US Aims to Replace Legacy Systems While Asian Regulators Favor a Containment Strategy
On October 22, 2026, a significant deadline passed for U.S. federal civilian agencies, requiring them to submit detailed post-quantum cryptography migration plans. This deadline is poised to have far-reaching consequences not just within the United States, but also for public and private sector organizations worldwide. The initiative is part of a broader effort by the U.S. government to transition to post-quantum cryptography, especially following an executive order signed by former President Donald Trump.
The directive, outlined in OMB Memorandum M-26-15 by the U.S. Office of Management and Budget (OMB), mandates that federal agencies submit comprehensive plans to the Office of the National Cyber Director. The memorandum, issued in June, describes the plans as "dynamic documents that will mature over time." The key requirement is that agencies must present a risk-prioritized migration strategy. This includes not only identifying cryptographic systems but also setting execution milestones, coordinating with third parties, and providing cost estimates.
Although many aspects of the memorandum follow conventional lines, one provocative provision stands out: the emphasis on legacy systems that are deemed too complex or expensive to migrate. The guidance stipulates that agencies must identify systems incapable of supporting migration or hybrid cryptography, assigning these older systems the utmost priority for replacement or decommissioning. This directive indicates that federal authorities hold a firm stance against the continued reliance on outdated technology, signaling a significant mindset shift in the approach to cybersecurity.
Experts in the field believe that the discussions surrounding post-quantum migration typically adhere to a predictable framework, focusing on inventory, agility in cryptographic practices, and vendor interactions. However, they also highlight a critical issue: the growing tendency for organizations to grant exceptions for essential products that fail to support migration. Roger Grimes, founder of Post-Quantum Defense, notes that such exceptions can accumulate rapidly. "I’ve seen this occur in many companies where exceptions become so numerous that they undermine the initial intent of establishing a robust policy," he stated.
Furthermore, the memorandum explicitly acknowledges that not all systems can be replaced before a designated deadline. It places responsibility for risk acceptance on senior leaders, thus formalizing the notion that exceptions will occur. However, distinguishing feature of this approach is that these exceptions are now directly tied to an accountable individual and integrated alongside budgeting considerations — a strategic move aimed at enhancing transparency and responsibility.
In comparison, Asian regulators have exhibited a more cautious approach. Not a single regulator in the region has adopted a framework as aggressive as the U.S. model. For instance, India’s national quantum-safe roadmap serves as a guideline rather than a legal mandate. It advises containing classical-only systems within controlled environments when immediate migration isn’t achievable and managing risk accordingly. Meanwhile, the Monetary Authority of Singapore is expected to release formal supervisory expectations in 2024, though its current advisory indicates a preference for mitigation rather than transitional compulsion.
The Hong Kong Monetary Authority has set a 2030 readiness target, but again, it lacks mandatory requirements. Australia offers the closest parallel to U.S. policies with its Information Security Manual, which prohibits the use of RSA and elliptic-curve algorithms post-2030. However, this regulation concerns algorithms rather than the broader systems utilizing them.
Despite regional differences in regulatory stance, Chief Information Security Officers (CISOs) across Asia need not await formal directives. They can proactively categorize systems based on migration feasibility and establish replacement timelines for those that cannot be modernized. While such a list may be uncomfortable, naming vendors and core systems that have historically been overlooked, it represents the most candid assessment of quantum risk that an organization can attain.
The U.S. memorandum does not entirely resolve the legacy systems issue. However, it prevents outdated systems from being concealed within an exception list, a practice that risks compromising overall security. This aspect of accountability serves as a model for Asian regulators as they shape their own strategic blueprints. The transition to quantum resilience will likely face more hurdles stemming from antiquated systems than from evolving algorithms. Hence, the emphasis on proactive replacement is crucial in paving the way for future security advancements.