# Federal Agencies Plan Post-Quantum Cryptography Migration

A Government Accountability Office review found that none of the 24 reviewed CFO Act agencies has fully prepared to transition vulnerable systems to post-quantum cryptography. Gaps include prioritized cryptographic inventories, funding estimates, technical expertise, and testing plans; GAO identified 89 recommendations, while the estimated government-wide cost to migrate priority systems or replace systems that cannot support new cryptography is about $7.1 billion. Agencies are required to prepare priority-based migration plans by the end of October. Milestones call for new commercial national security systems to support quantum-resistant algorithms in 2027, legacy-system phaseout by 2030, and broader Department of War adoption by 2031. No specific solicitation or award is identified in the signals.

- Contractors with cryptography discovery and inventory tools, migration planning, cost estimation, modernization, and PQC testing capabilities may be positioned to support agencies addressing the documented gaps.
- The end-of-October planning milestone creates near-term demand for agency assessments and prioritized migration planning; companies can align relevant service offerings and technical evidence to those needs.
- The estimated $7.1 billion is a government-wide transition estimate, not an awarded contract or confirmed procurement budget. The 2027, 2030, and 2031 milestones point to a longer pipeline for system upgrades, testing, and legacy replacement.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Digital Infrastructure, Regulatory Compliance
**Published:** October 07, 2026

### Government Entities
- Government Accountability Office (GAO)
- Office of Management and Budget (OMB)
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Security Agency (NSA)
- Department of War

### Sources
- [GAO: Federal Agencies Not Ready for Quantum Threat](https://www.executivegov.com/articles/gao-federal-agencies-quantum-cryptography-readiness) - ExecutiveGov
- [GAO: Federal Agencies Haven’t Fully Prepared for PQC Transition – MeriTalk](https://www.meritalk.com/articles/gao-federal-agencies-havent-fully-prepared-for-pqc-transition) - MeriTalk
- [Work needed to fortify systems against quantum threats, watchdog says | FedScoop](https://fedscoop.com/agencies-behind-fortifying-systems-against-quantum-threats-watchdog-says) - FedScoop