Politics & Government · Federal Technology & Cybersecurity
The Quantum Budget Needs a Queue
October 7, 2026 · Commentary
A cryptographic inventory can show where the exposure is. It cannot decide which system deserves the next migration dollar.
A quantum computer capable of breaking today’s vulnerable cryptography has no confirmed arrival date. The budget meeting does.
On October 6, 2026, the Government Accountability Office publicly released GAO-27-108740, finding that none of 24 selected CFO Act agencies had fully addressed three preparatory practices for post-quantum cryptography migration: prioritized inventories, funding assessments, and testing.
But the date matters. The public report reflects work completed in September 2025. It is not an October 2026 readiness assessment.
What has changed since then is the deadline.
Executive Order 14412 directs agencies to transition high-value assets and high-impact systems to post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. OMB Memorandum M-26-15 requires agencies to submit risk-prioritized migration plans within 120 days of its June 24, 2026 issuance—October 22, 2026.
That moves the question beyond Where is vulnerable cryptography?
The next question is:
Which systems should receive money first?
Systems that appear on the same exposure list are not necessarily the same funding decision.
One may hold information that must remain confidential for another decade. Another may depend on authentication, signatures, vendors, and legacy interfaces that make migration operationally difficult. A third may be scheduled for retirement.
Those are different problems.
Three Systems
Consider three fictional federal systems. The costs below are illustrative, not estimates or HSG pricing.
System A: long-lived sensitive records.
The system stores investigative and personnel information expected to remain sensitive beyond 2030. Its dependencies are understood and migration appears technically manageable.
The risk is largely about confidentiality. Data captured today may still matter years from now. OMB specifically tells agencies to consider data expected to remain mission-sensitive in 2030 when prioritizing migration.
A long protection horizon can therefore justify moving this system toward migration even if another system appears more operationally important today.
System B: a high-impact operational service.
This system supports a mission that cannot tolerate prolonged disruption. It also depends on identity services, vendor products, APIs, legacy interfaces, and digital signatures.
Its risk is different.
Authentication and signatures protect trust in users, devices, software, and transactions. Replacing those mechanisms without understanding interoperability can create its own mission risk.
NIST’s migration project has separate workstreams for cryptographic discovery and interoperability testing, including identifying and resolving compatibility issues in a controlled environment.
So the first funded action may not be a full migration.
It may be a $300,000 controlled test before leadership commits several million dollars to broader implementation.
Fund the next risk-reducing action, not merely the biggest label.
System C: a legacy system scheduled for retirement.
The program office expects it to disappear within two years.
That can make a full migration look wasteful.
But “retiring soon” is not a control.
Is the replacement funded? Has it been awarded? Can it assume the mission? Has data disposition been planned?
A system can also disappear while its encrypted records, backups, and archived keys remain.
Shutdown is not the same as disposition.
If System C loses replacement funding, it moves up.
If System B’s vendor delivers native PQC support earlier than expected, its implementation path changes.
If System A’s retention requirement falls from 15 years to three, its protection horizon changes.
The Decision Record
For each system competing for funding, leadership should be able to see five things:
| Decision factor | What to document |
|---|---|
| Mission consequence | What happens if the system is compromised, disrupted, or unable to establish trust? |
| Protection horizon | How long must the information or function remain confidential, authentic, or trustworthy? |
| Cryptographic function | Is the primary concern confidentiality, authentication/signatures, or both? |
| Retirement evidence | Is replacement actually funded, scheduled, and capable of absorbing the mission and required data? |
| Next validation | What test, discovery step, cost estimate, owner decision, or unresolved assumption must be addressed next? |
OMB’s sample responsibility model makes CIO and CISO leadership accountable for prioritization, risk acceptance, and resource allocation. The CFO works with them and the migration program manager to represent resource needs in the annual budget request.
That is where the technical exposure list becomes a resource decision.
HSG’s role in that process is deliberately bounded.
We do not inventory cryptography, select algorithms, or validate implementations. We can help organize the evidence behind a funding decision: the sources, assumptions, dependencies, unresolved questions, and next validation required to explain why one action comes before another.
That is the Intelligence Gap™ between knowing where exposure exists and being able to defend what leadership funds next.
The useful output is one page:
Fund this action first. Here is why. Here is what it will cost to validate. And here is the strongest reason the ranking may be wrong.
Request a Decision Defensibility Briefing to examine the assumptions behind one system’s place in the PQC migration plan due October 22, 2026.