-1.png?w=1024)
None of the 24 Chief Financial Officers (CFO) Act agencies had fully addressed three key practices for preparing to move to post-quantum cryptography (PQC), according to a Government Accountability Office (GAO) report publicly released Oct. 6. The findings reflect an audit completed in September 2025.
GAO measured those agencies against three practices drawn from Office of Management and Budget (OMB) guidance: inventory systems with vulnerable cryptography, estimate the funding to replace it, and test quantum-resistant algorithms. Only one agency fully completed its inventory work. None tested the new algorithms.
The report landed about two weeks before Oct. 22, when civilian agencies must submit migration plans to OMB under memorandum M-26-15. The plans must describe inventory methods, migration milestones, and funding and personnel needs — areas that overlap with GAO’s findings.
How Did Agencies Score on GAO's Three Practices?
GAO's audit of post-quantum cryptography preparation ran from February 2024 to September 2025. The public report follows a sensitive version issued to agencies that September.
| Practice | Fully addressed | What GAO found |
|---|---|---|
| Prioritized inventory of systems with vulnerable cryptography | 1 of 24 | 22 agencies left priority systems out, one had no inventory, and 19 used no automated discovery tools |
| Funding needed to move priority systems to PQC | 0 of 24 | 21 agencies submitted estimates they said were not fully accurate, and three submitted none |
| PQC testing in agency environments | 0 of 24 | One agency identified vendor products to test but ran no tests, and 23 addressed neither testing activity |
The audit ended roughly nine months before the administration’s June 2026 quantum executive orders. The cryptography order directs high-value assets and high-impact systems, excluding national security systems, to adopt PQC for key establishment by Dec. 31, 2030, and digital signatures by Dec. 31, 2031.
Agencies Blamed Missing Skills and Vendor Products
GAO traced the gaps to staffing, tooling, cost data, and vendor readiness:
- Expertise: 18 agencies reported a lack of cryptography expertise and had no plans to fill the gap.
- Tools: 15 agencies said it was too early for automated discovery tools or that they were waiting for the Cybersecurity and Infrastructure Security Agency (CISA) to identify some.
- Cost data: During the audit, 11 agencies said the lack of commercially available PQC products and vendor pricing made funding estimates difficult to develop.
- Testing: 16 agencies said testing was premature because vendors were still adding the algorithms to their products.
GAO rejected the testing argument. OMB encouraged agency testing in November 2022, before NIST finalized FIPS 203 and its companion standards in August 2024. Open-source prototyping tools have also existed for at least four years, according to the report.
Private buyers face a version of the same vendor problem, since hardware marketed as quantum-ready still needs verification.
Of the 23 agencies that received recommendations, 12 agreed and one disagreed with three of its four.
What eWeek Found: Migration Budgets Need More Than a Deadline
The funding findings expose a practical weakness: agencies were estimating migration costs before they fully understood the systems involved. OMB’s July 2024 report put the rough cost of migrating prioritized federal systems, including replacing legacy systems that cannot support PQC, at approximately $7.1 billion.
OMB and the Office of the National Cyber Director said the assessments were intended to provide an initial planning estimate, with costs refined as products and pricing matured. GAO’s findings suggest incomplete inventories could leave migration costs unaccounted for, although the report does not quantify any increase.
For enterprise leaders, preparing for quantum threats before they arrive starts with understanding the scope of the migration before setting a budget. Teams should identify which systems use vulnerable cryptography, who owns them, and how long their data must remain protected. Those details help distinguish systems that need early attention from those that can be upgraded during scheduled hardware replacements or software modernization.
Vendor availability also affects how organizations prepare. An announced PQC feature does not establish whether it will work with an organization’s applications, identity systems, or legacy infrastructure. Buyers should seek specific implementation details and plan compatibility testing before treating a vendor roadmap as evidence that their own migration is covered.
Oct. 22 is the next federal planning checkpoint. M-26-15 requires agencies to describe inventory methodologies and automated tools, alongside funding and personnel estimates. Updated evidence will be needed to establish how much progress agencies have made since the audit. For businesses setting their own timelines, the useful benchmark is whether their plans connect identified systems to accountable teams, testing milestones, and resources.
Read more: Google Cloud’s 2029 quantum-security roadmap explains how provider upgrades and customer responsibilities fit together when planning an enterprise PQC migration.