OMB orders federal agencies to inventory quantum-vulnerable cryptography
18 NOVEMBER 2022, WASHINGTON
The Office of Management and Budget issued memorandum M-23-02, "Migrating to Post-Quantum Cryptography." Its stated authority is National Security Memorandum 10, issued on 4 May 2022. The memorandum applies to federal executive agencies and excludes national security systems.
Agencies must inventory cryptographic systems vulnerable to quantum computers, focusing on high-impact systems and high-value assets. The inventory must describe each system's algorithms, key lengths, vendors, hosting arrangements and data lifecycle, and agencies must assess the funding needed to transition.
Deadlines include 30 days to designate an inventory and migration lead, 90 days for the Office of the National Cyber Director to release collection instructions, a first inventory due 4 May 2023 and annually after that, and, within a year, a CISA strategy for automated assessment tools. The target for completing migration is 2035.
The stated objective is to prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography before future quantum computers can compromise currently encrypted federal data.
Why it matters. This memorandum is a binding instruction to federal agencies, and it set the template for inventory work: which algorithms, which keys, which vendors, which hosting, and what data lifecycle. Vendors serving agencies should expect customers to ask for exactly this information. Other organizations can use the same fields as a reasonable model for their own inventory.