The answer, up front
This is an analysis of a 2024 document. In July 2024, the Office of Management and Budget (OMB) sent Congress a report on migrating federal information systems to post-quantum cryptography (PQC), as the Quantum Computing Cybersecurity Preparedness Act requires 1, 3. It rests on four precepts, projects about $7.1 billion over 2025 to 2035, and makes inventory the first job 1.
Report analyzed: July 2024. Updated Sep. 30, 2026 with a section on later developments.
What the report says about the threat
OMB says a cryptanalytically relevant quantum computer (CRQC) "is not yet known to exist." It adds that steady advances in quantum computing "may yield a CRQC in the coming decade" 1. That is a planning signal, not a prediction of a date.
The more immediate driver is record-now-decrypt-later. An attacker can copy encrypted data today and decrypt it once a CRQC arrives. OMB notes that zero trust policies already require encryption of data moving across internal agency networks, so the exposure is not limited to the internet edge 1. Harvest Now, Decrypt Later explains how to test your data against this risk.
The four precepts, read as an execution order
OMB states that the federal strategy is "based on four primary precepts" 1. ArcQubit guidance: read them as a sequence.
| Precept (OMB) | What it means in practice |
|---|---|
| 1. Keep a comprehensive and ongoing cryptographic inventory | Visibility comes before algorithms |
| 2. Start before a CRQC is known to be operational | Data outlives the threat timeline |
| 3. Prioritize systems and data | Sequence by mission impact and data life |
| 4. Identify systems that cannot support PQC early | These drive cost and schedule |
Precept 1: inventory is the baseline
OMB calls the inventory a "key baseline for successful migration." It explains that automated inventories may miss cryptography because tools may not see an entire network or work with every digital system. So under M-23-02, each agency must perform an annual manual inventory 1.
The report also says the ubiquitous and embedded nature of public-key cryptography makes inventory an iterative, ongoing process. Patching and lifecycle refreshes keep changing it 1.
Precept 2: start early, and plan to 2035
OMB uses 2035 as a planning horizon. Its prioritization criteria include systems holding data "expected to remain mission-sensitive in 2035" 1. Ask of every dataset: if someone recorded this today and decrypted it in 2035, would it still matter?
Precept 3: prioritize, because migration is not a cutover
OMB warns that if one party migrates and its partner does not, an encrypted connection may fail. Many systems "fail secure," so data stops flowing. The report states that "this migration will not be as simple as flipping a switch" 1.
Under M-23-02, OMB expects these to move first: high impact systems, agency high value assets, and other systems likely to be vulnerable to CRQC attacks. That last group includes systems with data still sensitive in 2035 and logical access control systems built on asymmetric encryption, such as public key infrastructure 1.
Precept 4: find the systems that cannot migrate
OMB describes systems whose algorithms are hardwired into hardware or firmware, or that cannot accept replacement algorithms. It says the cost to replace them "constitutes a significant portion of the overall estimate" 1. Finding them late turns a program into a procurement emergency.
The budget and the standards
The report projects that the government-wide cost to migrate prioritized systems between 2025 and 2035 will be approximately $7.1 billion in 2024 dollars. OMB calls this a rough order of magnitude with a high level of uncertainty. National security systems are estimated separately 1.
On standards, the report's timeline expected the first three PQC standards in July 2024 and the start of FALCON digital signature standardization in August 2024 1. NIST released FIPS 203, 204, and 205 on August 13, 2024, and said a fourth standard based on FALCON (FN-DSA) was planned for late 2024 2. Check NIST for the current status of that standard.
What changed since the 2024 report
Two June 2026 documents now drive federal timing. Executive Order 14412 was signed June 22, 2026 and published June 25, 2026 4. OMB memorandum M-26-15 is dated June 24, 2026 5.
- M-26-15 sets phases from 2026 and a 2035 end point. Phase one, 2026 to 2027, focuses on inventory 5.
- The order sets December 31, 2030 for key establishment and December 31, 2031 for signatures in OMB's guidance 4.
- Agency plans are due to OMB and the National Cyber Director within 120 days of the memo, which is October 22, 2026 5.
The 2024 report explains the reasoning. The newer documents carry the dates. See Global Mandates and Deadlines for the full comparison.
What this means for executives and the board
ArcQubit guidance: treat the report as a template for governance even if you are not a federal agency. Its logic applies to any large estate.
- Fund the inventory first. Everything else depends on it.
- Budget for replacement, not just software updates. Hardware-bound cryptography sets the schedule.
- Name owners and dates. Prioritization is mission sequencing and partner coordination, not only an engineering backlog.
Questions to ask your team this week
- Does our inventory map real cryptographic dependencies, or only systems?
- Which data must stay confidential through 2035?
- Which partners must migrate before we can?
- Which systems cannot accept new algorithms, and who owns the replacement plan?
Common mistakes
- Treating automation as complete. OMB itself requires manual inventory where tools fall short.
- Waiting for standards to settle. Start inventory, governance, and supplier alignment now.
- Ignoring internal traffic. The report ties zero trust encryption to the same risk.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the analysis above.
QuCode is ArcQubit's enterprise discovery and inventory product. It runs read-only scans, brings in the results of scanners you already run, and produces a Quantum Exposure Report that names each finding, its location, and whether your team or a supplier must fix it. QuCode is sold directly by ArcQubit. QuTrust then serves as the system of record for the migration roadmap. The AI & Quantum Consulting team can help scope the work.