Chuck Brooks is the president of Brooks Consulting International and one of Executive Mosaic’s GovCon Experts.
From a primarily scientific endeavor, quantum computing is developing into a technology that could have significant effects on cybersecurity, national security, economic competitiveness and the safeguarding of vital infrastructure. The United States cannot afford to wait until a quantum computer capable of cracking popular public-key cryptography exists in order to start safeguarding its most sensitive data.
Understanding the quantum threat is no longer the only challenge. It is carrying out one of the most intricate cryptographic transitions in contemporary IT history. Technological advancements bring about both extraordinary opportunities and consequential risks. As I explained in my book Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security, quantum computing has the potential to revolutionize advanced computing, scientific research, materials engineering and medicine. Additionally, it might compromise cryptographic systems that safeguard sensitive personal data, military networks, financial transactions, government communications and intellectual property.
Through legislation, federal cybersecurity frameworks, NIST standards, national security policies and increasingly stringent migration deadlines, the US has acknowledged this challenge. The most recent advancements in 2026 demonstrate that post-quantum cryptography, or PQC, is no longer just a topic for future study. Federal agencies, defense companies, government contractors and operators of critical infrastructure must immediately address this operational requirement. Before quantum computing creates an intolerable security gap, the main question is whether the US can convert policy into real, quantifiable progress.
As federal agencies and critical infrastructure operators race to meet new post-quantum cryptography deadlines, with CISA guiding the transition, the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10 will bring DHS leaders and industry together to discuss cyber resilience and the department’s priorities. Save your seat now!
Recognizing the Quantum Danger: Time Is Already Running
Public-key cryptography used today is based on mathematical puzzles that are very challenging for traditional computers to solve. Secure communications, digital signatures, identity verification and the creation of cryptographic keys are all supported by RSA encryption and popular elliptic-curve cryptographic systems.
The mathematical presumptions that safeguard these systems could be compromised by a sufficiently strong, fault-tolerant quantum computer executing Shor’s algorithm. Grover’s algorithm affects symmetric cryptography as well, but its effects are different and can usually be lessened with the right security settings.
It is still unclear when a cryptographically relevant quantum computer, or CRQC, will be developed. It is a very challenging engineering task to build a machine with the required scale, reliability, and error correction. No exact date should be regarded as an established fact because estimates differ. However, it would be a strategic error to wait for certainty.
The threat of “harvest now, decrypt later” is the immediate concern. In anticipation of future developments in quantum computing, adversaries can gather encrypted data now and store it. If the encryption of data depends on algorithms that a future quantum computer can crack, then data that is currently unreadable may eventually become readable.
Information with a long confidentiality life, such as classified government information, military planning, diplomatic communications, health records, sensitive financial data, industrial intellectual property and information about vital infrastructure, is especially vulnerable to this risk.
Additionally, the vulnerability goes beyond the privacy of data that is stored. Cryptographic mechanisms may need to be replaced or significantly altered in order to support digital signatures, software authentication, identity systems, certificate infrastructures and secure communications protocols. The implication for national security planners is simple: a quantum computer’s operational date is not always the relevant deadline. Sensitive data must be safeguarded against that possibility by that date.
Washington’s PQC Policy Framework
The federal government’s PQC strategy has evolved through a number of significant phases. The Cybersecurity and Infrastructure Security Agency’s readiness work, the National Institute of Standards and Technology’s cryptographic standards, the National Security Agency’s national security guidelines, and congressional legislation have all laid the groundwork for migration. More immediate milestones were added in 2026 by new executive action and federal implementation guidelines.
Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, issued on June 22, 2026, instructs the federal government to expedite the transition to post-quantum cryptography standards approved by NIST. Additionally, support for owners and operators of critical infrastructure is emphasized.
NIST, CISA, the National Security Agency, the Office of Management and Budget, and other federal agencies are given tasks by the order. It instructs agencies to create migration plans, evaluate high-value and high-impact systems, assign migration leads, and switch those systems to quantum-resistant cryptography on predetermined timelines.
Additional guidance for agency-wide implementation, governance and planning can be found in the accompanying OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography. Its main takeaway is that rather than being handled as a stand-alone technical project, PQC migration needs to be incorporated into current cybersecurity and enterprise risk management procedures.
Because cryptographic migration impacts almost every layer of an organization’s technology architecture, these developments are significant. Decisions pertaining to cybersecurity, procurement, application development, network engineering, identity management, cloud services, records retention and operational continuity must be coordinated. The federal framework is becoming more and more concerned with execution and accountability rather than just awareness.
The Federal PQC Schedule: The Important Milestones
As of October 2026, the following milestones offer a useful summary of the federal direction.
Date or milestone Federal mandate or guidance
- NIST completed its first three main PQC standards, FIPS 203, 204 and 205, in August 2024.
- Executive Order 14412, issued in June 2026, created a framework for accelerated federal PQC migration.
- Agencies were instructed to identify their PQC migration leads within 30 days of the executive order dated June 22.
- OMB was instructed to provide guidance on inventories, migration planning and the necessary transition of high-value and high-impact systems within ninety days of the order.
- Agencies are required to submit PQC migration plans to OMB and the Office of the National Cyber Director within 120 days of OMB Memorandum M-26-15.
- NIST’s designated PQC migration pilot must be finished by December 31, 2027.
- According to the NSA’s declared CNSA 2.0 direction, new commercial products used in National Security Systems must support quantum-resistant algorithms starting in 2027.
- December 31, 2030, The June 2026 executive order requires the transfer of federal high-value assets and high-impact systems to PQC for key establishment. Additionally, 2030 is designated as a significant risk-reduction milestone by federal migration guidance.
- By December 31, 2030, legacy National Security Systems that are unable to support quantum-resilient algorithms must be phased out, according to the NSA’s stated directive.
- The executive order mandates that federal high-value assets and high-impact systems switch to PQC for digital signatures by December 31, 2031.
- In collaboration with NIST, CISA is required to publish public guidelines on the minimal components of a cryptographic bill of materials within 270 days of June 22, 2026.
Sources: The NSA’s October 1, 2026, announcement, OMB Memorandum M-26-15 and Executive Order 14412
Organizations should not treat these deadlines as interchangeable because they apply to different systems and activities. National Security Systems are subject to different regulations than federal civilian high-value assets and high-impact systems. The relevant policy, contractual requirements and system-specific guidelines must be reviewed by agencies and contractors. The timeline is important because the shift needs to start well in advance of 2030. It can take years to complete inventories, architecture evaluations, procurement choices, testing, vendor coordination and legacy technology replacement. The planning window is already limited for systems with extended service lives.
The Technical Foundation for Quantum-Resistant Security, or NIST
Organizations require verified, interoperable cryptographic standards before they can migrate at scale, which is why NIST plays a key role in the shift. NIST completed three Federal Information Processing Standards in August 2024 with the goal of addressing significant cryptographic risks associated with quantum computing.
FIPS 203: Based on CRYSTALS-Kyber, ML-KEM creates a module-lattice-based key-encapsulation mechanism. It gives communicating parties a standard method for creating shared secret keys.
FIPS 204: Based on CRYSTALS-Dilithium, ML-DSA creates a module-lattice-based digital signature algorithm. It uses digital signatures to support integrity and authentication features.
FIPS 205: SLH-DSA, which is based on SPHINCS+, creates a stateless hash-based digital signature algorithm. It offers a different hash function-based signature method.
These standards collectively cover two essential cryptographic tasks: creating secure keys and confirming the legitimacy of digital data. Guidelines for moving away from quantum-vulnerable cryptographic algorithms are another aspect of NIST’s work. The planned shift from susceptible algorithms to authorized quantum-resistant substitutes is outlined in its NIST IR 8547 transition document. Instead of depending solely on early drafts, organizations should keep an eye on the most recent developments regarding this guidance and the related implementation standards.
HQC was chosen by NIST in March 2025 as an extra algorithm for key-establishment standardization. This offers a possible substitute for the main lattice-based method; however, selection for standardization should not be equated with an instant approval to implement a specific implementation in every federal setting.
The useful takeaway is that PQC involves more than just buying a new encryption product. Organizations must decide which cryptographic functions they employ, ascertain which implementations and standards are applicable, evaluate compatibility, and confirm that systems continue to be safe and functional following migration. The technical basis is provided by NIST standards. Enterprises and agencies need to develop an architecture and deployment strategy based on that foundation.
CISA: From Knowledge to Operational Preparedness
CISA plays a significant role in assisting critical infrastructure organizations and federal civilian agencies with their transition preparation. Its work supports a larger effort to identify vulnerable systems, coordinate risk management and enhance readiness in addition to complementing NIST’s technical standardization.
The practical issue is that cryptography is frequently hard to understand. Applications, operating systems, network appliances, cloud services, identity infrastructure, software libraries, certificates and third-party products can all incorporate it. Before conducting a systematic inventory, organizations might not be aware of which vendor dependencies need to be changed or which algorithms are in use.
The importance of inventorying cryptographic assets, comprehending exposure and creating migration plans is emphasized by CISA’s quantum-readiness resources. The 2026 executive order also instructs CISA to create public guidelines for a cryptographic bill of materials and to assist owners and operators of critical infrastructure.
The software transparency idea embodied in a conventional Software Bill of Materials is expanded upon by a cryptographic bill of materials, or CBOM. A CBOM is designed to assist organizations in identifying cryptographic assets and their use within hardware and software products, as opposed to merely identifying software components.
Essential questions like: Where is vulnerable public-key cryptography being used? can be addressed with this visibility. Which systems rely on specific algorithms? Which third-party services, devices, libraries and certificates will need to be changed or replaced? Which assets require a larger modernization effort in order to be upgraded?
This is particularly crucial for operators of critical infrastructure. Modern cloud applications are often combined with operational and legacy technology that is difficult to replace in power grids, water systems, transportation networks, hospitals, financial services and telecommunications environments.
In an industrial control environment, a migration that functions well in a traditional office IT setting might need significantly different testing and scheduling. It is necessary to consider availability, safety, vendor support, latency, hardware limitations and regulatory requirements. Therefore, CISA’s function extends beyond merely announcing a deadline. Its purpose is to assist in establishing the coordination, visibility and useful guidance necessary for organizations to meet deadlines without generating new operational risks.
The NSA & the Department of War: The Risk Profile of National Security Is Different
Because the information they safeguard is sensitive, long-lasting and strategically valuable, the Department of War and the larger national security community face especially difficult PQC challenges. For many years, military networks, intelligence systems, weapons platforms, tactical communications, satellite infrastructure, command-and-control systems and defense industrial base technologies may be in use. Certain platforms can function for several generations of technology. Therefore, a cryptographic choice made today can have decades-long effects on security.
A crucial framework for updating cryptography used in National Security Systems is provided by the NSA’s Commercial National Security Algorithm Suite 2.0, or CNSA 2.0. In addition to defining migration expectations for systems and products supporting national security missions, its guidance finds quantum-resistant algorithms.
The NSA announced further actions in accordance with Executive Order 14412 on October 1, 2026. The announcement states that new commercial products used in National Security Systems must be able to support quantum-resistant algorithms starting in 2027. By 2030, legacy systems that are unable to handle quantum-resilient algorithms will be phased out. For the specific requirements governing each product category, organizations should refer to the relevant CNSA 2.0 specifications and acquisition requirements.
For defense contractors, this is a crucial procurement factor. Products that are currently being developed, purchased, or upgraded should be evaluated for their capacity to support authorized post-quantum algorithms, adapt to upcoming cryptographic developments and function safely in the pertinent national security environment.
The problem extends beyond data encryption. Digital signatures, authentication, secure software updates, identity infrastructure, communications links and reliable supply chains are all essential components of military systems. Any of these flaws have the potential to erode trust in the system overall.
Additionally, even after the technology used to protect it has been put into place, the Department of War and its suppliers must consider classified information that might still be sensitive. Attacks known as “harvest now, decrypt later” pose a long-term risk that cannot be determined only by the adversaries’ present capabilities. Defense leaders should integrate PQC migration into mission assurance, systems engineering, acquisition planning, cybersecurity evaluations and sustainment plans. It might be too late to wait until a platform has finished its typical modernization cycle.
Congress: The Next Stage of Oversight and the Legislative Basis
Before the current wave of federal implementation deadlines, Congress acknowledged the challenge of quantum cybersecurity. Enacted as Public Law 117-260 in December 2022, the Quantum Computing Cybersecurity Preparedness Act created a legal framework for federal planning. It encourages the creation of systems that support cryptographic agility and instructs the federal government to identify and prioritize information technology systems that are vulnerable. The harvest-now-decrypt-later threat and the necessity of a government-wide plan to transition to quantum-resistant cryptography were also acknowledged by the legislation.
That law was a crucial first step. However, the magnitude of the shift necessitates ongoing congressional oversight, sufficient funding, workforce development and collaboration between the public and private sectors.
The 2026 National Quantum Initiative Reauthorization Act was first proposed as another noteworthy legislative development is 3597 in the 119th Congress. Provisions pertaining to the implementation of post-quantum cryptography and the encouragement of standards and adoption are included in the proposed legislation. Before relying on it as an operative mandate, its provisions should be separated from requirements already enacted into law; its final text and legislative status should be examined.
In this process, Congress plays a number of crucial roles. It can first monitor agency preparedness. The significance of determining whether agencies have sufficiently identified vulnerable systems and tested quantum-resistant algorithms is emphasized in the Government Accountability Office’s October 2026 report, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat. These results support the necessity of quantifiable benchmarks as opposed to paper-based plans.
Second, Congress can guarantee that agencies have enough funding to upgrade infrastructure, train staff, replace outdated systems and facilitate the transition between complex technological environments. Software updates are not free when it comes to cryptographic migration. It may necessitate extensive testing, vendor contract modifications, hardware replacement, application redesign and operational downtime.
Third, legislators can promote uniformity between federal regulations and business practices. Commercial software, cloud service providers, telecom companies, hardware producers and specialized technology suppliers are all essential to government agencies. Vendors may be encouraged to invest in quantum-resistant capabilities if procurement expectations are clear and consistent.
Lastly, the transition can be kept risk-based with the support of congressional oversight. While agencies must still maintain a credible plan for the wider migration, high-consequence systems and data with lengthy confidentiality requirements should be given priority. Although the legislative framework is in place, its effectiveness will rely on its execution, accountability and continued focus.
The Requirements for Federal Contractors
PQC readiness should not be viewed as a future compliance exercise, but rather as a strategic business issue by federal contractors. Depending on their contracts, the systems they run and the sensitivity of the data they handle, contractors supporting critical infrastructure, defense, intelligence and civilian agencies may be subject to various requirements. They shouldn’t assume that every commercial product or contractor environment is subject to the same federal deadlines.
However, the direction of travel is evident. Federal clients will increasingly require suppliers to show that their goods and services are capable of supporting authorized quantum-resistant cryptography and that they have a solid plan in place to replace weak mechanisms.
A cryptographic inventory should be the first step in contractors’ preparation. This inventory should show which products rely on outside vendors, where public-key cryptography is used, which algorithms and protocols are involved, and which systems require major redesign in order to be upgraded. These dependencies should then be mapped by organizations to contractual obligations, product roadmaps, acquisition schedules and the expected availability of validated implementations. A product’s cryptographic architecture should be assessed for flexibility rather than being built around a single fixed implementation when it will be in use for many years.
PQC support, implementation validation, cryptographic agility, certificate management, product lifecycle support and migration costs are among the specific questions procurement teams should pose to vendors. Additionally, contractors should think about how their own suppliers will notify them of vulnerabilities and provide updates.
Demonstrating preparedness could become a significant differentiator for businesses competing in federal markets. Those who can demonstrate a well-run migration program might be in a better position to assist organizations with ever-tougher security regulations.
A Useful Organizational Roadmap
A phased strategy that links executive accountability with technical execution is necessary for a successful PQC transition.
Phase One: Identify cryptographic assets and establish governance. Establishing cross-functional oversight, designating an accountable migration lead and compiling a thorough inventory of cryptographic assets are all important for organizations. Applications, networks, cloud services, identity systems, certificates, hardware, software dependencies and pertinent third-party services should all be included in this work. Finding vulnerable cryptography applications and comprehending the operational significance of the impacted systems are the goals.
Phase Two: Set priorities according to risk. The risk associated with each cryptographic asset varies. Organizations should consider the system’s exposure, the likelihood of a successful migration, the dependencies involved, the sensitivity and anticipated useful life of the protected information and the consequences of compromise. Early attention should be given to systems that safeguard valuable government assets, vital services, important intellectual property and long-lived classified information. Investments can be justified and progress can be quantified with the aid of a documented prioritization model.
Develop and test the migration architecture in phase three. Organizations should evaluate interoperability, test performance under practical operating conditions and choose suitable NIST-approved algorithms and validated implementations. Certificate chains, authentication protocols, hardware constraints, network appliances, application dependencies and systems with stringent latency or availability requirements should all receive special consideration.
During a transition, hybrid approaches might be suitable in some situations, but they should only be used in accordance with relevant standards and authoritative guidelines. The system is not automatically made secure by adding a second algorithm.
Phase Four: Include PQC in modernization and procurement. Before purchasing or deploying new systems, their cryptographic agility and quantum-resistant capability should be assessed. Legacy platforms may need to be replaced, vendors may need to provide product roadmaps, and existing contracts may need to be amended. Businesses should refrain from establishing new reliance on cryptographic techniques that they plan to discontinue. The cost and complexity of migration over the next ten years will be impacted by procurement decisions made today.
Phase Five: Confirm, track and document developments. The percentage of cryptographic assets inventoried, the number of high-priority systems evaluated, the percentage of eligible systems migrated, the number of unresolved vendor dependencies and the status of legacy-system replacement are all quantifiable indicators that should be used to monitor migration.
Organizations should confirm that authorized algorithms are in fact being used, that out-of-date cryptographic techniques have been eliminated when necessary, and that operational systems are still performing as intended after migration. Instead of being a one-time project that ends when a deadline is reached, PQC readiness should become an ongoing governance responsibility.
The Challenge of Workforce & Innovation
This transition has a human component as well. Specialized knowledge is needed for quantum computing and post-quantum cryptography, but a much larger workforce will be necessary for the migration to be successful. The ramifications of cryptographic change will need to be understood by cybersecurity experts, software developers, system architects, procurement specialists, risk managers and executive leaders.
As an adjunct professor at Georgetown University who teaches cybersecurity risk management, I recognize the value of integrating knowledge of emerging technologies with real-world risk management. In addition to comprehending cryptographic algorithms, the upcoming generation of cybersecurity experts will also need to know how to handle technological shifts in intricate organizations.
To create training that connects cryptographic theory and practical application, academic institutions, governmental bodies, standards organizations, and business should collaborate. Personnel with the ability to evaluate vendors, interpret standards, manage inventories and coordinate migrations across technology portfolios will be needed by federal agencies.
Beyond PQC, this workforce investment will pay off. Resilience against traditional cyber threats will also be strengthened by stronger technology governance, disciplined procurement, enhanced software transparency and cryptographic agility.
The Bottom Line of Strategy
In laying the groundwork for post-quantum cryptography, the US has made great strides. Initial algorithms have been standardized by NIST. A legislative foundation for federal preparedness has been established by Congress. Coordination of critical infrastructure and preparedness are supported by CISA. National Security Systems must meet certain requirements set by the NSA. New deadlines and requirements for implementation have been added by OMB and the White House.
However, deadlines and frameworks by themselves do not ensure preparedness. The recent evaluation by the Government Accountability Office serves as a reminder that agencies still need to deal with real-world issues related to system inventories, testing, resources and execution. Organizations that rely on complicated supply chains, outdated technology, or legacy infrastructure will find the shift especially challenging.
Converting policy into a financially supported, quantifiable migration program is the top priority for federal agencies. Ensuring that national security systems and future acquisitions can support quantum-resistant cryptography is a top priority for the Department of War and the defense industrial base. Finding exposure and adjusting without jeopardizing safety or service continuity are top priorities for operators of critical infrastructure. Congress prioritizes consistent oversight, sufficient funding and a well-defined legislative framework that facilitates execution.
In the fields of computing, science, medicine, materials and national security, the quantum era will bring incredible opportunities. In order to be ready for it, it is also necessary to face the possibility that some of the most reliable cybersecurity measures in use today will eventually fall short.
The precise date of Q-Day is not necessary for the United States to act. It must be aware of the locations of vulnerable cryptography, the systems that are most important, the migration strategy and the timeliness of the changeover.
In the field of cybersecurity, readiness frequently makes the difference between handling a technological disruption and being completely overtaken by it. This also applies to post-quantum cryptography. There is more to the countdown than just the arrival of a potent quantum computer. The information, infrastructure and national interests that rely on cryptography must already be protected in the United States. Now is the time to get ready!
