November 4, 2026
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline
BLOG
5 min.
TL;DR – GAO’s latest report shows why waiting for the compliance deadline could mean arriving years too late.
In Part 1, Post-Quantum Cryptography: Migrate by Risk, Not by Checkbox, I argued that post-quantum cryptography (PQC) cannot be treated as a compliance exercise. The Government Accountability Office’s (GAO) October 2026 report, GAO-27-108740, shows why: none of the 24 Chief Financial Officers (CFO) Act agencies fully addressed cryptographic inventory, funding assessment or testing and not one had tested PQC.
The audit ran February 2024 through September 2025, before Executive Order (EO) 14412 and Office of Management and Budget (OMB) Memorandum M-26-15 accelerated the migration – so this is the baseline the Federal Government carried into the accelerated period. In GAO’s words, the gaps “increase the risk that their transitions to quantum-resistant cryptography will occur too late.” That makes the real deadline much closer than 2030.
GAO Put Numbers Behind the Problem
In Part 1, I wrote that when an organization cannot see its cryptography, the inventory gap is not a footnote – it is the program. GAO’s report, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, puts numbers behind that point: only one of 24 agencies fully addressed the prioritized-inventory activities, 18 reported lacking cryptography expertise with no plan to close the gap, 23 had no documented inventory maintenance process, none fully addressed funding and none had tested PQC in their environment.
These are not simply compliance findings. They are indicators of execution risk. If I cannot see quantum-vulnerable cryptography, I cannot prioritize it; if I cannot prioritize it, I cannot budget it; if I have not tested the replacement, I do not know what will break.
What Did Waiting Look Like?
The part of the report I keep rereading is not the scorecard. It is the explanations agencies gave, in good faith, for why each practice could wait a little longer: too early for automated tools or waiting on the Cybersecurity and Infrastructure Security Agency (CISA) to name them (CISA says it never asked anyone to wait); too early to test (open-source PQC tooling has existed for years); too early to document funding without vendor pricing – which is how the Government arrived at an approximate $7.1 billion estimate OMB itself calls a rough order of magnitude.
None of these reasons is unreasonable on its own. Together they form a dependency chain: no automation, so no inventory; no inventory, so no funding estimate; no testing, so no idea what breaks. Every year spent waiting for a better tool or a vendor quote is a year subtracted from the migration clock – the one clock agencies actually control.
2030 Is a Compliance Line, Not a Risk Line
One concern I continue to have is that the December 31, 2030 deadline creates a false sense of time.
Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, requires Federal High Value Assets (HVAs) and high-impact systems to use PQC for key establishment by December 31, 2030 and for digital signatures by December 31, 2031. OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, implements that direction for civilian agencies in five phases, from discovery in 2026-2027 through full migration by 2035 – and frames 2030 as mitigating as much quantum risk as feasible by that date, not starting then. EO 14306 adds Transport Layer Security (TLS) 1.3 by January 2, 2030.
The nearest milestones have already arrived: a named PQC migration lead within 30 days of EO 14412 and a PQC Migration Plan to OMB and the Office of the National Cyber Director (ONCD) within 120 days of the June 24, 2026 memorandum.
But Even October 22 Is Not the Real Security Deadline
Compliance gives us dates. Risk gives us a different clock. The question is not when will a cryptographically relevant quantum computer (CRQC) arrive, but how long does our information need to remain protected?
An adversary does not need a CRQC today to create a future compromise. They only need to collect the encrypted data today. That is the harvest-now, decrypt-later problem; EO 14412 names it in its first paragraph and GAO makes it concrete, citing collection techniques already in use, from Border Gateway Protocol (BGP) rerouting to supply-chain compromise. Two further GAO points belong in every briefing:
- Detection will not save you. Using a CRQC to derive a private key from a public key “is not an event that can be detected by the victim organization’s cybersecurity tools.”
- The exposure is in transit and in key establishment. Data at rest is generally protected by symmetric cryptography, which is not currently projected to be vulnerable. The harvestable risk sits in public-key exchanges – exactly why key establishment carries the 2030 gate.
Migrating a system in 2030 does not recall data an adversary collected in 2026. That changes the deadline.
The Deadline Is Driven by the Data
The concept is captured well by what is often called Mosca’s inequality, from Michele Mosca’s 2015 paper:
The migration itself takes years and the estimate keeps moving: the Global Risk Institute’s Quantum Threat Timeline Report 2025 puts the probability of a CRQC at 28-49 percent within 10 years and 51-70 percent within 15, up from its prior survey.
We do not need the exact arrival date to manage the risk. We do not wait to learn the date of the next ransomware campaign before building resilience or which credential an adversary will steal before strengthening identity controls. PQC should be treated the same way.
Long-Lived Data Changes the Priority
Two systems can use the same vulnerable algorithm and carry completely different quantum risk. Data that loses its sensitivity next year is a different priority than personnel, health, investigative, intellectual-property or national-security information that must stay confidential for 10, 20 or 30 years. M-26-15 already points this way, directing agencies to “prioritize identifying and re-encrypting long-lived sensitive data.” GAO adds a nuance: a CRQC recovers keys slowly – hours to more than 200 hours each – so the adversary’s prize is a long-lived, heavily reused key. Key lifetimes belong in the risk score alongside the algorithm.
A checkbox tells me the control exists. Risk tells me whether it will still work against the threat it is meant to stop.
Discovery Cannot Stay a Spreadsheet Exercise
One department told GAO its unclassified environment supports more than four million endpoints – and it had no plan yet for inventorying the cryptography inside them. M-26-15 calls manual approaches “often insufficient” and directs automated discovery into a central Cryptographic Bill of Materials (CBOM); EO 14412 gives CISA and the National Institute of Standards and Technology (NIST) 270 days to publish minimum CBOM elements. Build toward that format now; do not wait for it.
Testing May Be the Bigger Warning
One GAO finding concerns me even more than inventory: none of the 24 agencies had tested PQC in their environments. ONCD called testing encouraged, not required; GAO’s view is that OMB never called it voluntary and that open-source tooling was enough to begin.
Whatever the policy reading, the engineering reality is the same. PQC migration is not swapping one algorithm for another: larger keys, new handshakes and new libraries ripple through every dependent system, including the legacy ones. Policy now bakes testing into the schedule – M-26-15’s Phase 2 pilots in 2027-2028 and NIST’s own pilot due December 31, 2027 – and NIST has published the standards and the transition path in NIST IR 8547.
"Waiting until the deadline to discover that a critical mission system cannot support the new cryptography is not migration planning. It is crisis management."
The Point I Keep Coming Back To
PQC may be the best test of that idea in years. There are two ways to fail. Move too slowly and information protected today may eventually become readable by an adversary. Move without discovery, engineering and testing and we disrupt the mission ourselves. That is why the answer cannot be “move everything immediately.” And it cannot be “we have until 2030.”
Five Steps to Start PQC Migration Now
If I were sitting with an agency leadership team today, these are the five actions I would put on the board:
- Identify the data that must remain sensitive into the 2030s and beyond. That is your highest harvest-now, decrypt-later exposure.
- Establish continuous cryptographic discovery. Build toward a living CBOM rather than periodic spreadsheets. Do not wait for a government-furnished tool.
- Prioritize by mission risk, data longevity and migration complexity. An HVA designation matters, but it is not the only thing that matters.
- Begin representative PQC testing now. Phase 2 pilots start in 2027; the test plan has to exist first.
- Connect the migration plan to funding, acquisition and modernization. PQC is not solely a CISO program; M-26-15 names the Chief Financial Officer, program offices and system owners as accountable.
The Federal Government now has policy direction, standards and hard milestones. What agencies cannot afford is to read those milestones as permission to wait.
For long-lived sensitive data in transit today, the exposure window may already be open. By 2030, agencies should be measuring what they migrated – not discovering where their vulnerable cryptography lives.
Ready to Start Your PQC Migration?
GuidePoint Security works with Federal agencies and mission partners to assess cryptographic exposure, prioritize systems by mission risk and data longevity and identify discovery, inventory and testing capabilities that fit the environment – without anchoring the strategy to a single vendor. If you cannot yet answer what cryptography you have, what data it protects, how long it must stay protected and what will break when you migrate it, that is where the work begins.
Read Part 1 for the five-phase roadmap, then reach out for a cryptographic exposure assessment.
FAQs
What is harvest now, decrypt later?
Adversaries collect encrypted data today and store it. When a quantum computer arrives, they decrypt it. Data with long confidentiality needs is most at risk.
What is Mosca's inequality?
Mosca’s inequality says data is at risk when its confidentiality lifetime plus migration time exceeds the time until a quantum computer arrives.
How do I start a PQC migration plan?
Begin with a cryptographic inventory using automated discovery tools. Prioritize systems by data longevity and mission risk, then run pilot tests before full migration.
What happens if agencies miss the 2030 PQC deadline?
Data encrypted with vulnerable algorithms stays exposed to harvest-now, decrypt-later attacks. The longer migration takes, the wider the window an adversary has to collect and eventually decrypt sensitive records.
What is a Cryptographic Bill of Materials (CBOM)?
A CBOM is a living inventory of all cryptographic assets across an organization. OMB M-26-15 directs agencies to build one using automated discovery rather than manual spreadsheets.
Federal Chief Information Security Officer (CISO)
GuidePoint Security
Timothy Amerson is currently the Federal Chief Information Security Officer (CISO) at GuidePoint Security. While also serving as the the President of the Board of Directors for The KEY (Keep Elevating Yourself) Community Non-Profit. He brings more than 30+ years of distinguished service in federal cybersecurity leadership. Most recently, he served as the CISO and Associate Commissioner at the Social Security Administration (SSA), where he was recognized as a 2023, 2024 and 2025 Top 100 Information Security Professional; 2024 FedScoop Top 50 Federal Leader Nominee; 2025 CyberScoop Government Leaders, FedScoop Top 50 Federal Leader Nominee and Finalist US Forces in Business Lifetime Achievement Award.
Search
Categories
Recent Posts
October 27, 2026