US Quantum-Security Roadmap Arrives After Audit Finds 24 Agencies Short of Readiness Standards

WASHINGTON — A new federal roadmap for replacing quantum-vulnerable encryption has sharpened the gap between US cybersecurity deadlines and the preparation documented by congressional auditors. The National Institute of Standards and Technology (NIST) published its final transition guidance, NIST Interagency Report 8547, on October 27, 2026. It explains which cryptographic standards are being phased out and how federal agencies and suppliers can move to approved post-quantum alternatives.

The guidance follows a Government Accountability Office (GAO) public report released October 6 and revised October 14. GAO assessed 24 agencies covered by the Chief Financial Officers Act against three preparatory practices: identifying systems using vulnerable cryptography, estimating transition funding, and testing replacement methods. None of the 24 had fully addressed all three practices during the review period. The finding is a measure of readiness in the audit, not evidence that a quantum computer has broken federal encryption.

The dates matter. GAO's underlying review covered work conducted from February 2024 through September 2025, and a sensitive version of its report was completed in September 2025. Agencies may have taken further steps since then. The public version does not establish their precise compliance position as of November 2026. Independent federal-technology reporting by FedScoop also noted the gap between the earlier audit baseline and subsequent government guidance.

GAO identified shortcomings in cryptography inventories, funding estimates and agency-level testing. In its sensitive report, it made 89 recommendations to the Cybersecurity and Infrastructure Security Agency and 23 of the 24 reviewed agencies, including calls for inventory processes and funding assessments. Of the 23 agencies receiving recommendations, 12 agreed, two partially agreed, seven neither agreed nor disagreed, and one disagreed with three of four recommendations. The public version adds no new recommendations. These response categories are not proof that corrective work is complete.

NIST's final roadmap supplies a different part of the accountability record: a technical migration path. The institute says existing quantum-vulnerable algorithms must be replaced with post-quantum key-establishment and digital-signature standards, taking account of system dependencies and suppliers. The underlying risk includes the possibility that encrypted information stolen today could be decrypted in the future, although sufficiently capable quantum computers do not yet exist.

The federal timetable has several layers. NIST says National Security Memorandum 10 sets 2035 as the primary target for migration across federal systems. Executive Order 14412 imposes faster milestones for high-value assets and high-impact systems: key establishment by 2030 and digital signatures by 2031. These priority deadlines should not be confused with a universal requirement for every system to finish by 2030. National security systems are governed by separate arrangements.

The accountability question is now whether agencies can show complete inventories, credible costs and working tests against those milestones. NIST's guidance is not itself evidence that the deficiencies GAO documented have been corrected, just as GAO's earlier audit is not a real-time assessment of work completed since September 2025.

The reports identify administrative and technical readiness gaps, not a breach, theft of protected data or deliberate misconduct by any named official. Future assessments of agency migration plans and independent tests will be needed to establish whether the gap has narrowed.