up:: For Policymakers MOC
What a governor needs to know
You hold the only lever in the country that currently reaches local government on this.
What can a state actually do is the institutional version of this page. This one is for the executive, and the difference matters, because most of what follows needs no legislature.
Not legal advice
This is general education about available authority rather than legal advice. What a particular state may do is a determination for its own counsel.
What is the situation in 5 sentences?
Encryption protecting data in transit today can be recorded now and decrypted years later, once a sufficiently capable quantum computer exists, so records with long confidentiality lives are exposed the day they travel rather than the day the machine arrives. Federal agencies are under a dated migration mandate. That mandate stops at the federal government. Your state operates health exchanges, Medicaid systems, retirement funds, universities, corrections, vital records and often election infrastructure, and none of it is covered. Neither is any city, county or school district in your state.
Why is the municipal layer your problem specifically?
Because nobody else can reach it.
OMB M-26-15, the federal migration directive, is addressed “TO THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES” and carries one explicit exclusion, for national security systems. The words local, tribal, municipal and territorial appear zero times in it. Cities are not carved out. They were never inside the universe it addresses.
Source: OMB, M-26-15, June 24, 2026, M-26-15 PDF.
Congress has not filled that space and no instrument indicates it will. Meanwhile the systems in that layer are the ones residents deal with daily: schools, public hospitals, benefits, courts, transit, vital records and property records. They hold some of the longest-lived personal data in public administration on the thinnest technology budgets in public administration.
A state reaches those entities routinely, through procurement terms, through the conditions attached to state funding, and through the agencies that already supervise them. No federal instrument does. That is not a small distinction, and it is currently unused by every state.
What can a governor do without the legislature?
Five actions, available through executive authority in most states.
1. Put the question into state procurement. State technology purchasing is large enough to move suppliers on its own. Requiring vendors to state their post-quantum position in writing, at contract and at renewal, is typically administrative rather than statutory. The obligation is disclosure rather than capability, which is what makes it adoptable now instead of after a market exists.
2. Extend that condition to state-funded local purchasing. This is the action nobody has taken and the one only you can. Where a state passes money through to municipalities, school districts or special authorities for technology, the same disclosure condition can travel with it. That is how the uncovered layer gets covered without a single new statute.
3. Direct state agencies to inventory their cryptography. The federal executive branch has required an algorithm-level inventory of its own agencies since 2023. A governor or state CIO can direct the equivalent under existing authority in most states.
Source: OMB, Memorandum M-23-02, November 18, 2022, OMB M-23-02.
4. Instruct the regulators you appoint to ask. Insurance departments, banking regulators and health agencies already run examination cycles. Adding a cryptographic inventory question to an existing cycle costs almost nothing and produces the first real visibility any state has had into private-sector readiness.
5. Name an owner. This work sits across incident response, privacy and IT operations while belonging to none of them, which is exactly why it drifts. Naming who owns it is the difference between a directive that lands and one that circulates.
Why isn’t this already handled by the people who run the systems?
Because for most services it was never their decision.
Two independent measurement studies published in 2026 found the same result at different scales: which infrastructure provider operates a service predicts its post-quantum support far better than anything about the organization that owns it. For email, once organizations sharing a mail provider are accounted for, a provider-only model reached an AUC of 0.994 against 0.156 for an organization-only model, which is below chance.
Source: Loizou and Ghadafi, arXiv 2608.02147, 2026, corroborated at global scale by Wickramasinghe et al., arXiv 2607.29005, 2026.
Read plainly: where a state agency looks ready, that is usually its vendor rather than a decision anyone made. Where it does not, that is usually its vendor too. Which is exactly why procurement is the lever rather than a technology program.
Why does this pay off for you?
Because the risk is asymmetric in a way that almost nothing else on a technology agenda is.
It costs nothing, so it cannot be attacked as spending. Four of the 5 actions above are directives and purchasing language. There is no appropriation to defend, no program to name, and no headcount to justify.
There is no organized opposition. Nobody lobbies against asking vendors to disclose what they support. This is one of the few security measures with no constituency arrayed against it.
The first-mover position is unclaimed. As far as this Guide can establish, no US state has extended a post-quantum procurement condition to its local governments. First at something checkable, for the cost of one directive.
And the downside of inaction lands on a person, not an institution. If long-lived state or municipal records surface later as having traveled under retired cryptography, the question asked will be what was known and when. An executive with a dated inventory, a dated procurement change and a dated measurement has an answer. One without them has a news cycle. Acting is cheap and never looks bad in hindsight. Not acting is free right now and only free right now.
The version that survives scrutiny is narrow
“First state to require post-quantum disclosure in technology procurement, including state-funded local purchasing” is checkable and defensible. A claim about the state being quantum-safe or quantum-ready is neither, and it will be tested by the first competent reporter who asks what was actually migrated. Claim the action, never the outcome.
What will I be asked, and what does a good answer sound like?
The question arrives as some version of “what is the state doing about quantum risk,” usually from a reporter or in testimony.
A weak answer describes the threat and names a distant date. An answer that holds up is specific about what the state operates against what it buys, whether the buying now asks the question, and when the state last measured.
“Most of our public-facing cryptography is operated by vendors rather than by the state, so we changed what we require at procurement and we extended that condition to the technology money we pass through to local governments, which no federal rule reaches. We inventoried what our own agencies run, because that is where a state decision changes the answer, and we measured on a dated basis so we can show movement rather than intentions.”
What not to claim. Do not say the state is migrating unless it is. Do not quote a completion date owned by vendors. And do not describe this as federal compliance, because no federal mandate applies to a state, and saying so invites a public correction.
Which state systems are worst exposed?
| System | Why it’s the worst case |
|---|---|
| Health exchanges and Medicaid | Clinical data with lifetime sensitivity, at population scale |
| State retirement systems | Financial and identity records spanning whole careers and beyond |
| Universities | Research data, health systems, and student records held for decades |
| Vital records | Birth, death, marriage. Permanent by definition |
| Corrections and courts | Sealed records, juvenile records, protected identities |
| DMV and identity | Biometric and identity data that cannot be reissued |
| Election infrastructure | Where the exposure is trust rather than confidentiality |
| Utilities and transport | Operational technology with service lives past 20 years |
The pattern across all 8 is the same: long-lived personal data, thin technology budgets, and equipment nobody plans to replace soon.
What should I ask my state CIO?
- Which systems that we operate ourselves hold records that stay sensitive for more than 10 years?
- For our largest services, who actually operates the infrastructure, and is that written into the contract?
- What does our email run through, and have we asked that provider about post-quantum support?
- How much technology money do we pass through to local governments, and does any condition travel with it?
- Which systems or equipment cannot receive a cryptographic update at all?
Question 4 is the one that distinguishes a governor from every other official in this Guide. Nobody else can ask it.
Questions people ask
Is this urgent or is it a 2035 problem? The exposure that matters is records with long confidentiality lives, and those are traveling now. The migration is slow, which argues for starting the cheap parts rather than for waiting. See Harvest Now Decrypt Later.
What does this cost? The 5 actions cost staff time. The migration itself is a multi-year program and nothing here commits the state to one.
Won’t this conflict with federal rules? The federal instruments bind federal systems. A state acting on its own systems, its own procurement and the entities it supervises is in its own lane.
Why not wait for Congress? The gaps have been open since the federal instruments were written and nothing indicates they close soon. See What is not legislated yet.
Is any state doing this already? This Guide does not track state-level activity comprehensively. If a state has adopted a post-quantum procurement condition or an inventory directive not reflected here, that is a correction worth sending. See Corrections and verification.
What about small municipalities with no capacity? They hold exposed systems and cannot act alone, which is the same problem the federal analysis identifies for small water utilities and rural hospitals. Shared state services or grant conditions are the realistic answers. See Who pays for this.
Where to go next
- What can a state actually do is the institutional version, including what needs legislation.
- What a mayor needs to know covers the level your pass-through conditions would reach.
- What can a city actually do is the operational version for a municipal CTO.
- Model legislative language carries drafting text for the provisions that do need a legislature.
- What is not legislated yet places this among the open gaps.
- For Policymakers MOC is the full policy route.
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs.