Federal Quantum Readiness Falls Short as Agencies Face Cryptography Skills Gaps

Federal Quantum Readiness Falls Short as Agencies Face Cryptography Skills Gaps

The Government Accountability Office’s (GAO) 2026 public report on post‑quantum cryptography (PQC) preparedness reveals a stark reality: none of the 24 major federal agencies reviewed have fully met the three core preparation practices needed to protect government systems against future quantum‑computing attacks. The gaps span incomplete inventories of vulnerable systems, inadequate migration‑cost assessments, and a lack of real‑world testing of PQC solutions.

1. Incomplete Inventories: The First Line of Defense

A reliable inventory of systems that rely on cryptographic methods vulnerable to quantum attacks is the foundation of any quantum‑ready strategy. The GAO found that only one agency had a fully comprehensive inventory. Twenty‑two agencies had inventories that missed key systems or contained inaccurate technical details—such as mislabeling symmetric cryptography as vulnerable. Without a clear picture of what needs protection, agencies cannot prioritize resources or identify high‑risk assets.

What agencies should do:

• Develop a priority list that includes mission‑critical systems, those whose compromise could cause severe harm, and data expected to remain sensitive beyond 2035.
• Document a repeatable process for collecting, validating, and updating inventory data, leveraging automated tools where possible.
• Conduct a gap analysis to surface missing or incorrectly classified systems.

2. Cost Estimation Shortfalls

Even when agencies draft funding assessments, the GAO notes that none fully addressed the activity of identifying funding for all vulnerable priority systems. Twenty‑one agencies acknowledged that their estimates were not fully accurate, citing a lack of vendor pricing, reliable tools, and trained personnel. The Office of Management and Budget (OMB) currently uses these rough estimates to inform Congress, but the lack of documented processes risks unexpected costs as PQC products mature.

What agencies should do:

• Establish a formal funding assessment process that ties inventory data to budgetary projections.
• Engage with vendors early to obtain realistic pricing and product roadmaps.
• Update cost models annually as new PQC solutions become available.

3. Testing Deficiencies

Testing PQC implementations in real‑world environments is essential to uncover compatibility issues and to validate that new cryptographic algorithms meet security requirements. Only one agency had conducted market research to identify potential vendor implementations, and none had performed in‑environment testing. Sixteen agencies cited that it was too early to test because vendors were still integrating PQC algorithms into their products.

What agencies should do:

• Create a testing roadmap that identifies suitable environments and vendor candidates.
• Leverage open‑source tools for early research while planning for eventual deployment‑ready testing.
• Allocate resources—both budget and skilled personnel—to conduct these tests before full migration.

4. Workforce and Process Gaps

Eighteen agencies reported a lack of cryptography expertise, and only one documented an inventory maintenance process. Automation was used by only five agencies, and most lacked documented procedures for consistent data collection. The GAO’s 89 recommendations emphasize the need for training, clear responsibilities, and repeatable processes.

What agencies should do:

• Invest in cryptography training for IT staff and procurement teams.
• Assign clear ownership for inventory upkeep and cost estimation.
• Adopt automated tools to supplement human effort, ensuring they are integrated into documented workflows.

Practical Takeaway

The GAO’s findings are a wake‑up call: quantum readiness is not a future‑only concern but a present‑day imperative. Agencies must act now to build accurate inventories, establish robust cost‑assessment processes, and begin testing PQC solutions. By addressing these gaps, federal agencies can protect sensitive data, maintain trust in digital credentials, and avoid the “harvest‑now, decrypt‑later” threat that looms as quantum technology advances.

---

TL;DR: The GAO report shows that no major federal agency has fully prepared for quantum threats, with critical gaps in system inventories, cost estimates, and PQC testing—action is needed now to secure government data.