Post Quantum Cryptography: Federal Mandates, Market Drivers and What IT Companies Should Do Now

The Quantum Threat and The Need for Change

Quantum computing is introducing a newer cybersecurity risk with the potential to undermine encryption methods that are currently considered secure, reducing their effectiveness against future threats. For federal agencies and national security systems, this is critical as they rely on cryptography to protect data, identities, software and communications. The risk is not theoretical for planning purposes. The real concern is attackers’ practice of “harvest now, decrypt later”, when encrypted data is copied and kept until quantum computers can decrypt it later. The challenge for the federal government, as well as IT companies, is no longer about whether changes are needed, but how quickly they can be addressed without disrupting operations. This is particularly significant to the national security systems, as a security failure is not an option.

PQC Mandates

Currently, federal PQC mandates (EO 14028, EO 14144, EO 14306, OMB M-23-02 and NSM-10) center on inventorying quantum-vulnerable cryptography, adopting NIST’s finalized PQC standards and planning the migration of a government-wide timeline. For national security systems, NSA’s CNSA 2.0 (Commercial National Security Suite 2.0) provides the clearest compliance criterion, setting requirements for agencies and contractors to become crypto-agile and PQC-ready. Released in September of 2022, it is designed to transition the U.S. government and defense systems to post-quantum cryptography. Its core requirement is to identify where RSA, ECC and other vulnerable public-key algorithms are used, then prioritize migration to post-quantum alternatives identified by NIST. By Jan 1, 2027, all agencies must use the new post-quantum algorithms identified in CNSA 2.0. In November 2025, the DoW issued guidance to inventory cryptographic systems, prohibiting unapproved PQC tools, and requiring approval for any quantum-resistant technologies. CNSA 2.0 is considered one of the most significant cybersecurity modernization efforts in decades.

Mandatory Compliance

The NSA has laid out a firm transition schedule for agencies and contractors:

• September 7, 2022: Release of CNSA 2.0 mandating government-wide PQC migration by 2025
• January 1, 2027: Any newly acquired products or services supporting National Security Systems must be capable of using CNSA 2.0 algorithms.
• December 31, 2030: Older equipment and services that are unable to operate with CNSA 2.0 need to be retired.
• January 2, 2030: Transport Layer Security (TLS) 1.3 or successor must be supported across NSS and non-NSS systems.
• December 31, 2031: CNSA 2.0 becomes the default requirement for all cryptographic implementations in NSS, except where explicit waivers apply.
• January 1, 2035: National Security Systems are expected to complete the shift to quantum-resistant cryptography

Funding, Incentives, and Procurement Channels

Federal spending on PQC migration is estimated at $7.1 billion from 2025 to 2035; funds are unlikely to come from a single PQC line item and will likely appear through modernization budgets, cyber and quantum programs, and standard contract vehicles. Last month, the Department of Commerce signed Letters of Intent with nine companies under the CHIPS and Science Act, totaling $2 Billion in federal incentives to advance scalable quantum technologies. A bill was also introduced in January 2026 that would extend the National Quantum Initiative timeline through 2034. If passed, $85 million would annually fund NIST’s QIST research and consortium efforts and $25 million for NASA’s QIST research, from FY26 through FY34.

Importantly, the National Defense Authorization Act (NDAA) FY27, still working its way through Congress, includes provisions for quantum and PQC activities that would be channeled through the NSA’s cybersecurity modernization, DOW CIO zero-trust related RDT&E, DARPA RDT&E and military service branches’ networks and systems modernization related activities.

GSA has also directed agencies to contract vehicles such as the Multiple Award Schedule - IT Category, Alliant 2 and 8(a) STARS III. Agencies can also use GSA’s Market Research as a Service (MRAS) to leverage vendor capabilities and industry support.

Implications for IT Companies

With the January 1, 2027 deadline just seven months away, CNSA 2.0 highlights the urgency for IT companies to take the lead in PQC modernization, supporting federal agencies' security compliance. IT companies selling to the federal market should view PQC as an immediate priority rather than a future consideration. Essential areas of requirements include:

• Cryptographic inventory
• Public Key Infrastructure modernization
• Crypto-agile infrastructure
• AI-assisted migration planning
• Translating policy into execution
• Hardware replacement planning

Position for Competitive Advantage

Vendors and partners can differentiate by being execution-focused and mission-emphasized. Agencies will look for IT companies that help them navigate complexity in transition, particularly connect policy, risk signals to migration implementation (requirements, standards and timeline). A strong sales strategy includes leading with practical transition steps, transparency and offerings that support crypto-agility over time.

To get more TD SYNNEX Public Sector Market Insight content, please visit our Market Intelligence microsite.
 

About the Author:
Toan Le is a Senior Market Insights Analyst on the DLT Market Insights team covering DOD and IC domain-centric trends across the Public Sector.