[{"data":1,"prerenderedAt":402},["ShallowReactive",2],{"blog-\u002Fblog\u002Fus-post-quantum-cryptography-migration-plan":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":333,"date":334,"description":335,"draft":336,"extension":337,"faqs":338,"findingsSource":7,"geo":351,"howto":7,"howtoTitle":7,"image":353,"industries":354,"keyFindings":7,"meta":357,"modified":358,"navigation":359,"path":360,"pullquote":7,"recommendations":7,"references":361,"related":377,"seo":386,"seoTitle":387,"signposts":7,"slug":388,"stats":389,"stem":392,"tags":393,"tldr":400,"__hash__":401},"blog\u002Fblog\u002Fus-post-quantum-cryptography-migration-plan.md","U.S. Post-Quantum Cryptography Plan: Analysis of the 2024 OMB Report","ArcQubit Team",null,{"type":9,"value":10,"toc":314},"minimark",[11,16,32,38,42,48,60,64,70,122,127,132,137,141,147,151,156,161,165,171,175,180,190,194,204,223,231,235,238,259,263,278,282,302,306,311],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,28,29,31],"p",{},"This is an analysis of a 2024 document. In July 2024, the Office of Management and Budget (OMB) sent Congress a report on migrating federal information systems to post-quantum cryptography (PQC), as the Quantum Computing Cybersecurity Preparedness Act requires ",[21,22,23],"span",{},"1",", ",[21,26,27],{},"3",". It rests on four precepts, projects about $7.1 billion over 2025 to 2035, and makes inventory the first job ",[21,30,23],{},".",[17,33,34],{},[35,36,37],"em",{},"Report analyzed: July 2024. Updated Sep. 30, 2026 with a section on later developments.",[12,39,41],{"id":40},"what-the-report-says-about-the-threat","What the report says about the threat",[17,43,44,45,47],{},"OMB says a cryptanalytically relevant quantum computer (CRQC) \"is not yet known to exist.\" It adds that steady advances in quantum computing \"may yield a CRQC in the coming decade\" ",[21,46,23],{},". That is a planning signal, not a prediction of a date.",[17,49,50,51,53,54,59],{},"The more immediate driver is record-now-decrypt-later. An attacker can copy encrypted data today and decrypt it once a CRQC arrives. OMB notes that zero trust policies already require encryption of data moving across internal agency networks, so the exposure is not limited to the internet edge ",[21,52,23],{},". ",[55,56,58],"a",{"href":57},"\u002Fblog\u002Fharvest-now-decrypt-later","Harvest Now, Decrypt Later"," explains how to test your data against this risk.",[12,61,63],{"id":62},"the-four-precepts-read-as-an-execution-order","The four precepts, read as an execution order",[17,65,66,67,69],{},"OMB states that the federal strategy is \"based on four primary precepts\" ",[21,68,23],{},". ArcQubit guidance: read them as a sequence.",[71,72,73,86],"table",{},[74,75,76],"thead",{},[77,78,79,83],"tr",{},[80,81,82],"th",{},"Precept (OMB)",[80,84,85],{},"What it means in practice",[87,88,89,98,106,114],"tbody",{},[77,90,91,95],{},[92,93,94],"td",{},"1. Keep a comprehensive and ongoing cryptographic inventory",[92,96,97],{},"Visibility comes before algorithms",[77,99,100,103],{},[92,101,102],{},"2. Start before a CRQC is known to be operational",[92,104,105],{},"Data outlives the threat timeline",[77,107,108,111],{},[92,109,110],{},"3. Prioritize systems and data",[92,112,113],{},"Sequence by mission impact and data life",[77,115,116,119],{},[92,117,118],{},"4. Identify systems that cannot support PQC early",[92,120,121],{},"These drive cost and schedule",[123,124,126],"h3",{"id":125},"precept-1-inventory-is-the-baseline","Precept 1: inventory is the baseline",[17,128,129,130,31],{},"OMB calls the inventory a \"key baseline for successful migration.\" It explains that automated inventories may miss cryptography because tools may not see an entire network or work with every digital system. So under M-23-02, each agency must perform an annual manual inventory ",[21,131,23],{},[17,133,134,135,31],{},"The report also says the ubiquitous and embedded nature of public-key cryptography makes inventory an iterative, ongoing process. Patching and lifecycle refreshes keep changing it ",[21,136,23],{},[123,138,140],{"id":139},"precept-2-start-early-and-plan-to-2035","Precept 2: start early, and plan to 2035",[17,142,143,144,146],{},"OMB uses 2035 as a planning horizon. Its prioritization criteria include systems holding data \"expected to remain mission-sensitive in 2035\" ",[21,145,23],{},". Ask of every dataset: if someone recorded this today and decrypted it in 2035, would it still matter?",[123,148,150],{"id":149},"precept-3-prioritize-because-migration-is-not-a-cutover","Precept 3: prioritize, because migration is not a cutover",[17,152,153,154,31],{},"OMB warns that if one party migrates and its partner does not, an encrypted connection may fail. Many systems \"fail secure,\" so data stops flowing. The report states that \"this migration will not be as simple as flipping a switch\" ",[21,155,23],{},[17,157,158,159,31],{},"Under M-23-02, OMB expects these to move first: high impact systems, agency high value assets, and other systems likely to be vulnerable to CRQC attacks. That last group includes systems with data still sensitive in 2035 and logical access control systems built on asymmetric encryption, such as public key infrastructure ",[21,160,23],{},[123,162,164],{"id":163},"precept-4-find-the-systems-that-cannot-migrate","Precept 4: find the systems that cannot migrate",[17,166,167,168,170],{},"OMB describes systems whose algorithms are hardwired into hardware or firmware, or that cannot accept replacement algorithms. It says the cost to replace them \"constitutes a significant portion of the overall estimate\" ",[21,169,23],{},". Finding them late turns a program into a procurement emergency.",[12,172,174],{"id":173},"the-budget-and-the-standards","The budget and the standards",[17,176,177,178,31],{},"The report projects that the government-wide cost to migrate prioritized systems between 2025 and 2035 will be approximately $7.1 billion in 2024 dollars. OMB calls this a rough order of magnitude with a high level of uncertainty. National security systems are estimated separately ",[21,179,23],{},[17,181,182,183,185,186,189],{},"On standards, the report's timeline expected the first three PQC standards in July 2024 and the start of FALCON digital signature standardization in August 2024 ",[21,184,23],{},". NIST released FIPS 203, 204, and 205 on August 13, 2024, and said a fourth standard based on FALCON (FN-DSA) was planned for late 2024 ",[21,187,188],{},"2",". Check NIST for the current status of that standard.",[12,191,193],{"id":192},"what-changed-since-the-2024-report","What changed since the 2024 report",[17,195,196,197,200,201,31],{},"Two June 2026 documents now drive federal timing. Executive Order 14412 was signed June 22, 2026 and published June 25, 2026 ",[21,198,199],{},"4",". OMB memorandum M-26-15 is dated June 24, 2026 ",[21,202,203],{},"5",[205,206,207,213,218],"ul",{},[208,209,210,211,31],"li",{},"M-26-15 sets phases from 2026 and a 2035 end point. Phase one, 2026 to 2027, focuses on inventory ",[21,212,203],{},[208,214,215,216,31],{},"The order sets December 31, 2030 for key establishment and December 31, 2031 for signatures in OMB's guidance ",[21,217,199],{},[208,219,220,221,31],{},"Agency plans are due to OMB and the National Cyber Director within 120 days of the memo, which is October 22, 2026 ",[21,222,203],{},[17,224,225,226,230],{},"The 2024 report explains the reasoning. The newer documents carry the dates. See ",[55,227,229],{"href":228},"\u002Fblog\u002Fpqc-mandates-deadlines","Global Mandates and Deadlines"," for the full comparison.",[12,232,234],{"id":233},"what-this-means-for-executives-and-the-board","What this means for executives and the board",[17,236,237],{},"ArcQubit guidance: treat the report as a template for governance even if you are not a federal agency. Its logic applies to any large estate.",[205,239,240,247,253],{},[208,241,242,246],{},[243,244,245],"strong",{},"Fund the inventory first."," Everything else depends on it.",[208,248,249,252],{},[243,250,251],{},"Budget for replacement, not just software updates."," Hardware-bound cryptography sets the schedule.",[208,254,255,258],{},[243,256,257],{},"Name owners and dates."," Prioritization is mission sequencing and partner coordination, not only an engineering backlog.",[12,260,262],{"id":261},"questions-to-ask-your-team-this-week","Questions to ask your team this week",[264,265,266,269,272,275],"ol",{},[208,267,268],{},"Does our inventory map real cryptographic dependencies, or only systems?",[208,270,271],{},"Which data must stay confidential through 2035?",[208,273,274],{},"Which partners must migrate before we can?",[208,276,277],{},"Which systems cannot accept new algorithms, and who owns the replacement plan?",[12,279,281],{"id":280},"common-mistakes","Common mistakes",[205,283,284,290,296],{},[208,285,286,289],{},[243,287,288],{},"Treating automation as complete."," OMB itself requires manual inventory where tools fall short.",[208,291,292,295],{},[243,293,294],{},"Waiting for standards to settle."," Start inventory, governance, and supplier alignment now.",[208,297,298,301],{},[243,299,300],{},"Ignoring internal traffic."," The report ties zero trust encryption to the same risk.",[12,303,305],{"id":304},"how-arcqubit-approaches-it","How ArcQubit approaches it",[17,307,308],{},[35,309,310],{},"This box describes ArcQubit's own method. Keep it separate from the analysis above.",[17,312,313],{},"QuCode is ArcQubit's enterprise discovery and inventory product. It runs read-only scans, brings in the results of scanners you already run, and produces a Quantum Exposure Report that names each finding, its location, and whether your team or a supplier must fix it. QuCode is sold directly by ArcQubit. QuTrust then serves as the system of record for the migration roadmap. The AI & Quantum Consulting team can help scope the work.",{"title":315,"searchDepth":316,"depth":316,"links":317},"",2,[318,319,320,327,328,329,330,331,332],{"id":14,"depth":316,"text":15},{"id":40,"depth":316,"text":41},{"id":62,"depth":316,"text":63,"children":321},[322,324,325,326],{"id":125,"depth":323,"text":126},3,{"id":139,"depth":323,"text":140},{"id":149,"depth":323,"text":150},{"id":163,"depth":323,"text":164},{"id":173,"depth":316,"text":174},{"id":192,"depth":316,"text":193},{"id":233,"depth":316,"text":234},{"id":261,"depth":316,"text":262},{"id":280,"depth":316,"text":281},{"id":304,"depth":316,"text":305},"Compliance","2026-01-13","Analysis of the July 2024 OMB report to Congress on post-quantum migration: four precepts, the $7.1 billion estimate, and what leaders should do with it.",false,"md",[339,342,345,348],{"q":340,"a":341},"How much will the U.S. government spend migrating to post-quantum cryptography?","The July 2024 OMB report projected about $7.1 billion in 2024 dollars to migrate prioritized federal information systems between 2025 and 2035. OMB called it a rough order of magnitude with a high level of uncertainty. National security systems are estimated separately [1].",{"q":343,"a":344},"What are the four precepts in the OMB post-quantum report?","OMB's four precepts are: keep a comprehensive and ongoing cryptographic inventory; start migrating before a cryptanalytically relevant quantum computer is known to be operational; prioritize systems and data; and identify systems that cannot support post-quantum algorithms as early as possible [1].",{"q":346,"a":347},"What does M-23-02 require for cryptographic inventories?","The OMB report states that under M-23-02 each agency must perform an annual manual inventory, because automated tools may not see an entire network or work with every digital system. Agencies also deliver an annual inventory of quantum-vulnerable cryptography on prioritized systems to OMB and the National Cyber Director [1].",{"q":349,"a":350},"Is this 2024 OMB report still the current federal plan?","No. It remains a useful baseline, but Executive Order 14412 (June 2026) and OMB memorandum M-26-15 (June 24, 2026) now set the current federal direction, including dated objectives for 2030 and 2031. Read the 2024 report for its reasoning and the newer documents for deadlines [4], [5].",[352],"washington-dc","\u002Fblog\u002Fus-pqc-plan.png",[355,356],"Cross-Sector","Government Facilities",{},"2026-09-30",true,"\u002Fblog\u002Fus-post-quantum-cryptography-migration-plan",[362,365,368,371,374],{"label":363,"url":364},"Office of Management and Budget, \"Report on Post-Quantum Cryptography,\" as required by the Quantum Computing Cybersecurity Preparedness Act, Pub. L. 117-260, Jul. 2024","https:\u002F\u002Fbidenwhitehouse.archives.gov\u002Fwp-content\u002Fuploads\u002F2024\u002F07\u002FREF_PQC-Report_FINAL_Send.pdf",{"label":366,"url":367},"National Institute of Standards and Technology, \"NIST Releases First 3 Finalized Post-Quantum Encryption Standards,\" NIST, Aug. 13, 2024","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2024\u002F08\u002Fnist-releases-first-3-finalized-post-quantum-encryption-standards",{"label":369,"url":370},"\"Quantum Computing Cybersecurity Preparedness Act,\" 6 U.S.C. 1526, Inventory of cryptographic systems; migration to post-quantum cryptography","https:\u002F\u002Fuscode.house.gov\u002Fview.xhtml?req=granuleid%3AUSC-prelim-title6-section1526%29&num=0&edition=prelim",{"label":372,"url":373},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":375,"url":376},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",[378,379,380,383],{"label":229,"url":228},{"label":58,"url":57},{"label":381,"url":382},"Cryptographic Inventory and CBOM Guide","\u002Fblog\u002Fcryptographic-inventory-cbom",{"label":384,"url":385},"Migration Roadmap","\u002Fblog\u002Fpqc-migration-roadmap",{"title":5,"description":335},"U.S. PQC Migration Plan: 2024 OMB Report Analysis","us-post-quantum-cryptography-migration-plan",[390,391],"OMB's July 2024 report projected about $7.1 billion (2024 dollars) to migrate prioritized federal information systems to post-quantum cryptography between 2025 and 2035 (OMB, Report on Post-Quantum Cryptography, Jul. 2024).","NIST released its first three finalized post-quantum encryption standards, FIPS 203, 204, and 205, on Aug. 13, 2024 (NIST, Aug. 13, 2024).","blog\u002Fus-post-quantum-cryptography-migration-plan",[394,395,396,397,398,399],"post-quantum cryptography","PQC migration","cryptographic inventory","NIST PQC standards","for government","industry analysis","The July 2024 OMB report to Congress built federal post-quantum migration on four precepts, estimated $7.1 billion for 2025 to 2035, and told agencies to inventory first and find unmigratable systems early.","jvdoioDKlxPu9Bq-3ot9gsKfXqcReah-q7rRVzSMyhQ",1792182884565]