The General Services Administration (GSA) said on Aug. 24 that it is updating and expanding two existing federal programs to support the government-wide migration to post-quantum cryptography (PQC). The action follows a June executive order and Office of Management and Budget (OMB) memorandum directing agencies to accelerate the transition to quantum-resistant security.
In a blog post, GSA said it is updating the Federal Identity, Credential, and Access Management (FICAM) architecture to support quantum-resistant algorithms.
The FICAM modernization effort will emphasize “crypto agility,” which GSA described as the ability to quickly shift between cryptographic methods as threats and security standards change.
GSA is also expanding the testing capabilities of the Federal Information Processing Standards (FIPS) 201 Evaluation Program, executed through the Physical Access Control System (PACS) lab, to evaluate quantum-resistant solutions for federal buildings.
“This ensures that employee badges, visitor passes, and building access controls will remain secure against future quantum threats,” GSA said.
“The enhanced lab infrastructure represents an entirely new capability, requiring extensive research and development to test quantum-resistant technology for both physical access control systems and employee identification cards,” it added.
The June OMB memo also tasked GSA with establishing an interagency working group focused on FICAM modernization for the PQC transition. GSA said the group held its first meeting on Aug. 12, with 40 participants representing 17 federal agencies.
The working group plans to meet biweekly and address issues including non-human identities, automation, and other aspects of identity in a PQC environment, according to GSA.
GSA will also host the 2026 Post-Quantum Cryptography Summit on Sept. 16, a hybrid event bringing together federal officials, industry representatives, and subject-matter experts to discuss the government’s transition to PQC.
The broader federal migration to PQC is expected to span nearly a decade. The executive order requires agencies to transition all high-value assets and high-impact systems to PQC for key establishment by Dec. 31, 2030.
Then, OMB said agencies should migrate digital signatures in 2031 and fully migrate remaining systems by 2035.