up:: For Policymakers MOC
What a member of Congress needs to know
The executive branch has been migrating since 2022. Congress has legislated almost none of what surrounds it.
What is not legislated yet is the full gaps register. This page is what a member’s office does with it.
Not legal advice
This is general education about published instruments and the gaps between them rather than legal advice.
What is the situation in 5 sentences?
Encryption protecting data in transit today can be recorded now and decrypted years later, once a sufficiently capable quantum computer exists, so records with long confidentiality lives are exposed the day they travel rather than the day the machine arrives. Federal agencies carry a dated migration mandate under OMB M-26-15. Almost everything around that mandate is unlegislated, including whether anyone is ever told, who bears the loss, and whether a device sold today can be updated at all. No obligation reaches the private sector directly. And no instrument at any level reaches cities, counties or school districts.
Why is the municipal gap a federal-structure problem?
Because it is the one gap created by how the instruments were written rather than by what they left out.
M-26-15 is addressed “TO THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES” and carries exactly one explicit exclusion, for national security systems. The words local, tribal, municipal and territorial appear zero times in the document. Local government is not carved out. It was never inside the universe the memo addresses, and an executive memorandum could not have reached it regardless.
Source: OMB, M-26-15, June 24, 2026, M-26-15 PDF.
That layer is not small. The federal .gov registry lists 12,716 local government domains: 8,928 city, 2,623 county, 1,100 special district and 65 school district. Those entities operate schools, public hospitals, benefits administration, courts, emergency dispatch, transit and vital records, holding some of the longest-lived personal data in American public administration on the thinnest technology budgets in it.
Source: CISA .gov registry, cisagov/dotgov-data, retrieved August 10, 2026.
States can reach that layer and mostly have not. The executive branch cannot reach it at all. Congress can, and has three ways to do it that need no new program.
What are the levers?
1. The cheapest vehicle already exists, and its funding phase is ending
The State and Local Cybersecurity Grant Program, created by the Infrastructure Investment and Jobs Act of 2021, put roughly $1 billion over 4 years into exactly the entities nothing else reaches. Its active funding phase is reported as concluding in FY 2026, with the period of performance running to FY 2029.
Source: CISA, State and Local Cybersecurity Grant Program. A member’s office should confirm current authorization and appropriation status directly, since this moves.
A reauthorization or successor is the single cheapest place in federal law to close the municipal gap. A condition attached to money already flowing reaches local government without any preemption question, without a new agency, and without a new appropriation if the program continues at all. The condition that costs the least and produces the most is a disclosure requirement rather than a capability mandate: recipients require their technology vendors to state post-quantum support and a dated plan in writing.
2. The gaps register is a legislative agenda that is already written
What is not legislated yet documents 8, each with an identified party bearing the loss. Ranked by what closes the most with the least new law:
| Provision | Why it ranks there |
|---|---|
| Updatability for long-lived products | Straightforward to draft, and the only gap that becomes permanently unfixable if deferred. A device manufactured in 2028 with fixed cryptography and a 20-year service life is a 2048 problem regardless of what any later Congress does |
| Inventory obligation for regulated entities | Extends to critical-infrastructure operators the duty federal agencies have carried since 2023, delegable to existing sector regulators with no new institutions |
| Notification tied to records rather than to detection | The hardest to draft and the most foundational, because no existing trigger fires for data that was copied rather than broken into |
| A safe harbor tied to completing an inventory | Attaches a benefit to the work rather than only a penalty to failure, which is what moves organizations with thin margins |
| Liability allocation | The most consequential and the slowest, because it requires a position on where the loss should fall rather than a default of leaving it with the individual |
Drafting text is at Model legislative language.
3. Oversight, where the question has no current answer
“Which federal instrument covers a city?” is a question no agency witness can answer affirmatively today. It is a clean oversight question with a documented premise, it takes 30 seconds to ask, and the answer is on the record either way.
Why does this pay off for you?
Because the gaps are documented, unowned, and nobody is defending them.
Nobody lobbies against disclosure requirements. There is no constituency arrayed against asking vendors to state what they support, which is rare on anything touching technology regulation.
The smallest useful version is an amendment rather than a bill. A condition on an existing grant program needs no floor time for a standalone measure, no new program, and in most framings no new money. That is a materially different lift from carrying original legislation.
Every gap on the register is unclaimed. They are published, sourced, and no member has attached their name to closing any of them. A legislator who names one owns it, and the updatability provision in particular has a property almost nothing in technology policy has: it is the only one that becomes impossible to fix later.
The constituency is every jurisdiction in the district. Every city, county and school district a member represents sits in the uncovered layer, and none of them can act on federal money that never arrives with a condition attached.
And the downside of inaction is asymmetric. If long-lived public records surface later as having traveled under retired cryptography, the question will be what was known and when. Three agencies described this collection as a present concern in August 2023 and no disclosure obligation followed, because none of the existing triggers fit. That statement is on the record and dated.
Source: CISA, NSA and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” August 21, 2023, cisa.gov.
Claim the provision, never the outcome
“First bill to close the municipal coverage gap” is checkable. A claim about making the country quantum-safe is neither checkable nor survivable, and it will be tested by the first competent reporter who asks what actually changed.
What should I ask an agency witness?
Five questions with documented premises, answerable in a hearing, where a deflection is audible.
- Which federal instrument requires a city, county or school district to inventory or migrate its cryptography?
- What is the mechanism by which a resident learns their data was collected under cryptography now retired?
- How many of the entities in your sector can currently produce an algorithm-level cryptographic inventory?
- What proportion of federal cryptographic risk sits inside vendor products rather than inside government systems, and what dated commitments does the government hold in writing?
- Which fielded systems and devices cannot receive a cryptographic update at all, and what is the plan for those?
Question 1 has no affirmative answer today, which is exactly why it is worth asking on the record. A longer version with what a substantive answer and a deflection each sound like is at What should I ask in a hearing.
What will I be asked, and what does a good answer sound like?
A weak answer describes the threat and names a distant date. An answer that holds up names a specific provision, a specific vehicle, and what it costs.
“The federal government has been migrating its own systems since 2022, and almost nothing around that has been legislated. Nobody has to tell you if your data was collected. Nothing requires a device sold today to be updatable, which is the one gap that becomes permanently unfixable if we wait. And no federal instrument reaches a single city or school district. I’m working on the smallest version that does something: a disclosure condition on cybersecurity money already going to local government.”
Questions people ask
Is this urgent or is it a 2035 problem? The exposure that matters is records with long confidentiality lives, and those are traveling now. The migration is slow, which argues for starting the parts that cost nothing. See Harvest Now Decrypt Later.
Hasn’t Congress already acted? Congress has acted on federal systems. The private-sector duties, the notification gap, the liability allocation, the updatability requirement and the municipal layer are all open.
Would a mandate on cities be an unfunded mandate? A disclosure condition attached to money already flowing is not, which is the reason the grant-condition route ranks first here. A capability mandate without appropriations would be, and the funding gap is itself one of the documented 8.
Is this partisan? Nothing on this page has an organized opposition, and the published instruments span administrations of both parties.
What is the smallest thing that matters? The updatability requirement for long-lived products, because it is the only one that becomes impossible rather than merely harder if deferred.
Where to go next
- What is not legislated yet is the full gaps register with the party bearing the loss in each.
- Model legislative language carries draft statutory text.
- What should I ask in a hearing covers oversight questions in depth.
- What a governor needs to know and What a mayor needs to know cover the levels a federal condition would reach.
- Who pays for this covers the entities with exposure and no capacity.
- For Policymakers MOC is the full policy route.
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs.