Guidance on Transitioning to Post-Quantum Cryptography

This memorandum serves as a guide for federal agencies on the transition to post-quantum cryptography (PQC) in compliance with National Security Memorandum 10. It outlines the necessity for agencies to prepare for the potential threats posed by quantum computers capable of compromising current cryptographic systems. The document details the steps agencies must take to conduct a prioritized inventory of their cryptographic systems, focusing on high-value assets and systems vulnerable to cryptanalytically relevant quantum computers. Agencies are instructed to submit their inventories annually, starting May 4, 2023, and to designate a lead for managing their cryptographic inventory and migration efforts. Additionally, the memorandum emphasizes the importance of assessing funding requirements for the migration to PQC and outlines timelines for submitting these assessments. It also mentions the development of automated tools for evaluating agency progress in adopting PQC, which will be released within a year of the memorandum's publication.