up:: For Policymakers MOC
Who pays for this?
The U.S. government has costed its own share at approximately $7.1 billion for priority federal civilian systems between 2025 and 2035, excluding national security systems entirely.
Everyone else pays for themselves, and that’s where the policy problem sits. The organizations holding some of the most exposed systems, meaning small water utilities, rural hospitals, county governments, and regional transport operators, have the least capacity to pay for anything. They didn’t create the risk, and pricing it or even locating it sits beyond what their staffing supports.
A mandate they can’t fund produces documented non-compliance rather than migration.
The short version:
- $7.1 billion is the U.S. projection for priority federal civilian systems, 2025 to 2035, and it excludes defense and intelligence.
- The figure came from inventory then costing, which is the same 2-step any organization has to run.
- The algorithms are free. The cost is labor, coordination, and replacing equipment that can’t be updated.
- Small operators are the gap. They hold exposed infrastructure and have no capacity to inventory it, let alone migrate it.
- **Y2K cost the U.S. an estimated 8.5 billion was federal, which is the closest precedent for scale.
- Delay raises the bill, because a compressed migration pays premiums a phased one avoids.
What has the government actually costed?
The Office of Management and Budget projected approximately $7.1 billion in 2024 dollars to migrate priority federal civilian information systems to post-quantum cryptography between 2025 and 2035. OMB labels it an initial projection carrying “a high, but expected, level of uncertainty,” because agencies were still building inventories when it was produced.
Source: Office of Management and Budget, “Report on Post-Quantum Cryptography,” July 2024, OMB PQC Report.
Three qualifiers travel with it. It excludes national security systems, so the whole-of-government figure is higher than the published civilian number. It covers a decade across an entire federal civilian government, so it can’t be scaled down to a single organization by any ratio. And it was produced by aggregating individual agency assessments, after those agencies were directed to inventory their cryptographic systems and then assess what migration would require.
Source: Office of Management and Budget, Memorandum M-23-02, November 18, 2022, OMB M-23-02.
That last point is the transferable one. The government produced a defensible number by counting first and pricing second, which is the only method that produces a number anybody can defend.
What are we actually paying for?
The replacement algorithms are free public standards, so the spending is labor and equipment.
| What the money buys | Why it costs |
|---|---|
| Finding the cryptography | Locating every place encryption runs across applications, networks, certificates, and purchased products, at the algorithm level |
| Replacing it | Reconfiguring, reissuing certificates, testing each change against everything that depends on it |
| Replacing equipment | Hardware with cryptography fixed in firmware that no update can reach, which has to be bought new |
| Vendor coordination | Chasing supplier roadmaps and writing dated requirements into contracts |
| Running the program | Multi-year project management and coordination across agencies and teams |
The U.S. report names legacy systems with cryptography embedded in hardware or firmware as the most difficult and expensive category, precisely because they often can’t be updated and have to be replaced outright. That’s a capital cost rather than a software cost, and it’s the line that hits infrastructure operators hardest.
Who can’t pay, and what do they hold?
The mismatch between exposure and capacity is the substance of this question.
| Who | What they operate | Why they can’t fund it |
|---|---|---|
| Small water and wastewater utilities | Treatment control and remote monitoring for whole communities | Minimal budget, frequently no dedicated security staff at all |
| Rural and community hospitals | Patient records, imaging, connected medical devices | Thin margins, and clinical equipment on long replacement cycles |
| County and municipal government | Identity records, court files, emergency services, elections infrastructure | No capital budget line for cryptography, and competing statutory duties |
| Regional transport and utilities | Signaling, grid control, industrial equipment with decade-long lifetimes | Rate-regulated revenue, so unplanned capital spending needs approval |
| Small suppliers in regulated chains | Components and software inside larger systems | Inherit requirements through contracts with no funding attached |
Each of these holds systems whose failure reaches the public, and none of them can absorb a multi-year program out of operating budget. A deadline applied to them without funding produces a compliance record showing non-compliance rather than a migration.
What funding mechanisms does a legislature actually have?
Six, and they differ sharply in speed and cost to the public purse.
- Direct appropriation. The clearest and the slowest. Sized against an inventory rather than a guess, which means funding the inventory first is the prerequisite for funding anything else.
- Grants to operators with no capacity. Targeted at the categories above. The design question is whether to fund the assessment, the remediation, or both, and funding assessment alone produces reports without change.
- Procurement preference. Costs nothing and works immediately. When government buys only from suppliers with a dated post-quantum commitment, the whole supplier base moves, including for their private customers.
- Tax treatment. Relief for assessment and remediation labor reaches organizations that a grant program would never enroll, and it reaches them without an application process.
- Safe harbors. Attach a liability benefit to completing an inventory and publishing a plan. Costs nothing directly and moves organizations that respond to risk rather than to subsidy.
- Insurance and regulator coordination. Define what readiness evidence looks like, so the private market prices the work rather than the public purse funding it.
The combination that gets furthest fastest is procurement preference plus an inventory requirement plus grants for those who can’t meet it alone, since the first is free, the second creates the visibility, and the third closes the capacity gap. See How do you make it worth doing.
What does the Y2K precedent tell us about scale?
That a coordinated remediation of this class is expensive, achievable, and easy to misjudge afterward.
The United States alone spent an estimated 8.5 billion of that by the federal government. Organizations inventoried systems nobody had examined in years, prioritized what mattered, fixed or replaced it, and tested against a deadline everyone could see.
Source: U.S. Senate Special Committee, S. Prt. 106-42, govinfo.gov.
Two differences change the funding picture rather than the scale. Y2K had a date on the calendar that everyone could plan against, and this has a capability threshold nobody can date, which makes appropriations harder to time. And Y2K’s failure would have been visible immediately, where this failure is silent, which removes the political urgency that funded the first one.
The comparison is also the strongest available argument that the money is findable. A comparable remediation was funded once, at roughly 14 times the current federal civilian projection.
What does delay cost?
Deferral raises the bill through 3 mechanisms, all of them ordinary.
- Compression pays a premium. The same work done in fewer years needs more parallel effort, more contractors, and more overtime.
- Late buyers lose leverage. The moment to get a dated commitment from a supplier is at purchase or renewal. A buyer chasing it against a deadline has nothing to trade.
- Phasing becomes impossible. Starting early spreads spending across budget cycles. A late start forces it into 1 window where it competes with everything else.
For a legislature there’s a fourth. Data collected while the decision is deferred is exposed retroactively, so the delay itself decides that a period of records stays readable. That cost never appears in a budget line.
Questions people ask
Is $7.1 billion the total cost to the United States? No. It covers priority federal civilian systems only and explicitly excludes national security systems, so the whole-of-government figure is higher. It covers no private-sector spending at all.
Can that figure be scaled down to a state or a company? No. It aggregates a decade of migration across an entire federal civilian government, and cost varies more between 2 similar-sized organizations than any ratio would capture.
Why fund an inventory rather than a migration? Because nobody can size a migration before knowing where the cryptography is. The government’s own number was produced that way, and funding remediation before assessment funds guesswork.
Who pays for critical infrastructure that can’t pay for itself? Unresolved. The available mechanisms are grants, rate-recovery approval for regulated utilities, and procurement pressure through the vendors those operators buy from.
Do the mandates come with money? The federal inventory and migration duties were issued without appropriations sized to them, which is why the funding question is live rather than settled.
Is there a cheaper option than migrating? For short-lived data, accepting the risk is a legitimate and much cheaper call, made explicitly. For systems with long confidentiality or service lives, deferral raises the eventual cost rather than avoiding it.
What’s the single cheapest effective measure? Procurement preference. It costs nothing, it works immediately, and it moves suppliers for their private customers as well as their government ones.
Where to go next
- How do you make it worth doing covers the incentive design in full.
- What happens to countries that cannot afford this covers the same problem between countries.
- What critical infrastructure is exposed covers what the underfunded operators actually run.
- What does this cost covers the same question for a private company.
- For Policymakers MOC is the full legislative route.
Go deeper into the technical detail
The technical cost model is What a PQC Migration Costs and The Inventory-First Cost Build.
These open the Post-Quantum Field Guide, a separate site written for security professionals.
Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.