Running PQC Readiness As A Programme: Governance, Roles And Budget

Post-quantum migration is usually framed as a technical change, but most of the hard decisions are about ownership, money and timing. The work will run for several years, touch most systems and depend on suppliers. Without clear governance it tends to stall after the first inventory.

This article draws on the most detailed public guidance available as of October 2026, the US Office of Management and Budget’s memorandum M-26-15, along with the UK National Cyber Security Centre’s migration timelines. M-26-15 is written for US federal agencies, so treat it as one well-documented model rather than a rule for everyone.

Why It Cannot Sit Only With IT

OMB is direct on this point: migration is not solely the job of the chief information officer and chief information security officer, and every member of the leadership team carries responsibility for it.¹ The NCSC makes a similar observation from a different angle, noting that migration will typically span several leadership cycles in a large organisation.²

The practical reason is that the decisions cross departments. Finance has to fund work that may not show results for years. Procurement has to write post-quantum requirements into contracts. System owners have to schedule changes into their own roadmaps. Risk owners have to decide which legacy systems can be tolerated and for how long.

Roles And Responsibilities

OMB’s Appendix B gives sample roles.¹ The table below maps those roles to the main activities of a programme. The R, A, C and I letters (responsible, accountable, consulted, informed) are our own illustration of how the roles described by OMB could divide the work, not a table OMB publishes. Each activity has exactly one accountable role, which is the usual rule for this kind of grid.

For US agencies part of this structure is now set by executive order. Executive Order 14412 required each agency head to name a PQC migration lead, reporting to the chief information officer and responsible for cryptographic inventory management, the prioritised migration plan and coordination across agencies, within 30 days of the order.³

In OMB’s descriptions, the CIO and CISO are accountable for prioritisation, risk acceptance and resourcing. The programme office makes sure vendor requirements include post-quantum readiness and crypto-agility. The chief financial officer works with them to get migration costs into the annual budget request. A migration lead coordinates the programme and reports to senior leadership, a technical lead oversees inventory, algorithm choice and testing, a security architect handles integration, and system owners implement the change on their own systems.¹

What A Migration Plan Should Contain

OMB lists the minimum contents of an agency migration plan.¹ The list works well as a checklist for any organisation:

OMB also expects the plan to be a living document that matures over time.¹ Expect the first version to contain gaps, and record them openly rather than filling them with guesses.

Budgeting Without Surprises

The NCSC says the total cost of migration could be significant and that organisations should budget for preparatory work as well as for the migration itself.² As of October 2026 we are not aware of a reliable published cost benchmark for private organisations, so the first budget will usually be an estimate built from the inventory.

Costs fall when migration rides on changes that are already planned. OMB makes the same point: it tells agencies to fold post-quantum upgrades into cloud migrations, software development lifecycles and hardware refresh cycles to keep costs down, and to flag systems that cannot support post-quantum or hybrid cryptography as priorities for replacement or retirement.¹ The NCSC adds that some legacy systems may never be capable of post-quantum cryptography, and that the strategy has to account for them.²

Fitting Into Existing Frameworks

A migration programme does not need its own control framework. NIST’s NCCoE has published a draft mapping of its migration project capabilities to the NIST Cybersecurity Framework 2.0 and to the SP 800-53 control catalogue, so that post-quantum work can be tracked inside controls many organisations already use.⁴ OMB similarly asks agencies to build migration into existing governance, asset management and supply chain risk processes.¹ Canada’s federal roadmap treats the same supporting work as part of its preparation phase, listing roles and responsibilities, financial planning, an education strategy and procurement policies among the early activities.⁵

The NCSC also suggests publishing a statement of intent for your migration. It signals demand to suppliers and shows customers that the threat is being managed.²