# The Federal Push Toward Post-Quantum Cryptography: What Agencies Need to Know
Federal agencies across the government are racing against a tightening deadline to prepare their digital infrastructure for the advent of quantum computing, which threatens to render many of today’s encryption methods obsolete. With a series of ambitious milestones set by the White House, the transition to post-quantum cryptographic (PQC) standards represents one of the most complex and consequential IT modernization efforts the federal government has ever undertaken.
## Why This Migration Matters
Quantum computers, once fully realized, are expected to be capable of breaking the public-key cryptographic algorithms that currently secure virtually all federal communications, digital identities, and classified data. Unlike earlier technology migrations—such as the transition to IPv6 or cloud adoption—the move to post-quantum cryptography carries uniquely high stakes because it involves re-engineering the foundational security layers upon which government operations depend.
The timeline is aggressive. Agencies are tasked with making all high-value assets and systems quantum-resistant by 2030, completing digital signature migrations for those same assets by the end of 2031, and finishing the full migration of all remaining systems by 2035.
## The Inventory Challenge
Before any migration can begin, agencies must first understand exactly what they have. Federal officials have emphasized that the current inventory process is inconsistent, overly bureaucratic, and often treated as a compliance checkbox rather than a genuine discovery exercise. Many agencies are still filling out spreadsheets and submitting them into tracking systems without achieving true visibility into where their cryptographic assets reside.
Patrick Manley, who leads quantum security efforts at the Cybersecurity and Infrastructure Security Agency (CISA), has stressed the importance of moving beyond surface-level inventories. Without a comprehensive picture of an organization’s cryptographic landscape, it becomes impossible to make informed risk decisions or to prioritize which systems should be migrated first.
## A Phased Approach
The Office of Management and Budget (OMB) has laid out a phased roadmap to guide agencies through the transition. The first phase, spanning 2026 through 2027, focuses on continuing to catalog cryptographic systems, developing a clear migration strategy, and building awareness and training programs to prepare personnel for the changes ahead. This phase is designed to lay the groundwork for a structured, risk-based migration approach.
During the second phase, from 2027 to 2028, agencies are expected to launch pilot programs, begin migrating prioritized systems, and refine their overall migration strategies based on lessons learned from those early efforts.
## Identity and Authentication: The Critical Bottleneck
One of the most significant hurdles in the PQC migration is the challenge of updating federal identity systems. Personal Identity Verification (PIV) cards and Common Access Cards (CACs)—the standard identification tools used by millions of federal employees and contractors—currently rely on traditional cryptographic algorithms that will eventually be vulnerable to quantum attacks.
If the public key infrastructure (PKI) underlying these identity systems cannot support post-quantum algorithms, every other migration goal becomes irrelevant. Officials have noted that in practical terms, all systems and products within the Department of Defense must be post-quantum ready by the end of 2029 to allow sufficient time for a full rollout across the department before the 2030 high-value asset deadline.
The National Institute of Standards and Technology (NIST) and the General Services Administration (GSA) are collaborating to address this challenge. NIST is updating several of its Special Publications to incorporate PQC standards for smart cards, while GSA is leading identity management efforts through the Federal Identity, Cybersecurity and Access Management (FICAM) program. These initiatives are focused on developing deployable, standards-aligned certification authority services and operational pilots that can scale across agencies while maintaining compatibility with existing federal PKI trust frameworks.
## Budget and Leadership Gaps
Federal leaders have raised concerns that PQC migration efforts are being hampered by budget constraints and leadership turnover. Many agencies lack dedicated PQC migration leads, and those positions that do exist are not always backed by adequate funding. Without properly connecting cost estimates to actual budget allocations, even the best-laid migration plans risk stalling before they get off the ground.
The urgency is amplified by the pace at which the timeline is moving forward. As fiscal year 2027 budget decisions are finalized and agencies begin planning for fiscal year 2028 requests, PQC funding has been identified as a critical priority that Congress and federal leadership must not overlook.
## Different Missions, Different Urgencies
Adding complexity to the effort is the fact that no two agencies face identical challenges. The Department of Defense, for example, must balance the varying urgency levels of different mission systems, each of which serves a distinct operational purpose. A system failure in one area could have dramatically different consequences than a failure in another, making it difficult to apply a one-size-fits-all migration sequence.
This challenge extends beyond government agencies to include vendor organizations and private-sector partners that support federal operations. Even entities in the financial sector, for instance, must evaluate which of their systems are truly critical and which could be temporarily deprioritized in the event of a cryptographic failure.
## FAQ
**What is post-quantum cryptography?**
Post-quantum cryptography refers to encryption algorithms designed to be resistant to attacks by quantum computers. These algorithms are intended to replace current public-key cryptographic methods that quantum computing could potentially break.
**Why does the federal government need to migrate to PQC?**
The government stores and transmits vast amounts of sensitive data, from national security communications to citizen records. Quantum computers, once they reach sufficient capability, could decrypt this data, exposing it to theft or manipulation. Migrating to PQC ensures that this data remains protected for decades to come.
**What are the key deadlines agencies are working toward?**
All high-value assets and systems must be PQC-ready by 2030. Digital signature migrations for high-value assets must be completed before the end of 2031. The full migration of all remaining systems must be finished by 2035.
**What role does OMB play in this effort?**
OMB has issued guidance prescribing a phased approach for agency PQC migration plans and has set the deadline for agencies to deliver those plans. OMB also works with agencies on budget planning to ensure adequate funding is allocated for the transition.
**What is the FICAM program doing?**
The Federal Identity, Cybersecurity and Access Management (FICAM) program, led by GSA, is working to identify quantum-resistant solutions for federal identity systems, including PIV cards, digital certificates, and trust infrastructure. The program is currently in a phase focused on developing a deployable PQC PKI certification authority service blueprint and running operational pilots.
**Why is identity and authentication such a big challenge?**
Federal identity systems like PIV and CAC cards are deeply embedded in daily operations. If these systems cannot support PQC algorithms, they will fail when the old cryptographic methods are retired, potentially locking millions of federal workers out of critical systems.
**What can agencies do right now to prepare?**
Experts recommend that agencies begin with a thorough and honest inventory of all cryptographic assets, invest in training and awareness programs, secure dedicated budget lines for PQC migration, and start planning pilot programs to test new algorithms in controlled environments.
## Conclusion
The transition to post-quantum cryptography represents a fundamental reshaping of how the federal government protects its data, systems, and identity infrastructure. With aggressive deadlines set by the White House and guidance from OMB and NIST, agencies must act decisively to inventory their cryptographic assets, secure funding, and begin phased migrations well before the 2030 cutoff for high-value systems. The challenges are substantial—spanning inconsistent inventory practices, budget shortfalls, identity infrastructure complexities, and shifting leadership—but the consequences of falling behind are equally significant. As quantum computing capabilities advance, the window for preparation will continue to narrow, making proactive action not just advisable but essential.
Thank you for reading
