Federal Quantum Readiness Falls Short as Agencies Face Cryptography Skills Gaps

Insider Brief

• In a public report on PQC preparedness, the GAO found that none of 24 major federal agencies reviewed fully addressed all three preparation practices for protecting systems against future quantum computing threats.
• The review identified incomplete inventories of vulnerable systems, inadequate migration cost assessments and no testing of post-quantum cryptography in agency environments.
• GAO made 89 recommendations to strengthen preparation, including addressing expertise gaps, establishing inventory and funding assessment processes, and developing testing plans.

None of the 24 major federal agencies reviewed by the Government Accountability Office fully completed the preparation practices it assessed for protecting government systems against future quantum computing attacks.

That’s according to the GAO’s recently released 2026 report, which is the public version of a 2025 report, although portions of the original 2025 report remain withheld because federal agencies deemed the information sensitive.

According to the new GAO public report, the gaps covered identifying systems that use vulnerable cryptography, estimating the cost of replacing it and testing alternatives designed to withstand quantum attacks. GAO found that incomplete inventories, shortages of cryptography expertise and inadequate planning left agencies poorly positioned to manage the transition. These are three essential tasks for PQC preparation.