Why It Matters
None of the 24 Chief Financial Officer (CFO) Act agencies has fully addressed the three preparatory practices needed to transition federal systems to post-quantum cryptography, according to Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, a U.S. Government Accountability Office (GAO) report reissued with revisions on Oct. 14.
The gaps, rooted in insufficient cryptography expertise, missing inventory processes, and absent testing plans, leave sensitive federal data exposed to a future cryptographically relevant quantum computer (CRQC) that most industry experts believe could arrive as soon as the 2030s.
The Big Picture
Federal agencies rely on cryptography, the mathematical processes that lock, unlock, and authenticate information, to protect sensitive data and systems. Today's quantum computers cannot yet break that cryptography, but a CRQC of sufficient size and sophistication could compromise systems that authenticate users, allowing a malicious actor to access sensitive information or decrypt data collected and stored before such a machine exists. Development estimates for a cryptographically relevant quantum computer vary widely because of uncertainty in qubit growth rates and in how many qubits will be needed.
A malicious actor could acquire and store data before a cryptographically relevant quantum computer (CRQC) is developed, then decrypt it once such a computer exists, GAO reports.
To evaluate readiness, GAO used a framework derived from Office of Management and Budget (OMB) guidance and assessed all 24 CFO Act agencies against three preparatory practices: developing cryptography inventories, identifying transition funding, and planning for post-quantum cryptography testing.
The sensitive version of the report was issued in September 2025 and addressed to the Ranking Member of the Joint Economic Committee, Sen. Maggie Hassan (D-NH).
GAO then coordinated with executive branch agencies from September 2025 to confirm that sensitive information had been appropriately removed before the public version was released, a process that stretched more than a year.
GAO found that none of the 24 agencies it reviewed fully addressed three preparatory practices for migrating to post-quantum cryptography, a shortfall due in part to a lack of cryptography expertise, of processes for developing cryptography inventories and identifying transition funding, and of plans to guide post-quantum cryptography testing.
Without a complete inventory of vulnerable cryptographic systems, agencies cannot prioritize which systems to migrate first or estimate the full cost of the transition, compounding the risk that the most sensitive systems go unprotected longest.
The Bottom Line
GAO made 89 recommendations to 23 of the 24 CFO Act agencies; one agency received no recommendations. The sensitive report's 89 recommendations to 23 agencies include establishing and implementing processes to develop inventories of vulnerable cryptography and to identify funding for post-quantum cryptography. Twelve agencies agreed with their recommendations, two partially agreed, seven neither agreed nor disagreed, and one agency disagreed with three of its four recommendations. GAO said all 89 recommendations are warranted and made no additional recommendations in the public version of the report.
The mixed concurrence picture, with eight agencies either partially agreeing, disagreeing, or declining to take a position, means a substantial share of the recommended actions carry no agency commitment to act. Because the recommendations remain open and agency concurrence is uneven, the path to a fully secured federal cryptographic infrastructure depends on whether agencies move to implement changes before a CRQC becomes a practical threat, a timeline the report does not fix but places potentially within a decade.
Advocates, congressional staff, and agency officials tracking this issue can monitor related legislative and oversight activity at Legis1.
A linked invitation to track related legislative activity on Legis1
Access the Legis1 platform for comprehensive political news, data, and insights.
Spot something wrong? Report an issue with this article
