A Government Accountability Office review found that none of 24 major federal agencies fully completed the preparation practices it assessed for adopting post-quantum cryptography, identifying gaps relevant to companies offering migration tools, technical expertise and implementation support.
The deficiencies span three foundational tasks: identifying systems that use vulnerable cryptography, estimating transition costs and testing quantum-resistant alternatives. For PQC companies, the findings suggest that agencies need help defining and planning their migrations, alongside products that implement new cryptographic standards.
The October 2026 publication is the public version of a sensitive report issued in September 2025. Its findings should therefore be read as an assessment from the earlier review, rather than a fresh measurement of federal readiness or current purchasing plans.
GAO: Discovery and Expertise Come First
Only one agency fully addressed the applicable activities for developing a prioritized inventory of systems with vulnerable cryptography. One had no inventory, while the other 22 did not fully account for all priority systems.
Several inventories also lacked information about cryptographic methods, software packages, operating systems or hosting arrangements. Some incorrectly identified symmetric cryptography as vulnerable to the quantum threat assessed in the report.
These findings from the GAO public report point to a need for discovery tools and services that help agencies locate vulnerable cryptography, verify findings and connect them to mission priorities. Agencies must distinguish systems requiring migration from those needing replacement, while accounting for information that must remain confidential for years.
Five agencies used automated tools to identify and verify inventory data; 19 did not. However, automation was recommended as an aid rather than required by policy, and officials emphasized that tools alone could not produce complete inventories.
The workforce gap was similarly broad. Eighteen agencies reported lacking expertise in cryptography and inventory development without having plans to address those shortages. That finding suggests potential demand for training and technical support, although the report does not establish funded procurement opportunities.
Cost Estimates Need Better Foundations
None of the agencies fully addressed the funding assessment activity. Twenty-one produced assessments but acknowledged that their data were not fully accurate; three produced none.
Eleven agencies reported difficulty estimating costs because vendors lacked PQC products and associated pricing at the time examined. Only one agency had documented a process for assessing migration funding.
OMB used agency assessments to provide Congress with an approximately $7.1 billion governmentwide estimate for migrating priority systems or replacing legacy systems unable to support PQC, according to the GAO.
That figure is a rough planning estimate, not an approved spending commitment or a measure of revenue available to PQC suppliers. Officials said estimates would be refined as products and reliable pricing became available.
For vendors, the findings suggest that clear implementation requirements and credible cost information could help agencies improve planning.
Testing and Migration Support
None of the 24 agencies tested PQC in its own environment. One conducted market research to identify potential vendor implementations for testing.
Sixteen agencies said testing was premature because vendors were still incorporating the algorithms into products. National Cyber Director officials also said testing was encouraged rather than explicitly required and that many agencies lacked resources or expertise.
GAO nevertheless called for testing plans to identify compatibility problems and systems requiring replacement.
The report’s message for PQC companies is that federal migration depends on more than supplying algorithms. Agencies need reliable inventories, skilled personnel, defensible cost estimates and practical testing plans.
GAO made 89 recommendations in the earlier sensitive report. The public version adds none and does not establish that the identified gaps have been resolved.
