GAO's Quantum Warning: Why Federal Agencies Need Support Now

Quantum is now a high priority in federal IT modernization, cybersecurity, procurement and national security. Federal mandates and directives are accelerating the need to strengthen quantum leadership and preparing government systems for post quantum cyber resilience.

Agencies are now required to transition high-value assets and high-impact systems, excluding national security systems, to post-quantum cryptography (PQC) for key establishment by December 2030 and digital signatures by December 2031. For national security systems specifically, vendors and resellers supplying new technology must ensure they are meeting NSA’s CNSA 2.0 cryptographic requirements starting January 2027, unless an exception or waiver applies. Meeting these deadlines will require agencies to identify vulnerable technologies, modernize vulnerable systems and build infrastructure that can support the post-quantum era.

However, a recent Government Accountability Office (GAO) report found that none of the major federal agencies have fully completed key preparations for transitioning vulnerable federal systems to PQC. GAO found significant readiness gaps in cryptographic inventories, funding assessments, planning documentation and workforce readiness. Without visibility into cryptographic functions embedded across systems, networks, databases and cloud environments agencies cannot effectively prioritize vulnerable systems, estimate costs or plan for a successful migration strategy.

For technology companies, these readiness gaps signal opportunities to help agencies support PQC transition and long-term security modernization. Agencies need tools, expertise and implementation support to translate policy mandates into operational
capability in several key areas:

1. Cryptographic discovery and inventory management
2. Identity and PKI modernization
3. Migration planning and systems integration
4. Crypto-agile infrastructure

Cryptographic Discovery and Inventory Management

The GAO report has called attention to the fact discovery and inventory management are going to be the foundation of every PQC transition effort. Agencies need to understand where cryptography is used, which algorithms and technologies are vulnerable and system dependencies on existing cryptographic implementations. According to the GAO, several agency’s inventories lacked information about vulnerable cryptographic methods, software packages, operating systems or hosting arrangements.

For industry, there will likely be opportunities for automated cryptography discovery and inventory (ACDI) tools, enterprise software asset management (SWAM) solutions and support for cryptographic bill of materials (CBOM) initiatives. Vendors and resellers can
also help agencies integrate cryptographic visibility into existing continuous diagnostics and mitigation (CDM) programs. CDM updates should consider updates to the dashboards, data models and reporting metrics to include tracking PQC readiness. Companies that can help agencies build accurate, actionable, reliable inventories and prepare for near-term compliance requirements will have an advantage.

Identity and PKI Modernization

Understanding existing identity and certificate infrastructure will also be critical to support quantum-resistant PKI modernization, cloud and network security and zero trust alignment. Agencies must assess how current certificates, digital signatures, authentication services and cryptographic algorithms are used across users, devices and applications. 

Defense and Intelligence agencies will have a particularly difficult challenge with preparing and updating algorithms on a wide distribution of people and endpoints using Personal Identity Verification (PIV) and Common Access Cards (CACs). 

Agencies will need to plan and execute transitions will maintaining interoperability, security and operational continuity. There will be opportunities for vendors and resellers to assist agencies in preparing and modernizing PKI, secure identity platforms, PIV credentials, certificate management and authentication services.

Migration Planning and Systems Integration

Obstacles to tackling these challenges that GAO called attention to are lack of planning, incomplete funding assessments and lack of vendor cost data as hurdles to successful PQC migration. Agencies struggling with documentation and establishing processes need
support from industry with practical steps for migration planning, architecture assessments, dependency analysis and operational execution to maintain the necessary documentation.

Prioritizing thorough inventories, documentation and migration planning will be necessary to meet deadlines for PQC migration and accommodate future cryptographic changes. This creates opportunities for technology vendors to help deliver cryptographic architecture assessments, dependency mapping, migration roadmaps, cost modeling and implementation support. 

Crypto-Agile Infrastructure

As cryptographic standards and requirements continue to evolve, limiting disruption to systems and infrastructure will be an essential consideration for modernization. Vendors and resellers can help agencies adopt more modular security architectures, flexible
software and hardware platforms and hybrid environments that support crypto-agile infrastructure. There will likely be opportunities for system integration, secure APIs, cryptographic libraries and infrastructure management tools.

What Industry Should Do Now 

• Assess your company’s cryptographic posture including identifying solution dependencies and vulnerable quantum-resistant algorithms, NIST standard alignment, supply chain implications and cryptographic governance practices. 
• Lead with practical implementation on how solutions can discover vulnerable systems, estimate costs and develop and implement migration plans while minimizing operational disruption.
• Shift messaging from experimentation and future quantum threats to risk reduction, operational execution and compliance support.

The GAO's assessment highlights a growing disconnect between federal quantum security requirements and agency preparedness. While policy and standards continue to mature, many still face challenges around visibility, planning and execution.

For technology vendors and resellers, success will come from helping agencies build product and system inventories, governance processes, identity infrastructure and migration roadmaps needed to achieve long-term quantum resilience. As federal deadlines approach, quantum readiness is becoming a becoming an urgent modernization priority and a meaningful growth market for industry partners.

To get more TD SYNNEX Public Sector Market Insight content, please visit our Market Intelligence microsite.
 

About the Author:
Nikki Hamlin is a senior analyst on the TD SYNNEX Public Sector Market Intelligence team covering trends across the federal market. Nikki has more than 8 years of experience in federal procurement research and analysis, providing critical insights to support businesses in making informed decisions across civilian and defense agencies.