federal leaders must now move beyond dual‑stack hesitation and commit fully to single‑stack IPv6. That means embedding milestones into agency performance plans, holding CIOs and CISOs accountable for delivery, and reporting progress transparently through public dashboards. The technical case is settled; the strategic imperative is undeniable. The only question left is whether we will summon the will to finish the mission. The time to act is now.

That urgency is sharpened by the fact that the September 30, 2025 deadline has passed, but the mission has not failed. It has simply entered a new phase—one that demands renewed commitment, stronger accountability, and decisive strategic intervention. What follows are specific, actionable recommendations drawn from my three decades of experience across both the public and private sectors, including leadership roles delivering state‑of‑the‑art technical solutions nationwide. They reflect a deep, hard‑earned understanding of what succeeds—and what does not—in large‑scale federal technology transformation. These recommendations are offered as my personal perspective, grounded in professional practice and informed by lived experience.

To finish the mission, federal leaders must act on seven priorities: conduct immediate, transparent assessments of IPv6-only status; establish binding interim milestones through 2028; create a CISA‑led IPv6 Center of Excellence; enforce accountability through budgets, reporting, and leadership evaluations; close vendor gaps with full IPv6 procurement requirements; invest in workforce development to build lasting expertise; and integrate IPv6-only adoption into Zero Trust, cloud migration, modernization, and cybersecurity strategies. Together, these steps transform IPv6-only from a deferred mandate into the foundation of federal digital resilience.

Phase One: Establish the Ground Truth and Reset the Clock

1. Conduct Immediate Assessment and Transparency

• Every agency must report detailed IPv6-only implementation status by December 31, 2025 (or within 90 days of normal operations resuming if disruptions persist).
• Reports must go beyond percentages: specify which systems are IPv6-only, which remain dual‑stack, and what barriers block transition.
• Transparency creates accountability; public reporting creates pressure; detailed assessment enables targeted assistance.

This assessment is not about producing another compliance snapshot; it is about exposing the operational reality of federal networks. By requiring agencies to identify which systems remain dual‑stack and why, leaders can separate technical debt from vendor dependency and cultural resistance. That clarity allows policymakers to target interventions precisely—whether through funding, vendor mandates, or leadership accountability—and ensures that the path forward is based on facts, not assumptions.

Without transparency, there can be no accountability—and without accountability, there will be no progress.

2. Establish New Interim Milestones

• Agencies that missed FY2025 must adopt binding targets:
• 60% IPv6-only by September 30, 2026
• 80% IPv6-only by September 30, 2027
• 100% IPv6-only by September 30, 2028
• Embed these milestones in performance plans with CIO/CISO accountability.
• Require quarterly reporting with public dashboards tracking agency status.

Milestones are not arbitrary dates; they are instruments of discipline. Phased targets allow agencies to pace their transitions, measure progress, and avoid the “big bang” failures that come from deferring action until the final deadline. These checkpoints also give OMB and CISA the visibility to identify laggards early and intervene before failure becomes systemic.

Crucially, these milestones are achievable—but only with the comprehensive support infrastructure that was absent from the original M‑21‑07 implementation. A dedicated IPv6 Center of Excellence, robust training programs, coordinated vendor engagement, and clear accountability mechanisms will provide the scaffolding agencies need to succeed.

Deadlines matter because they drive discipline, and discipline is the difference between aspiration and achievement. Yet deadlines alone are not enough. To make these milestones real, agencies must be equipped with the tools, support, and accountability structures that will carry them across the finish line.

The following five priorities provide that foundation.

Deadlines drive discipline—and discipline is the difference between aspiration and achievement.

Phase Two: Deliver the Infrastructure to Succeed

3. Create an IPv6 Center of Excellence (CISA‑led)

• Technical Assistance: architecture reviews, security assessments, and troubleshooting.
• Reference Architectures: deployment templates, configuration guides, security frameworks.
• Training Programs: comprehensive IPv6 training and certification for federal IT staff.
• Vendor Coordination: centralized engagement to close product gaps and align roadmaps.
• Knowledge Sharing: forums, case studies, and collaboration platforms.

Agencies should not be left to reinvent the wheel. A centralized Center of Excellence ensures that lessons learned in one agency become shared assets for all. By consolidating expertise, standardizing architectures, and coordinating vendor engagement, the federal government can accelerate adoption while reducing cost and risk. This model has worked in other domains—cybersecurity, cloud, and Zero Trust—and it must now be applied to IPv6.

A Center of Excellence transforms isolated struggles into shared success.

4. Implement Accountability Mechanisms

• Budget Leverage: prioritize IT modernization funding for agencies showing IPv6-only progress.
• Elevated Reporting: require non‑compliant agencies to submit monthly remediation reports to OMB and CISA.
• Mandatory Assistance: agencies far behind must use the IPv6 Center of Excellence.
• Leadership Accountability: CIO/CISO evaluations must explicitly include IPv6-only progress.

Accountability is the missing ingredient in federal technology transformation. Without consequences, deadlines slip and priorities fade. By tying funding, reporting, and leadership evaluations directly to IPv6-only progress, the government can ensure that this mandate is treated not as optional guidance but as a binding requirement.

Accountability is not punishment—it is the engine of progress.

5. Address Vendor Gaps Systematically

• Federal procurement must require full IPv6 parity, not minimal “IPv6‑capable” compliance.
• Contracts should include IPv6 requirements, testing protocols, and remediation clauses.
• Federal purchasing power should drive market transformation by making IPv6 parity non‑negotiable.

Vendors respond to market signals, and the federal government is the largest IT customer in the world. By demanding full IPv6 parity in every contract, the government can close product gaps, accelerate vendor roadmaps, and ensure that agencies are not forced to maintain insecure dual‑stack environments. Procurement is policy—and in this case, it is the lever that can reshape the entire marketplace.

When the federal government demands parity, the market delivers it.

6. Invest in Workforce Development

• Establish IPv6 training requirements for all network and security staff.
• Create career pathways recognizing IPv6 expertise.
• Partner with universities and training organizations to expand the curriculum.
• Incentivize certification and advanced skill development.
• Build internal IPv6 expertise to reduce contractor dependence.

Technology transitions succeed or fail on the strength of the workforce. IPv6-only adoption requires not just technical skill but cultural confidence—the assurance that federal staff can design, operate, and secure these networks without perpetual reliance on contractors. By investing in training, certification, and career pathways, the government builds enduring capacity that will sustain modernization long after the initial transition is complete.

Technology endures only when people are trained to sustain it.

7. Integrate IPv6-only with Broader Federal Initiatives

• Zero Trust Architecture: make IPv6-only a prerequisite or parallel requirement.
• Cloud Migration: requires IPv6-only by default.
• IT Modernization: embed IPv6-only requirements into all projects.
• Cybersecurity: frame IPv6-only as foundational architecture, not an optional upgrade.

IPv6-only cannot be treated as a siloed initiative. It is the connective tissue that enables Zero Trust, cloud adoption, and modern cybersecurity. By embedding IPv6-only requirements into every modernization effort, the government ensures that resources are aligned, duplication is avoided, and security is strengthened at the architectural level.

IPv6-only is not a side project—it is the backbone of federal IT modernization.

Taken together, these seven priorities form more than a checklist—they are a blueprint for finishing the mission. Transparency exposes the truth, milestones enforce discipline, a Center of Excellence spreads expertise, accountability ensures follow‑through, procurement reshapes the market, workforce development builds lasting capacity, and integration embeds IPv6-only into the very fabric of federal modernization. This is not theory; it is a practical, achievable path forged from three decades of lessons learned. The question is no longer whether IPv6-only is necessary, but whether we will summon the will to execute. The time for hesitation has passed.

The time for leadership is now.

A Personal Reflection: Three Decades, One Mission

I have spent more than three decades of experience in IT across both public and private sectors, including sixteen years in federal leadership roles spanning multiple agencies. I have designed networks, built data centers, led engineering teams, overseen large-scale infrastructure deployments and upgrades, and shaped policy at the highest levels. Through it all, one technical truth has become undeniable: IPv6-only adoption is not optional. It is inevitable.

Over a decade ago, I began sounding the alarm on America’s urgent need to modernize its digital foundation—not just inside agencies, but in the public square. On May 1, 2014, I published my first public opinion article, Stop Using Internet Protocol Version 4!, across ComputerWorld, CIO.com, NetworkWorld, InfoWorld, and other IDG outlets. It marked the beginning of my public advocacy for IPv6 and was soon cited worldwide in books, academic papers, peer-reviewed journals, policy forums, technical briefings, and online platforms—including Wikipedia’s “Internet of Things” article, where it is referenced twice to support the foundational case for IPv6 as essential to IoT scalability and the global modernization of Internet infrastructure.

Since that first article, I’ve authored more than two dozen pieces on IPv6, digital infrastructure, and cybersecurity—published across ComputerWorld, Homeland Security Today, LinkedIn, and beyond. In 2015, IPv6, If Not Now, When?! warned of the growing urgency to move beyond IPv4. Five years later, Adopting and Enforcing an IPv6-Only Policy: If Not Now, When? called on the federal government to lead by example and set a firm deadline for IPv6-only adoption. And now, in 2025, my newly published Legacy Essay—“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years—featured in Homeland Security Today, revisits that call to action, tracing the progress made, the challenges faced, and the lessons learned.

The message remains clear: America must finish the mission. Completing the transition to IPv6-only is not merely a technical milestone—it is fundamental to strengthening national cyber resilience and securing a future-ready Internet.

For over a decade, I have championed this transition—not because it is easy or convenient, but because it is essential to the future of cybersecurity. I have written articles, spoken at conferences, briefed senior leaders, consulted with Internet pioneer Dr. Vint Cerf (Co-creator of the TCP/IP protocol suite) on IPv6 policy and implementation challenges, engaged CEOs, CIOs, and CISOs, contributed to policy development, and advocated relentlessly for what the technical evidence makes clear must be done.

As Technology Co-Chair of the Federal IPv6 Task Force, I led monthly Technical Roundtables and shaped implementation strategy across federal agencies. In 2015, my Task Force co-chair, Rene Smeraglia, publicly recognized me as an IPv6 thought leader within the U.S. government—an early acknowledgment of my sustained advocacy and technical leadership. Over the years, that reputation has grown across the federal IT community, where colleagues and conference peers have come to identify me as the government’s principal IPv6 advocate—a reflection of both technical mastery and enduring commitment to advancing IPv6-only adoption.

Today, through Alliance for Universal Computing™, I continue this work from a new platform, carrying forward the same conviction: the mission is unfinished, and its success is still within reach. My commitment to IPv6-only adoption is not tied to any government position, political administration, or organizational affiliation. It is rooted in technical truth and strategic necessity that transcend these temporary structures.

I am sometimes asked whether I am frustrated by the pace of progress. The honest answer is yes—but also no.

Yes, because I know we could have achieved this by now. The technical path is clear. The policy framework is sound. The timelines were realistic. With sufficient commitment and prioritization, federal agencies could be operating primarily IPv6-only today, with dramatically reduced attack surfaces and fundamentally stronger security postures.

But also no, because I understand that important transformations take time. Changing entrenched architectures, overcoming cultural resistance, developing expertise, and achieving organizational alignment across the vast federal enterprise is inherently difficult. Progress often comes more slowly than advocates hope, but faster than skeptics predict.

What matters most is sustained commitment to the correct long-term objective, even when short-term progress is disappointing.

Three decades in, I remain as committed as ever—not to a job title or agency, but to a technical truth and a strategic imperative. IPv6-only adoption is not just a protocol shift; it is a security foundation, a future-proofing strategy, and a moral obligation for those entrusted with digital stewardship.

A decade after first asking “If not now, when?”, that question still guides me. The mission continues—and so do I.

And as my published record shows, I have never stopped saying what must be said—because the mission demands it.

Why History Will Prove This Vision Correct

In a decade, when IPv6-only operations are standard practice, history will look back on the 2020s and ask why it took so long to embrace the inevitable. The mathematics of address space does not change. The security imperatives do not change. What must change is organizational will.

Every major transition in the history of computing—analog to digital, on-premises to cloud, static to software-defined—was resisted before it was accepted. IPv6-only adoption is no different. It represents not merely a protocol change but a paradigm shift in how nations build and defend digital infrastructure. When that shift is complete, it will be remembered not as a technical footnote, but as a defining milestone in the modernization of global networks and the strengthening of national resilience.

Technical realities always prevail over inertia. The only question has ever been when.

Moving Forward: Alliance for Universal Computing

Through the Alliance for Universal Computing™ (AUC), I continue this mission on a global scale—building upon the foundation established through the federal IPv6 transition to advance a broader vision: a universally interoperable, sustainable, and secure computing ecosystem.

AUC’s purpose extends beyond IPv6-only adoption. It seeks to unify global efforts around open, standards-based architectures that promote secure, future-ready digital infrastructure. By convening public and private organizations, academic institutions, and technical communities worldwide, AUC aims to accelerate innovation, strengthen cybersecurity by design, and advance sustainability and resilience as core principles of digital transformation.

The work continues. The mission endures. The vision remains clear: to build a connected world where universal computing standards enable both progress and protection for generations to come.

Conclusion: The Question Endures

Five years ago, I asked: “If not now, when?” The deadline has passed. The urgency has only intensified.

Federal IPv6-only adoption is a national security imperative—rooted in technical reality and driven by global competition. The policy is in place. The framework is sound. The leadership exists. What remains is execution.

• To federal IT leaders: The mission is clear. Execute with urgency.
• To policymakers: Sustain accountability, resources, and focus.
• To the cybersecurity community: Advocate relentlessly and support agencies in transition.
• To the American people: Demand secure digital infrastructure from your government.

Every day of delay expands the attack surface. Every hesitation deepens strategic disadvantage. Let us answer “If not now, when?” decisively—with intentional, urgent, and strategic execution.

The transition to IPv6-only is inevitable. Let us make it intentional, successful, and secure—for the nation and its future. IPv6-only is not a future option. It is the present mandate. History will measure us by whether we had the will to finish the mission.

About the Author

This article was originally published by Homeland Security Today (HSToday), where the author is recognized for his leadership in advancing national cybersecurity strategy and IPv6 modernization.

Visionary Founder & CEO, Alliance for Universal Computing™
Former Technology Co-Chair, Federal IPv6 Task Force
Recognized IPv6 Thought Leader | Inventor | Public Speaker | Columnist

The author continues to champion progress at the intersection of secure digital infrastructure, policy innovation, and future-ready computing. Feedback and dialogue are always welcome.

📚 Citation Formats for This Article:

APA (7th Edition) Citation

Charles Sun. (2025, October 15). “If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years. IPv6 Czar’s Blog. https://ipv6czar.blogspot.com/2025/10/if-not-now-when-federal-ipv6-only.html

Charles Sun. (2025, October 15). “If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years. Homeland Security Today. https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-the-unfinished-mission-of-federal-ipv6-only-adoption-five-years-later/

MLA (9th Edition) Citation

Sun, Charles. "“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years." IPv6 Czar’s Blog, 15 Oct. 2025, https://ipv6czar.blogspot.com/2025/10/if-not-now-when-federal-ipv6-only.html.

Sun, Charles. "“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years." Homeland Security Today, 15 Oct. 2025, https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-the-unfinished-mission-of-federal-ipv6-only-adoption-five-years-later/.

Chicago (17th Edition) Citation

Charles Sun. "“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years." IPv6 Czar’s Blog. October 15, 2025. https://ipv6czar.blogspot.com/2025/10/if-not-now-when-federal-ipv6-only.html

Charles Sun. "“If Not Now, When?”: The Federal IPv6-Only Mandate After Five Years." Homeland Security Today. October 15, 2025. https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-the-unfinished-mission-of-federal-ipv6-only-adoption-five-years-later/

Copyright © 2025 Charles Sun. All rights reserved.

This manuscript is the original work of the author and is protected under applicable copyright laws. The author retains full ownership of the content and reserves the right to publish, distribute, and adapt the material in whole or in part.

Non-exclusive republication rights are granted to editors, publishers, and media outlets—including but not limited to Homeland Security Today, LinkedIn, and affiliated platforms—provided that:

• The author is credited as Charles Sun, Founder & CEO of Alliance for Universal Computing™
• The original title and publication date are preserved
• Any edits or abridgments are subject to author review upon request
• A link to the official AUC website (www.aucglobal.com) is included in digital formats
• This republication does not restrict the author’s right to publish or distribute the work elsewhere

For syndication, translation, or derivative use inquiries, please contact:

 📧 press@aucglobal.com 🌐 www.aucglobal.com

© 2025 Charles Sun. All rights reserved.