TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A public 2026 GAO report found that none of 24 major federal agencies fully completed the three post-quantum cryptography preparation practices it reviewed. One agency fully addressed inventory work; none fully assessed migration funding or tested post-quantum cryptography in its own environment. The report carries forward 89 recommendations from a sensitive 2025 report, while some details remain withheld.
The Government Accountability Office found that none of 24 major federal agencies fully completed the three preparation practices it reviewed for post-quantum cryptography: identifying vulnerable systems, estimating migration costs and testing new cryptography. The findings, published in a public version of a 2025 report, point to gaps in agencies’ ability to plan for a future quantum threat, even though current quantum computers cannot break the cryptography at issue.
GAO reported that only one agency fully addressed the activities needed to develop a prioritized inventory of systems using vulnerable cryptography. One agency had not developed an inventory, and 22 had inventories that did not account fully for all priority systems. Some inventories also lacked or misstated technical details, including the cryptographic methods, software, operating systems or hosting arrangements used by systems.
None of the 24 agencies fully assessed the funding needed to migrate priority systems, and none tested post-quantum cryptography in its own environment, according to the report. GAO’s earlier, sensitive 2025 report made 89 recommendations, including calls to address expertise gaps and establish processes for inventories, funding assessments and testing plans. The October 2026 public version adds no recommendations and retains the earlier report’s objectives and audit methodology.
Some portions of the original 2025 report remain withheld because federal agencies deemed the information sensitive. GAO said updates may show whether deficiencies identified in the earlier review have since been addressed; the public report does not establish that agencies have completed the recommended work since the review.
Planning Gaps Could Delay Migration
The findings matter because preparing for post-quantum cryptography is not simply a matter of selecting a replacement algorithm. Agencies first need to know which systems use vulnerable cryptography, determine which systems warrant priority, estimate the work and funding involved, and test replacements in their operational environments. Gaps in inventories or technical expertise can make it harder to set priorities and allocate resources.
GAO described two risks from a future quantum computer capable of breaking relevant cryptography: attackers could undermine digital trust by recovering keys used for credentials or software verification, and they could retain encrypted communications now for possible decryption later. The latter is often called “harvest now, decrypt later.” Information that must stay confidential for many years could be exposed even before such a computer exists. The report cautions that recovering individual keys could take substantial time and resources, but says exposure of even a small amount of important information could seriously affect federal operations.
post-quantum cryptography testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
A Future Threat, Not a Current Break
Today’s quantum computers cannot break the cryptography covered by the report. Post-quantum cryptography relies on mathematical methods designed to resist attacks from sufficiently capable future quantum computers, and agencies can run it on conventional computers. Moving to it can still require changes across software, hardware and services.
The timetable for a cryptographically relevant quantum computer remains uncertain. GAO cited a December 2024 survey of 32 industry experts who placed the probability of one being developed by 2040 above 50%. That figure is an expert estimate, not a confirmed forecast; the report notes that estimates vary and that quantum components and supporting technologies must improve. GAO’s inventory work focused on priority systems, including those essential to agency missions, those whose compromise could cause severe harm, information expected to remain sensitive in 2035, and systems using vulnerable public-key cryptography to control access.
“None of the 24 major federal agencies reviewed fully addressed all three preparation practices assessed.”
— Government Accountability Office report
cryptography inventory management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What the Public Report Leaves Open
The public report does not disclose all details of the 2025 review because portions remain withheld as sensitive. It also does not establish the current status of every agency’s response or whether the 89 recommendations have since been implemented. The report says updates may provide evidence of improved preparation, but this public version contains no additional recommendations.
The arrival date and capabilities of a quantum computer able to break the cryptography remain uncertain. The cited 2040 estimate reflects views from surveyed experts, not a guaranteed deadline. The report also does not imply that every encrypted record would be quickly recoverable if such a machine were developed.
quantum-resistant encryption hardware
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Agency Follow-Through on GAO Recommendations
The next measure of progress is whether agencies establish and carry out the processes GAO recommended: maintaining accurate inventories of priority systems, assessing the funding and work required to migrate them, and creating plans to test post-quantum cryptography. The public report identifies these as preparation needs but does not provide a new timetable for agency action.
Further public updates could clarify whether the deficiencies found in the earlier review have been addressed. Until then, the published findings document shortfalls in the reviewed agencies’ preparation, while the full account remains limited by the withheld portions of the 2025 report.
cybersecurity risk assessment tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Can today’s quantum computers break federal encryption?
No. The report says current quantum computers cannot break the cryptography it discusses. The concern is a sufficiently powerful future machine.
What did GAO find across the 24 agencies?
None fully completed all three practices reviewed: identifying vulnerable systems, assessing migration costs and testing post-quantum cryptography in agency environments. One agency fully addressed inventory work; none fully assessed funding or conducted the reported testing.
What are the 89 recommendations?
They come from GAO’s earlier, sensitive 2025 report and include developing cryptographic inventories, identifying migration funding, addressing expertise gaps and creating testing plans. The October 2026 public version did not add recommendations.
When could a quantum computer pose this threat?
The timing is unknown. GAO cited a December 2024 survey in which 32 industry experts put the probability of a cryptographically relevant quantum computer existing by 2040 above 50%; that is an estimate, not a confirmed timeline.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
