GAO Finds No Federal Agency Fully Ready for the Post-Quantum Cryptography Shift

The U.S. Government Accountability Office has put a number on how far Washington is from being ready for a computer that does not yet exist. In a public version of a once-sensitive audit released on October 6, the watchdog found that none of the 24 largest federal agencies has fully completed the preparatory steps the White House budget office set for moving to post-quantum cryptography. The report, GAO-27-108740, is titled "Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat."

What the audit found

GAO assessed all 24 agencies covered by the Chief Financial Officers Act against three practices drawn mainly from the Office of Management and Budget's November 2022 guidance: building a prioritized inventory of systems that use vulnerable cryptography, assessing the funding needed to migrate, and testing post-quantum algorithms. According to the report, no agency fully addressed any of the three.

On inventories, one agency fully addressed the requirement for a complete list of priority systems, 22 addressed it partially and one had no inventory at all. GAO also noted that several inventories wrongly listed symmetric algorithms as vulnerable to a quantum attack, a sign of the expertise gap discussed below. Of six agencies selected for an accuracy check, none fully met the algorithm or system-characteristic accuracy activities, and several could not document where their inventory data came from.

On funding, 21 agencies partially assessed what migration would cost and three developed no assessment. Only one agency's estimate rested on a complete inventory, and all 21 that produced estimates acknowledged their data was not fully accurate. Cybersecurity Dive reported that the Office of the National Cyber Director called the immature vendor market "the biggest factor" delaying those estimates.

On testing, the picture was thinnest. One agency had conducted market research on candidate vendor implementations but had not tested post-quantum cryptography. The other 23 addressed neither testing activity. Agencies pointed to immature vendor products, and the national cyber director's office told GAO that testing was voluntary. GAO disagreed, saying OMB's guidance does not say so and that open-source tools have been available for at least four years.

Why agencies are behind

GAO traced the gaps to people, process and tooling rather than to any single failure. Six agencies had trained staff on cryptography; the other 18 reported a lack of expertise and had no plans to fill it. Twenty-three agencies had no documented process for maintaining an inventory. Only five used automated discovery tools, and 15 of the remaining 19 said it was too early or that they were waiting for the Cybersecurity and Infrastructure Security Agency to recommend tools. Cybersecurity Dive reported that CISA told GAO it is working with the National Institute of Standards and Technology to identify the best inventory tools.

Scale compounds the problem. GAO described one department with more than four million endpoints that had no plan for building its inventory, and 11 agencies cited a lack of vendor cost data for funding. The pattern is circular: vendors have not priced post-quantum products because demand is thin, and agencies cannot budget without prices.

The threat model

The report's urgency rests on "harvest now, decrypt later," in which an adversary stores encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists. GAO said such a machine could compromise authentication systems, for example by forging code-signing keys or digital certificates, and that its impact on unprepared federal systems "could be catastrophic to the nation's economy and security," as Cybersecurity Dive quoted the report. The outlet added that U.S. intelligence officials and private analysts say China is likely stockpiling stolen U.S. data for this purpose; that is an attributed assessment rather than something the report establishes.

On timing, the report is candid about uncertainty. It cites a December 2024 survey of 32 experts by the Global Risk Institute in which most put the probability of such a machine by 2040 above 50 percent, with a small minority expecting one much sooner. The highlights say a machine is possible as soon as the 2030s, while the conclusions describe the probability within the next 10 years as low. GAO attributes the uncertainty to unsettled qubit growth rates, unclear error-correction requirements, undeveloped supporting technology and the possibility that artificial intelligence speeds progress. It also cites a 2023 RAND estimate of roughly $64,000 and about one gigawatt of energy to derive a single private key, a cost NIST officials said could fall by a factor of 10.

Recommendations and responses

The public report adds no new recommendations. The sensitive version issued in September 2025 made 89 recommendations to CISA and 23 agencies, covering inventory processes, funding identification and expertise. Of the 23 agencies with recommendations, 12 agreed, two partially agreed and seven neither agreed nor disagreed. One disagreed with three of its four recommendations while agreeing with one, and the Department of the Interior did not respond. GAO said it continues to believe all of the recommendations are warranted.

In the public version, the Department of Homeland Security reiterated its earlier response and said it remains committed to quantum readiness. The Social Security Administration agreed with the recommendations and said it had updated its cryptographic data collection. Coverage by The National reported the same 89-recommendation figure and the lack of response from Interior.

What to watch

Three things will determine whether the audit changes behavior. The first is whether agencies close the inventory gap, since GAO's own findings show most cannot yet say which systems are exposed. The second is whether OMB and the national cyber director's office treat testing as mandatory, a point on which GAO and the White House office publicly disagree. The third is whether vendor products mature quickly enough for agencies to price migration, which Quantum Computing Report framed as the main commercial question for suppliers.

For the quantum industry, the report is an indirect demand signal. Governments that cannot inventory their cryptography cannot buy migration services, and the audit suggests procurement is still at the stage of finding out what needs replacing. That favors vendors selling discovery and cryptographic-inventory tooling over those selling finished replacements. It also reinforces a point familiar to security teams: the quantum threat is treated as a scheduling problem as much as a physics one, and the schedule is set by the slowest part of an organization rather than by the fastest qubit.