FEDQUANTUM SIGNAL 001
PQC & SECURITY · SEPTEMBER 2026
You cannot migrate what you cannot see.
Federal post-quantum readiness is moving from long-range cybersecurity planning toward operational implementation. For agencies and the organizations supporting them, visibility into existing cryptography is becoming an essential first step.
THE SIGNAL · WHY IT MATTERS · WHAT TO WATCH · FEDQUANTUM VIEW
THE SIGNAL
Cryptographic inventory is becoming the starting point.
The federal transition to post-quantum cryptography begins with a deceptively difficult question: where is vulnerable cryptography actually being used? Across large agencies, cryptographic dependencies can exist throughout applications, networks, infrastructure, devices, certificates, software libraries and third-party products.
That makes discovery and inventory more than a compliance exercise. Agencies cannot build credible migration plans, establish priorities or understand operational risk without visibility into the cryptographic environment they already have.
As federal PQC requirements move toward implementation, cryptographic visibility is becoming foundational to the transition. Before organizations can determine what to replace, when to migrate or where to invest, they need an accurate picture of the cryptographic environment—and the dependencies—already in place.
WHY IT MATTERS
Migration is an enterprise problem disguised as a cryptography problem.
Cryptography is deeply embedded in modern technology environments, often in places organizations do not actively manage or even recognize. A single enterprise can depend on cryptographic components distributed across legacy applications, cloud environments, network infrastructure, endpoints, operational technology and an extensive software supply chain.
For federal agencies, that creates both a technical and management challenge. Discovering cryptographic assets is only the beginning; organizations must eventually determine which cryptographic dependencies create risk, which information requires long-term protection, which systems are mission-critical and how migration can occur without disrupting operations.
The same challenge extends to federal contractors and technology suppliers. Quantum readiness will increasingly depend on understanding not only an organization's own cryptography, but the cryptographic dependencies embedded throughout its technology ecosystem.
WHAT TO WATCH
Discovery will tell us how serious the transition has become.
Formal deadlines will remain important, but one of the clearest indicators of federal readiness will be what happens before migration begins. Watch for agencies to move from policy discussions toward cryptographic discovery, inventory, prioritization and migration planning.
That means paying attention to automated discovery initiatives, requirements for cryptographic inventories, crypto-agility programs, procurement language and expectations placed on technology suppliers and systems integrators. These activities will reveal whether agencies are building the operational foundation required to execute the transition.
Migration gets the attention. Discovery tells us whether migration is actually possible.
FEDQUANTUM VIEW
Readiness begins with visibility.
Quantum readiness is often framed around a future event: sufficiently capable quantum computers eventually threaten today's public-key cryptography. But that framing can obscure the work organizations need to undertake now.
The immediate challenge is not replacing every vulnerable algorithm tomorrow. It is developing enough visibility to understand the scope, dependencies and priorities of a migration that will likely span years.
That is why FedQuantum views cryptographic discovery as one of the earliest meaningful indicators of readiness. An organization that cannot see its cryptography cannot effectively prioritize it, manage it or migrate it.
SOURCE
This Signal was informed by reporting and commentary from NEXTGOV/FCW examining recent presidential executive actions and federal efforts to safeguard sensitive data, critical infrastructure and the digital economy. FedQuantum's analysis and conclusions are independent.