Budgeting for a PQC Future

Accurate cost estimation for post quantum cryptography (PQC) transitions is not only a financial planning requirement but also a federal mandate under NSM-10, which requires agencies to provide cost estimates for updating or replacing systems to meet future cryptography standards. This budgeting requirement ensures agencies can secure adequate funding and avoid mission disruptions due to insufficient resources during the quantum transition.

Developing accurate cost estimates for PQC transitions requires comprehensive analysis of multiple interconnected factors that extend far beyond simple technology replacement costs.

Direct technology costs typically include new hardware capable of supporting PQC algorithms, updated software licenses, and professional services for system integration and testing. However, these visible expenses often represent only a fraction of total transition costs. Agencies must also account for workforce development, including specialized training for cybersecurity professionals, system administrators, and end users who will interact with new cryptographic systems.

Beyond these technology expenses, operational considerations significantly impact cost projections. Agencies must account for potential system downtime during migrations, parallel operation requirements during transition periods, and ongoing maintenance of hybrid cryptographic environments. Risk mitigation strategies also carry financial implications, including enhanced monitoring capabilities, incident response preparations, and contingency planning for accelerated migration timelines if quantum threats emerge earlier than expected.

Long-term operational costs must be factored into financial planning, including increased computational requirements for post-quantum algorithms and enhanced key management systems. Agencies should make an effort to build a framework that provides considerations to factor many, if not all, of these costs when developing cost projections for migration to PQC.

Our final post in this series will look ahead to the migration work and planning required to become post-quantum ready.