For federal CISOs, the post-quantum cryptography challenge is quickly becoming less about future technology and more about present-day accountability.
A new report from the U.S. Government Accountability Office, GAO-27-108740, “Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat,” highlights major gaps in federal agency preparedness for the transition to post-quantum cryptography.
The findings matter for CISOs because they point to a broader operational reality: agencies cannot build a credible PQC migration plan, defend a budget request, or demonstrate compliance without first knowing where vulnerable cryptography exists.
GAO reviewed 24 Chief Financial Officers Act agencies and found that none had fully addressed the core practices needed to prepare for PQC migration.
The most significant gaps centered on three areas:
- Cryptographic inventory
- Migration funding and planning
- PQC testing
For federal security leaders, these are not isolated technical issues. They are governance, risk, compliance, procurement, and mission-readiness issues.
Why Federal PQC Readiness Starts With Cryptographic Inventory
The First CISO Challenge: Knowing What You Have
GAO found that only one of 24 agencies fully addressed the activities needed to develop a prioritized cryptographic inventory. That is a major concern because nearly every subsequent PQC decision depends on inventory accuracy.
Before a CISO can prioritize migration, the agency needs to understand:
- Where cryptography is being used
- Which algorithms and libraries are deployed
- Which applications and systems depend on vulnerable cryptography
- Which assets support critical missions
- Which systems contain long-lived sensitive information
- Which technologies can be upgraded and which may require replacement
- Which third-party products introduce cryptographic dependencies
Achieving this visibility manually is difficult.
Federal environments are complex by design. They often include legacy systems, custom applications, cloud services, commercial software, operational technology, distributed networks, contractors, and shared infrastructure.
Cryptography can exist across all of them.
The CISO may ultimately be responsible for the agency’s cryptographic risk posture without having a reliable way to see the full cryptographic environment.
That is the gap agencies need to close.
Why Federal Agencies Need Continuous Cryptographic Visibility
Static Inventories Are Not Enough
GAO’s findings also raise an important issue around how agencies maintain cryptographic inventories. According to the report, 23 of the 24 agencies lacked a documented process for maintaining their cryptographic inventories.
A one-time inventory may satisfy an immediate reporting request, but it does not create long-term operational visibility. Federal IT environments change continuously. Software is patched. Applications are modernized. New cloud services are introduced. Certificates change. Libraries are updated. New systems are acquired. Contractors deploy new technology. Cryptographic dependencies shift over time.
For CISOs, the objective should not be to produce a static spreadsheet. Instead, they should establish a continuous view of cryptographic posture.
GAO also noted that CISA, NIST, and NSA have recommended automated tools for identifying vulnerable cryptography across applications, endpoints, servers, network protocols, and software libraries. Yet only five of the 24 agencies GAO reviewed reported using automated tools. That means many agencies are still relying heavily on manual processes to understand an environment that is constantly changing.
How Cryptographic Inventory Supports PQC Budgeting and Planning
The CISO Cannot Fund What the Agency Cannot Scope
The inventory problem directly affects another major responsibility for federal security leaders: budgeting.
GAO found that none of the 24 agencies fully addressed the requirement to identify the funding needed to migrate vulnerable systems to PQC.
Twenty-one agencies developed some form of funding assessment, but GAO found that only one was based on a complete inventory of priority systems. That creates an obvious planning challenge.
If an agency does not know which systems are affected, how can it accurately estimate:
- Migration costs
- Staffing requirements
- Vendor expenses
- Testing resources
- Legacy system replacement costs
- Application modernization requirements
- Multi-year budget needs
This is particularly important given the scale of the federal transition.
GAO cites an OMB estimate of approximately $7.1 billion in governmentwide costs associated with migrating priority systems to PQC or replacing legacy systems that cannot support modern cryptography.
For CISOs working with CIOs, CFOs, acquisition teams, and agency leadership, cryptographic visibility therefore becomes part of the business case. A complete inventory is not simply a technical artifact. It underpins a defensible migration roadmap and budget request.
Why Federal Agencies Should Begin PQC Testing Now
Federal CISOs Should Not Wait to Begin PQC Testing
GAO also found very limited progress in testing post-quantum technologies. Only one agency had conducted market research to identify potential vendor implementations for testing, and even that agency had not tested PQC in its own environment. The remaining 23 agencies had not addressed the testing activities GAO reviewed.
Some agencies indicated that testing was premature because vendors were still integrating PQC capabilities. But waiting creates another kind of risk. Testing helps agencies determine whether their current infrastructure can support the transition.
Early testing can reveal:
- Application compatibility issues
- Performance impacts
- Certificate and key management challenges
- Network and protocol dependencies
- Vendor limitations
- Legacy systems that cannot support new algorithms
- Operational constraints that could delay migration
For CISOs, these findings are especially valuable because they expose migration obstacles while there is still time to address them.
The worst time to discover that a mission-critical system cannot support PQC is when a compliance deadline is approaching.
How Harvest Now, Decrypt Later Changes Federal PQC Risk
The urgency around PQC is also driven by the threat commonly known as harvest now, decrypt later.
Adversaries do not need a cryptographically relevant quantum computer today to create long-term risk. They can collect encrypted information now and retain it until future computing capabilities make decryption possible. That creates an immediate concern for federal agencies protecting information with long confidentiality requirements.
For CISOs, the most important question may not be “When will a quantum computer be powerful enough to break today’s encryption?”, the more relevant question is “How long does this information need to remain secure?”.
If sensitive information must remain protected for 10, 20, or 30 years, the exposure window already exists. That makes PQC preparation a current risk-management responsibility, not a future technology initiative.
Federal PQC Mandates Require Cryptographic Visibility
Federal agencies are already operating under a growing set of PQC and cryptographic modernization directives. OMB, NIST, CISA, NSA, and other federal organizations have steadily increased expectations around cryptographic inventory, PQC migration planning, crypto-agility, and modernization.
For CISOs, the challenge is turning those mandates into an executable program. That requires moving beyond policy documents and questionnaires.
Agencies need to be able to demonstrate:
- What cryptography exists
- Where vulnerable cryptography is located
- Which systems represent the greatest risk
- What remediation is required
- What progress has been made
- Whether new vulnerabilities or dependencies have appeared
Without that evidence, it becomes difficult to demonstrate meaningful progress to agency leadership, auditors, OMB, or other oversight organizations.
From Cryptographic Inventory to Cryptographic Posture Management
This is where Cryptographic Posture Management becomes increasingly important. While a static cryptographic inventory provides a point-in-time snapshot, Cryptographic Posture Management gives organizations continuous visibility into their cryptographic environment—helping security teams understand what cryptography exists, where vulnerabilities and risks are located, what has changed, which assets matter most, and which actions to prioritize.
SafeLogic CPM is designed to help federal organizations continuously discover and assess cryptographic technologies across applications, libraries, certificates, TLS connections, systems, and runtime environments. Using agentless discovery, APIs, integrations, and targeted data collection, agencies can build a more complete understanding of their cryptographic environment. Technical findings can then be correlated with application and mission context so teams can prioritize remediation based on actual risk.
For federal CISOs, this can help answer the questions leadership will increasingly ask:
- What is our current PQC exposure?
- Which systems should we migrate first?
- Which applications are mission-critical?
- What legacy technology presents the greatest risk?
- How much will migration cost?
- What progress have we made?
- Can we demonstrate that progress?
From Cryptographic Discovery to PQC Remediation
Discovery Must Lead to Remediation
Visibility is only the first step.
Federal agencies ultimately need to replace vulnerable cryptography and build the ability to adapt as standards evolve.
SafeLogic helps organizations move from discovery to remediation through solutions including CryptoComply, which provides FIPS 140-3 validated cryptographic software, and SafePQ, which supports post-quantum and hybrid cryptographic deployments. Combined with SafeLogic CPM, agencies can establish a more complete lifecycle – Discover, Prioritize, Remediate, Govern.
The objective is not simply to complete one PQC migration.
It is to create crypto-agility: the ability to identify, replace, and manage cryptography as standards, threats, and mission requirements change.
That is particularly important for federal environments where systems may remain operational for decades.
What Federal CISOs Should Do Now
The GAO report makes one point especially clear: waiting for PQC migration deadlines is not a viable strategy. Federal CISOs should use the current window to lay the foundation for migration. That means building and maintaining a reliable cryptographic inventory, introducing automated discovery where possible, identifying mission-critical dependencies, developing realistic budget estimates, and beginning PQC testing before migration timelines become compressed.
The PQC transition will require coordination across security, IT, acquisition, finance, engineering, and agency leadership. But the starting point is straightforward.
Before an agency can manage cryptographic risk, it has to be able to see it.
The GAO report suggests that, for much of the federal government, that remains the most urgent gap to close. For CISOs, solving that visibility problem may be one of the most important steps toward meeting federal PQC mandates and building a more crypto-agile security posture for the years ahead.
