For federal agencies preparing for the quantum era, the biggest challenge may not be the technology itself, but the work required to put it into practice.
In a recent interview with MeriTalk, Dr. Jordan Kenyon, quantum growth and operations lead at Booz Allen Hamilton, said agencies must tackle the immediate cybersecurity risks posed by quantum computing while preparing to harness its longer-term benefits.
“It’s not a science problem. It involves science, but it’s an execution problem,” Dr. Kenyon said, pointing to the acquisition, workforce, engineering, and operational expertise needed to turn emerging quantum technologies into mission-ready capabilities.
Dr. Kenyon said the federal government is entering a critical period for quantum readiness, driven by new post-quantum cryptography (PQC) mandates and the growing potential of quantum computing and sensing technologies.
“There are now very clear requirements governing the PQC transition, and I think federal leaders are aware – acutely aware – that they’re racing the clock on this,” she said.
From cryptographic inventories to outcomes
Dr. Kenyon said the Trump administration’s Executive Order 14412, issued in June, could fundamentally change how federal agencies approach their PQC transitions.
While earlier mandates emphasized cryptographic discovery and inventories, the new order shifts attention toward implementation outcomes.
“The new executive order pivots to a focus on outcomes, which I think is really critical because it provides more flexibility to agencies on where they start solving the problem,” Dr. Kenyon said.
Under the new requirements, agencies are expected to prioritize PQC protections for high-value assets and other sensitive systems, with key establishment migrations targeted for 2030, digital signatures for 2031, and broader migration completion by 2035.
Dr. Kenyon said Booz Allen has seen agencies take different approaches to getting started. Some begin by identifying where cryptography is used across their systems, while others pursue prototypes to understand how PQC could affect mission-critical operations.
Others have started by working with technology vendors to determine which migration responsibilities will fall to their own organizations.
“One of the most common barriers to adoption really is establishing that visibility in the beginning and maintaining it and strengthening it throughout the transition,” Dr. Kenyon explained.
“But, I think operationally, one of the biggest barriers to most agencies’ ability to implement PQC at speed and at scale is really resourcing,” she added.
Dr. Kenyon pointed to an Office of Management and Budget (OMB) estimate from 2024 of more than $7 billion to transition federal non-national security systems to quantum-resistant cryptography.
“Appropriations have not yet followed, and I think that creates a difficult operational environment,” Dr. Kenyon said.
“Without dedicated funding lines, I think it’s going to be really hard for the entire government to meet these transition deadlines,” she warned.
Quantum readiness requires more than new algorithms
For Dr. Kenyon, quantum readiness means more than replacing vulnerable encryption algorithms with quantum-resistant alternatives.
It also requires agencies to rethink how they manage cryptography across their infrastructure, particularly as emerging technologies introduce new security threats.
“We cannot afford to continue treating cryptography the way that we have always treated cryptography,” she said. “We cannot afford to look at the PQC transition as a one-time transition to a select number of algorithms.”
Instead, Dr. Kenyon emphasized the importance of cryptographic agility, which she described as the ability to change cryptographic algorithms without substantially disrupting systems and operations.
She explained that the National Institute of Standards and Technology is working to establish computational diversity within its PQC algorithm suite, using algorithms based on different mathematical foundations to provide alternatives if one approach becomes vulnerable.
However, she stressed that having multiple algorithms available does not automatically make an agency cryptographically agile.
“Computational diversity is only the first part of the problem,” Dr. Kenyon said. “Cryptographic agility is how you use computational diversity within your systems, and it’s the piece that falls on the agencies for implementation.”
The broader challenge, she said, is recognizing that quantum readiness involves both defending against new cyber threats and identifying where quantum capabilities could benefit federal missions.
“Every single agency needs to be implementing post-quantum cryptography. The quantum cyber threat is ubiquitous,” Dr. Kenyon said.
“But a lot of agencies will also need to be creating capacity to use quantum computing and quantum sensing technologies to harness advantages that those technologies will provide,” she added.
A roadmap for federal PQC migration
Looking ahead to the next one to two years, Dr. Kenyon encouraged federal leaders to use OMB Memorandum M-26-15 as a roadmap for their PQC transitions – even if their components are not directly required to submit a response.
The June guidance directs federal agencies to develop migration plans covering system prioritization, implementation milestones, cryptographic discovery, vendor coordination, and risk management.
Dr. Kenyon said she has already seen proactive clients voluntarily use the guidance to develop their own migration strategies.
“I think it’s an incredibly useful framework and tool for thinking about what PQC migration will take, and for bringing forward very clear, well-defined, articulable action items for the next one to two years,” she said.
Dr. Kenyon encouraged organizations outside the federal government to consider adopting the framework as well.
“I think it can be a template for a lot of organizations that are not required to respond, but are looking for resources on how they get started,” she said.
Turning quantum potential into mission impact
Beyond the immediate PQC transition, Dr. Kenyon said Booz Allen is working across quantum computing, sensing, networking, and cryptography to help agencies translate emerging technologies into operational capabilities.
She said the company’s approach combines quantum scientists with mission experts, engineers, and implementation specialists who understand the practical challenges of deploying new technologies in complex federal environments.
“We have the quantum and cryptographic scientists, but we also have the mission experts. We have the engineering experts,” Dr. Kenyon said. “We’ve got the diversity of expertise in-house and such a strong partnership network with other quantum companies in the larger ecosystem.”
“They’re building hardware and software that solve pieces of the puzzle, but we’ve got the mission intimacy to put together that full picture and test it rigorously against operational environmental constraints,” she added.
Ultimately, Dr. Kenyon believes federal agencies must take an active role in determining how quantum technologies can be applied to their missions, rather than waiting for industry to provide ready-made solutions.
“Quantum computers will be an incredible tool, but the real innovation is the ability to rethink the mission problem and express it under new rules, like the rules of quantum mechanics, and then use the computational hardware for the last-mile solution,” she said.
That responsibility will require agencies to examine their existing computational workflows, identify potential quantum applications, and rigorously test whether those approaches deliver value.
“Quantum computing vendors will give us great computers, but they won’t tell us what to put into them,” Dr. Kenyon said. “[Federal leaders need] to meet this technology in a way that makes it useful for our nation and its people.”