OMB, Commerce Lay Out Road Map for Post-Quantum Migration

Encryption & Key Management , Government , Industry Specific OMB, Commerce Lay Out Road Map for Post-Quantum Migration Federal Investment Shifts From Research Toward Implementation Tiffany Wang • June 29, 2026     Credit Eligible Get Permission The US federal government has issued a detailed road map requiring agencies to begin post-quantum cryptography implementation immediately, while backing the transition with billions of dollars in quantum investments. (Image: Shutterstock) In 2019, researchers estimated that breaking RSA public-key encryption would require a quantum computer with 20 million physical quantum bits. Fast-forward to 2025, the same researcher at Google Quantum AI had reduced that estimate to fewer than 1 million physical qubits, thanks to more efficient algorithms. See Also: Securing AI Workloads With Ubuntu Pro The rapid pace of progress has gotten the attention of many enterprises, fearing the Biden administration's original 2035 deadline for transitioning to quantum-resistant cryptography may be too late to prevent foreign adversaries from cracking encrypted data. This year, Google and Cloudflare accelerated their own migration timelines to 2029, signaling greater urgency across the industry. That urgency appears to have reached Washington. Last week, the White House issued an executive order directing federal agencies to complete post-quantum cryptography migration for high-value and high-impact assets by 2030 and transition digital signatures by 2031. The director of the White House Office of Science and Technology Policy went even further, saying the transition could be completed by 2028 - just two years away. "This is not the first piece of U.S. federal PQC policy. NSM-10 and M-23-02 already targeted high-value and high-impact systems, but their requirement was to inventory and plan, with 2035 as an aspiration to be met 'as feasible,'" said Marin Ivezic, quantum security researcher and CEO of Applied Quantum. "The order replaces it with a completion mandate, hard 2030 and 2031 dates, named accountable officials and FAR rules extending the same deadline to contractors." The Office of Management and Budget - tasked with issuing transition guidance within 90 days of the executive order - published required actions, timeline and staff responsibilities just two days later. The memorandum requires agencies to fold post-quantum planning into their existing cybersecurity governance and submit an implementation plan with risk-based prioritization within 120 days. Under the plan, agencies will spend the first year conducting inventory assessments to create a dynamic, continuously updated inventory of cryptographic assets, known as a cryptographic bill of materials. The machine-readable inventory will provide a real-time view of each agency's cryptographic posture. The second year should focus on piloting early migration of prioritized systems. Then, migrating key establishments with high-impact systems and highly sensitive data should happen between 2028 and 2030, with signature migration concluding by 2031. The plan leaves a final period that goes until 2035 for a full migration of remaining systems. "Some organizations have probably more manageable-sized tasks to get from where they are now to quantum-resistant, while a big department like the Department of War, the Department of Energy has an incredible diversity of IT systems and legacy systems," Celia Merzbacher, executive director of Quantum Economic Development Consortium, an industry-driven partnership established by the National Quantum Initiative Act of 2018, told ISMG. Merzbacher said these agencies have been inventorying for years. They know what needs to be done and the resources they will have, so getting the job done ultimately depends on how quickly they can undertake the steps, she said. Federal funding for quantum research and development has remained steady at around $1 billion annually over the past four years, based on estimated and proposed budgets for 2024 and 2025. The funding supports quantum sensing, computing, networking, interdisciplinary research and use-case development. Roughly $200 million of the overall budget is directed toward quantum computing research, supporting activities such as the development of quantum bits, algorithms, software and computers. Merzbacher said the funding to date has been solid, but it must be sustained because it's getting pulled in many different directions. "It's a huge scope of work. And at the end of the day, [the billion-dollar funding] doesn't really go that far," she said. On May 21, the Department of Commerce announced plans to invest $2 billion to incentivize two quantum chip-making foundries and seven quantum computing companies. The funding comes from the $280 billion CHIPS and Science Act of 2022, which primarily supports semiconductor research and manufacturing while also funding scientific research in areas including quantum computing and artificial intelligence. "The entire National Quantum Initiative authorized only $1.25 billion across five years at the various agencies. Secretary Lutnik's announcement and the Commerce Department announcement last month in a single package in a single day for the computing and manufacturing layers alone was nearly twice the national quantum initiative," said Deputy Secretary Paul Dabbar of the U.S. Department of Commerce last week at a quantum conference. The National Institute of Standards and Technology, which sets standards for deploying cryptology defenses for the quantum era, has mandated the first deployments to happen in the federal government, Dabbar said. The Commerce Department will lead the government-wide migration by initiating a pilot project by the end of 2027 and will serve as the "biggest customer" to adopt the new technology. Dabbar said the United States has spent years building every layer of its quantum ecosystem, from scientific research that had no commercial application and an inquisitive culture to the cultivation of talents. The focus is now shifting toward commercialization. "We're now building the industrial layer, building the world's first two founder commercial foundry companies and building the supply chains into manufacturing as the leading country in the world for manufacturing of quantum devices," Dabbar said. "We're building the markets layer for companies that are looking at deploying quantum into their operations. We're calibrating the technology exports for controls and making certain that our adversaries are not looking at trying to steal what you all have built."