U.S. Post-Quantum Migration Plans Put Unmigratable Legacy Systems on a Replacement Track
Summary
Under OMB Memorandum M-26-15, U.S. federal agencies must submit risk-prioritized post-quantum migration plans and identify legacy systems for priority replacement or decommissioning. The article compares Asian approaches and urges CISOs to set retirement dates.
Key points
- Federal civilian agencies submitted post-quantum cryptography migration plans for approval under OMB Memorandum M-26-15.
- Plans must cover cryptographic discovery, migration milestones, third-party coordination and cost estimates.
- Systems unable to support migration or hybrid cryptography must be identified and prioritized for replacement or decommissioning.
- The memorandum makes senior leaders accountable for accepting risks tied to systems that cannot be replaced immediately.
- The article says India and Singapore favor mitigation approaches, Hong Kong has a 2030 readiness target, and Australia restricts RSA and elliptic-curve algorithms beyond 2030.
- The author advises CISOs to distinguish migratable systems from those requiring replacement and assign the latter a replacement date. The article warns that long-lived sensitive data on systems that cannot migrate may be exposed to harvest-now, decrypt-later attacks.
Article Details
- Event Type
- U.S. federal post-quantum cryptography migration planning requirement
- Impact
- Federal civilian agencies must submit risk-prioritized migration plans and identify legacy systems that cannot support migration or hybrid cryptography, prioritizing them for replacement or decommissioning. Senior leaders are accountable for accepted risks, and the approach may influence regulators and organizations outside the United States.
People
Countries
AustraliaThe Hong Kong Monetary Authority has set a 2030 readiness target but that too is not a requirement. Australia comes closest to U.S. strategy. Its Information Security Manual won't approve RSA and elliptic-curveHong Kongadvisory also points toward mitigation, and its formal supervisory expectations are still to come. The Hong Kong Monetary Authority has set a 2030 readiness target but that too is not a requirement. Australia comesIndiaNo regulator in the region has gone as far as the United States. India's national quantum-safe road map isn't a legal mandate. On legacy systems, it recommends containing classical-only systems in controlled enclavesSingaporeThe Monetary Authority of Singapore's 2024 advisory also points toward mitigation, and its formal supervisory expectations are still to come. The Hong Kong Monetary Authority has set a 2030 readiness target but that tooUnited StatesNo regulator in the region has gone as far as the United States. India's national quantum-safe road map isn't a legal mandate. On legacy systems, it recommends containing classical-only systems in controlled enclaves