What does OMB M-23-02 require from federal agencies for post-quantum cryptography?

OMB M-23-02 (December 2022) requires all federal agencies to inventory their cryptographic assets, identify systems using quantum-vulnerable public-key cryptography (RSA, ECDH, ECDSA), submit a prioritized migration plan to CISA and OMB, and begin transitioning to NIST-standardized post-quantum algorithms including ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). Quantumize delivers the cryptographic inventory, CBOM, and machine-readable migration roadmap needed to satisfy these requirements.

What is the NSA CNSA 2.0 timeline for National Security Systems?

NSA CNSA 2.0 (September 2022) sets algorithm-specific migration deadlines for National Security Systems: firmware and software must support post-quantum algorithms by 2025, with preferred adoption by 2026 and full adoption required by 2030–2033 depending on system type. It covers key encapsulation (ML-KEM replacing ECDH), digital signatures (ML-DSA replacing ECDSA), and code signing. Quantumize deploys CNSA 2.0-compliant algorithms and produces the compliance evidence trail auditors require.

How long does cryptographic discovery take for a federal agency?

For a mid-size federal agency, a comprehensive cryptographic discovery engagement covering network protocols, application code, APIs, PKI, firmware, and supply chain dependencies typically takes 6–12 weeks. Larger agencies with distributed infrastructure or classified enclaves may require 16–20 weeks. The engagement produces a Cryptographic Bill of Materials (CBOM) that satisfies OMB M-23-02 inventory requirements and serves as the authoritative input for migration planning.

Industry Solutions

Post-Quantum Cryptography for Federal Government.

OMB M-23-02 mandates federal agencies inventory their cryptography and begin migration. NSA CNSA 2.0 sets a 2033 deadline for National Security Systems. Quantumize delivers the platform, methodology, and NIST-standardized algorithms to meet both mandates without ripping out existing infrastructure.

Request a Federal Readiness Assessment View Platform

The Quantum Threat

Why Federal Government Faces Urgent Quantum Risk

Understanding the specific threat model, data exposure windows, and regulatory pressures driving post-quantum migration urgency for federal government organizations.

Harvest Now, Decrypt Later Targets Federal Networks First

Nation-state adversaries prioritize federal communications, classified records, and inter-agency data flows. Every day that PII, intelligence products, and sensitive agency data travel over classically encrypted channels, they are candidates for collection and retroactive quantum decryption. The harvest is underway regardless of when Q-Day arrives.

OMB M-23-02 Compliance Is Not Optional

OMB M-23-02 (December 2022) requires all federal agencies to inventory cryptographic assets and submit a prioritized migration plan. Agencies without a documented CBOM and roadmap face audit exposure. Quantumize produces the machine-readable CBOM and WORM-locked compliance evidence regulators expect.

Legacy Infrastructure Extends Migration Timelines

Federal IT estates span decades of procurement cycles mainframes, on-premises data centers, cloud enclaves, and interoperability requirements with other agencies, contractors, and allied partners. Quantumize's hybrid mode (classical + PQC simultaneously) lets agencies migrate system by system without forced cutover windows or interoperability breaks.

Supply Chain Cryptographic Risk

FISMA-covered systems depend on commercial software stacks, cloud providers, and contractor systems whose cryptography is outside agency control. Quantumize's cryptographic discovery tooling surfaces third-party dependencies and library versions so agencies understand their full HNDL exposure surface, not just the systems they own.

Compliance

Regulatory and Policy Context

Federal agencies face a layered mandate structure driving cryptographic migration urgency.

OMB M-23-02

Directs federal agencies to inventory cryptographic assets and develop a migration roadmap aligned with NIST post-quantum standards (Dec 2022).

NSA CNSA 2.0

Requires National Security Systems to complete post-quantum migration by 2033, with intermediate milestones beginning in 2025.

NIST FIPS 203/204/205

The finalized post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) that all federal agencies must adopt as the migration target baseline.

CISA PQC Guidance

CISA's post-quantum cryptography initiative provides migration guidance and threat context for civilian federal agencies.

FISMA

Federal Information Security Modernization Act requires agencies to maintain continuous awareness of cryptographic posture as part of overall security authorization.

Platform Capabilities

How Quantumize Protects Federal Government

NIST-standardized post-quantum cryptography deployed with the specific capabilities, compliance evidence, and migration tooling federal government organizations require.

CBOM Generation & OMB M-23-02 Evidence

Quantumize produces a machine-readable Cryptographic Bill of Materials covering every algorithm, certificate, API, and key across agency systems the authoritative artifact for OMB M-23-02 compliance submissions and FISMA audits.

Hybrid Migration With Zero Downtime

Run ML-KEM (FIPS 203) alongside classical key exchange simultaneously. Both mechanisms must be broken to compromise any session. Agency systems continue operating throughout migration without forced maintenance windows.

WORM-Locked Compliance Audit Trail

Every cryptographic operation, migration step, and key event is logged in a tamper-evident audit trail exportable to S3 Object Lock for WORM-compliant regulatory evidence ready for Inspector General review or Congressional reporting.

FAQs

Common Questions About PQC in Federal Government

What does OMB M-23-02 require from federal agencies for post-quantum cryptography?: OMB M-23-02 (December 2022) requires all federal agencies to inventory their cryptographic assets, identify systems using quantum-vulnerable public-key cryptography (RSA, ECDH, ECDSA), submit a prioritized migration plan to CISA and OMB, and begin transitioning to NIST-standardized post-quantum algorithms including ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). Quantumize delivers the cryptographic inventory, CBOM, and machine-readable migration roadmap needed to satisfy these requirements.
What is the NSA CNSA 2.0 timeline for National Security Systems?: NSA CNSA 2.0 (September 2022) sets algorithm-specific migration deadlines for National Security Systems: firmware and software must support post-quantum algorithms by 2025, with preferred adoption by 2026 and full adoption required by 2030–2033 depending on system type. It covers key encapsulation (ML-KEM replacing ECDH), digital signatures (ML-DSA replacing ECDSA), and code signing. Quantumize deploys CNSA 2.0-compliant algorithms and produces the compliance evidence trail auditors require.
How long does cryptographic discovery take for a federal agency?: For a mid-size federal agency, a comprehensive cryptographic discovery engagement covering network protocols, application code, APIs, PKI, firmware, and supply chain dependencies typically takes 6–12 weeks. Larger agencies with distributed infrastructure or classified enclaves may require 16–20 weeks. The engagement produces a Cryptographic Bill of Materials (CBOM) that satisfies OMB M-23-02 inventory requirements and serves as the authoritative input for migration planning.

Who We Protect

Built for Organizations with Zero Margin for Error

Federal Government

State & Local Government

Defense & Military

Healthcare

Financial Services

Banking

Insurance

Legal

Manufacturing

Critical Infrastructure

Utilities

Energy

Aerospace

Telecommunications

Cloud Providers

SaaS Companies

Higher Education

Research Organizations

Technology Companies

Other Industries

State & Local Government Defense & Military Healthcare Financial Services All Industries

Federal Government Post-Quantum Readiness

Request a Federal Readiness Assessment

A post-quantum readiness specialist will walk through the specific threat model, regulatory requirements, and migration priorities for your federal government organization.

Post-Quantum Cryptography for Federal Government.

Challenges

Harvest Now, Decrypt Later Targets Federal Networks First: Nation-state adversaries prioritize federal communications, classified records, and inter-agency data flows. Every day that PII, intelligence products, and sensitive agency data travel over classically encrypted channels, they are candidates for collection and retroactive quantum decryption. The harvest is underway regardless of when Q-Day arrives.
OMB M-23-02 Compliance Is Not Optional: OMB M-23-02 (December 2022) requires all federal agencies to inventory cryptographic assets and submit a prioritized migration plan. Agencies without a documented CBOM and roadmap face audit exposure. Quantumize produces the machine-readable CBOM and WORM-locked compliance evidence regulators expect.
Legacy Infrastructure Extends Migration Timelines: Federal IT estates span decades of procurement cycles mainframes, on-premises data centers, cloud enclaves, and interoperability requirements with other agencies, contractors, and allied partners. Quantumize's hybrid mode (classical + PQC simultaneously) lets agencies migrate system by system without forced cutover windows or interoperability breaks.
Supply Chain Cryptographic Risk: FISMA-covered systems depend on commercial software stacks, cloud providers, and contractor systems whose cryptography is outside agency control. Quantumize's cryptographic discovery tooling surfaces third-party dependencies and library versions so agencies understand their full HNDL exposure surface, not just the systems they own.

Regulatory and Policy Context

Federal agencies face a layered mandate structure driving cryptographic migration urgency.

OMB M-23-02: Directs federal agencies to inventory cryptographic assets and develop a migration roadmap aligned with NIST post-quantum standards (Dec 2022).
NSA CNSA 2.0: Requires National Security Systems to complete post-quantum migration by 2033, with intermediate milestones beginning in 2025.
NIST FIPS 203/204/205: The finalized post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) that all federal agencies must adopt as the migration target baseline.
CISA PQC Guidance: CISA's post-quantum cryptography initiative provides migration guidance and threat context for civilian federal agencies.
FISMA: Federal Information Security Modernization Act requires agencies to maintain continuous awareness of cryptographic posture as part of overall security authorization.

How Quantumize Helps

CBOM Generation & OMB M-23-02 Evidence: Quantumize produces a machine-readable Cryptographic Bill of Materials covering every algorithm, certificate, API, and key across agency systems the authoritative artifact for OMB M-23-02 compliance submissions and FISMA audits.
Hybrid Migration With Zero Downtime: Run ML-KEM (FIPS 203) alongside classical key exchange simultaneously. Both mechanisms must be broken to compromise any session. Agency systems continue operating throughout migration without forced maintenance windows.
WORM-Locked Compliance Audit Trail: Every cryptographic operation, migration step, and key event is logged in a tamper-evident audit trail exportable to S3 Object Lock for WORM-compliant regulatory evidence ready for Inspector General review or Congressional reporting.