Agencies have four months to finalize quantum-ready migration plans Federal officials have four months to draw up plans for migrating systems to encryption methods that could protect against the future cybersecurity threats posed by quantum computing. In a new memorandum, the Office of Management and Budget set deadlines for agencies to establish migration plans for post-quantum cryptography (PQC), giving agency heads 120 days from its publication to finalize those documents. Per the memo, which was dated Wednesday but released publicly Thursday, the goal is to migrate “as much quantum risk as feasible by December 31, 2030.” The memo comes days after the release of President Donald Trump’s anticipated quantum executive orders and establishes more specific requirements for agencies on the system security-focused directive. Under the OMB guidance, agency migration plans must prioritize high-impact systems, high-value assets, and any other system with either highly sensitive data or that is vulnerable to quantum computing attacks. They’re also required to update governance structures — including the appointment of a new “migration lead” — and prioritize PQC upgrades to existing systems and the purchase of third-party software. There will be five phases for implementation in those plans, beginning with a planning and discovery phase this year, moving to pilots and early migration over the next couple of years, hitting deadlines for priority migration in 2030 and 2031, and culminating in full migration in 2035. While a quantum computer that could pose the threat of decryption — known as a cryptographically relevant quantum computer (CRQC) — isn’t known to exist yet, the technology is expected to eventually be able to crack the math that underpins classical encryption methods. As a result, both the public and private sectors have been hard at work coming up with new cryptographic methods to shield private information from those capabilities.