By David E. Crawford, Director and Post-Quantum Cryptography Lead, CGI Federal
When I read the recent Government Accountability Office report showing that federal agencies are moving too slowly toward post-quantum cryptography (PQC) readiness, I wasn’t surprised. In my work with federal agencies, I’ve seen firsthand the struggle to gain visibility into legacy environments, align modernization priorities, and coordinate across disparate mission and IT stakeholders. What the GAO captured is what many of us in the field have sensed for a while: Agencies recognize the quantum threat to cryptography, but most are still at the starting line when it comes to preparing for it.
But here’s the truth as I see it. The message agencies should take from the GAO’s findings is the urgency with which they need to be moving now. PQC is not merely another cybersecurity requirement. It’s the catalyst for a years-long transformation in how the federal government protects and manages the data and systems that enable its mission.
As someone who works daily with federal leaders navigating this shift, I believe PQC readiness will ultimately distinguish agencies that lead from those that lag. And leadership – far more than technology – is what this transition demands.
The real problem isn’t cryptography. It’s visibility and coordination
The most common issue I see across agencies is that they don’t know what cryptography they’re using. Not reliably, not comprehensively, and not in a way that can support a multi-year modernization plan.
And without that baseline, no agency can create a credible roadmap – let alone meet the deadlines established in Executive Order 14412 or the Office of Management and Budget’s M-26-15 guidance.
The starting point is simple: Agencies need to take ownership of cryptographic visibility the same way they’ve taken ownership of asset management, identity, and logging. This is an enterprise competency, not a mere security task. And they must build it now.
The time for decisive leadership is now
Federal guidance is unambiguous: Agencies must transition high-value and high-impact systems to PQC key establishment by 2030, shift digital signatures by 2031, and complete full migration by 2035. Leaders should not take those deadlines as aspirational. The dates are operational guide rails.
But in my conversations with agency leaders, I see hesitation. Some are concerned about cost. Others aren’t sure whether their vendors are ready. Some worry about the impact on critical systems. While I can understand those concerns, leaders can’t allow them to become roadblocks.
This is a holistic modernization
This hesitation can be remedied if leaders accept that PQC will not be a single “big bang” transformation. It will unfold across multiple modernization efforts – cloud migration, identity modernization, zero trust architecture implementation, network upgrades, application refactoring, and others – that are already underway.
This understanding relieves them of the impression that they must do it all at once, while simultaneously illuminating the multiple pathways they can take now, or are already on. The opportunity is to align those initiatives under a unified PQC migration strategy. Leaders who do that will accelerate modernization; leaders who don’t will fall behind.
What agencies should do next, based on what I’ve seen in the field
Here are the four actions I believe every agency should take now:
1. Establish a PQC governance model with real authority
As with many enterprise-wide initiatives, treating PQC as a “side-of-the-desk” cybersecurity project can create challenges in maintaining momentum, resolving cross-functional dependencies, and establishing clear accountability. Agencies need to appoint a PQC lead, but more importantly, empower that role with visibility into all modernization initiatives, not just security ones.
2. To avoid rapid obsolescence, build a cryptographic inventory that updates itself
Agencies should deploy automated discovery tools that continuously identify algorithms, protocols, keys, and certificates across the environment.
Every modernization decision, large and small, should begin with answering the questions, “What cryptography does this system use, and what does that mean for PQC migration?”
3. Use PQC as a forcing function to modernize legacy systems
Some systems cannot transition to PQC, and agencies often already know which ones they are. They’re the same systems that can’t meet ZTA or identity modernization requirements. PQC gives agencies the justification and urgency to replace systems that have needed investment for years.
4. Demand crypto-agility from vendors and integrators
The PQC algorithms available today will not be the last. Agencies should require vendors to support crypto-agile architectures, externalized configuration, and modular cryptographic components.
This isn’t just a best practice – it is the only way to ensure today’s investments remain relevant tomorrow.
System integrators have a role to play – and a responsibility
At CGI Federal, we see PQC not as a narrow security upgrade but as a modernization accelerator. Our work with agencies often begins with helping them answer foundational questions:
- Where is cryptography used?
- Which systems are most sensitive to transition risk?
- How can PQC migration align with cloud and application modernization?
But what matters most is helping agencies build a sustainable, executable roadmap that they can carry forward for the next decade. Specific technologies are rarely the key consideration.
This is a partnership model, not a service model. Agencies shouldn’t have to navigate PQC alone, and the integrators who support them shouldn’t approach this as a one-off project. The scale and complexity are too great.
My view: PQC readiness is a test of organizational resolve
Quantum risk is real, but quantum opportunity is real too. Agencies that act decisively now will modernize faster, secure more effectively, and operate with greater mission resilience.
And those that wait, hoping for a simpler answer or a slower timeline, will soon face both higher cost and higher risk.
We’re at a pivotal moment. GAO has provided the signal. The White House has issued the mandate. OMB has given the roadmap.
Now it’s about leadership – and execution.
And that starts today.
David Crawford is a lead cyber architect in the National Security and Justice business unit at CGI Federal, spearheading the company’s zero trust, post-quantum cryptography (PQC) and artificial intelligence/superintelligence (AI/SI) security and governance initiatives. Drawing on deep expertise, David helps federal agencies advance integrated cybersecurity strategies that unify various disciplines and techniques to strengthen mission outcomes and long-term security posture.