Federal agencies have until the end of October to hand the White House their plans for moving to post-quantum cryptography, even as a Cybersecurity and Infrastructure Security Agency (CISA) official warns that many have not yet mapped where their current encryption lives, Federal News Network reported Friday. The timeline, and a Defense Department push to make government ID cards work with the new algorithms, will shape what technology vendors must support and offers a benchmark for private organizations that have not started.

Post-quantum cryptography, often shortened to PQC, refers to new encryption and digital-signature methods designed to withstand attacks from future quantum computers, which could one day break the public-key cryptography that protects most online communication and identity systems today.

What Happened

Agencies must deliver their migration plans to the Office of Management and Budget (OMB) and the Office of the National Cyber Director. According to Federal News Network, guidance OMB issued in June sets out two phases. The first, covering 2026 and 2027, focuses on cataloging the cryptography in use, setting a strategy and training staff. The second, in 2027 and 2028, calls for pilots and early migration of priority systems.

RelatedApathy, AI Impersonation and Quantum Top Five Experts' Cyber Threat Lists in WEF Video

White House targets call for an agency's most important systems, known as high-value assets, to be ready for PQC by 2030 and to use PQC digital signatures before the end of 2031, with all other systems migrated by 2035.

Patrick Manley, who leads quantum security work at CISA, told an AFCEA DC lunch that civilian agencies are still in the discovery and inventory stage, the outlet reported. He described the annual cryptographic inventory process as clumsy and inconsistent, more a compliance exercise than real visibility. He cited departures of experienced staff, a lack of consistent migration leads across agencies, budget cuts, transitions that go unfunded and cost estimates that are not tied to budgets. He said PQC funding must be a priority as Congress finishes fiscal 2027 spending and agencies prepare fiscal 2028 requests, and that CISA hopes to identify pilot projects by the end of the current fiscal year.

Why It Matters

Identity credentials are among the hardest pieces to replace. Agencies issue personal identity verification (PIV) smart cards, and the Defense Department uses Common Access Cards (CAC). Both depend on public key infrastructure (PKI), the system that issues digital certificates and vouches for them.

Britta Hale, the Defense Department's director of PQC, said both card types must support the new algorithms and that PKI must be ready by 2030, with the department aiming for its systems and products to be ready by the end of 2029. If the certificate infrastructure is not ready, she warned, "when you plug in those cards, nothing works, and people lose access."

For boards and executives, the federal schedule matters beyond government. Card makers, identity vendors and contractors will need products that meet these requirements, and Manley's critique applies to any organization whose cryptographic inventory is a spreadsheet filled in once a year. Without knowing where encryption is used, an organization cannot rank which systems to move first or estimate the cost.

The Standards Work

The National Institute of Standards and Technology (NIST) released working drafts on June 12 updating its PIV card specifications, SP 800-73 Parts 1 and 2 and SP 800-78, so cards can use ML-DSA, a quantum-resistant signature algorithm, and ML-KEM, a quantum-resistant method for exchanging encryption keys. The drafts propose a "dual-stack" design that keeps existing keys on the card while adding new quantum-resistant keys and certificates, allowing a gradual changeover. NIST describes them as preliminary working materials rather than formal public drafts and is taking feedback through a mailing list and GitHub.

Meanwhile, the General Services Administration's Federal Identity, Cybersecurity and Access Management (FICAM) program is in a second phase, developing a blueprint for a PQC certificate authority service and an operational pilot that works with existing PIV processes, according to Federal News Network.

What to Watch

The first test is whether agencies file their plans by the end-of-October deadline and how much detail OMB requires. Next are whether Congress funds the transition in fiscal 2027 appropriations, which pilots CISA names before the fiscal year ends, and when NIST turns its PIV working drafts into formal drafts open for public comment.