Preparing for Post-Quantum Cryptography in State Government: A Call to Action

Preparing for post-quantum cryptography and building a foundation for cryptographic agility

NASCIO CONTACTS

Amy Glasscock, Director, Innovation and Emerging Issues
Eric Sweden, Director, Enterprise Architecture and Governance

As quantum computing advances, state governments face growing cybersecurity risks that could compromise sensitive information, digital identities and critical government systems. This NASCIO publication examines the emerging threats to traditional encryption, the urgency of transitioning to post-quantum cryptography and the importance of preparing before quantum computers become capable of breaking today’s cryptographic protections. Drawing on federal guidance, industry research and findings from the 2026 NASCIO State CIO Survey, the report highlights early state efforts and outlines seven actionable steps to help states assess vulnerabilities, strengthen cryptographic agility and develop a phased migration strategy. The publication serves as a call to action for state technology leaders to begin preparing now for a more secure, quantum-resistant future.

Preparing for Post-Quantum Cryptography in State Government: A Cal to Action

Two Paths to Quantum Readiness

Quantum computing promises to transform fields ranging from scientific research and materials science to pharmaceuticals, logistics and cybersecurity. Its potential to solve certain complex problems beyond the practical reach of traditional computers presents significant opportunities for innovation. However, quantum computing also introduces a serious cybersecurity challenge for state governments: the potential to undermine cryptographic protections that secure sensitive information, digital identities, government transactions and critical infrastructure.

There are two important paths toward quantum readiness. The first is the innovation path, which explores how quantum computing might enable new capabilities, improve government operations and help address complex public policy challenges. The second is a risk-reduction path, which focuses on preparing government systems, information and infrastructure for the security threats that quantum computing will introduce.

Both paths are important, but the risk reduction path requires immediate attention. State governments depend on cryptography to protect confidential information, authenticate users, establish trusted communications and verify the integrity of digital transactions. Many of these protections rely on mathematical problems that future quantum computers may be able to solve efficiently.

The transition to post-quantum cryptography (PQC)—cryptographic methods designed to withstand attacks from both classical and quantum computers—will require significant planning, coordination and modernization. It is not a task that can be accomplished quickly once a new threat emerges.

State governments should begin preparing now. Some states have already taken important steps, but the larger challenge is ensuring that quantum readiness becomes an integral part of enterprise cybersecurity, technology governance and enterprise architecture.

Objects in the Mirror Are Closer Than They Appear

When will quantum computers become capable of breaking widely used cryptographic protections? There is no definitive answer, but the timeline is increasingly relevant to government cybersecurity planning.

The U.S. Government Accountability Office (GAO), in its October 2026 report Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, notes that most industry experts believe a cryptographically relevant quantum computer (CRQC) will be developed, possibly as soon as the 2030s. Such a computer would have sufficient capability to compromise certain cryptographic methods widely used today. The 2030s begin in just over three years. While this does not mean quantum computers capable of breaking today’s cryptography will necessarily arrive that soon, it does underscore how little time remains for organizations that have not begun preparing.

The Global Risk Institute’s Quantum Threat Timeline Report 2024 provides additional perspective. Drawing on assessments from 32 quantum computing experts, the report identifies substantial uncertainty about when these capabilities will emerge. Nevertheless, the experts assign meaningful probabilities to the development of cryptographically relevant quantum computers within the coming decade.

The Global Risk Institute emphasizes three considerations in assessing the urgency of migration:

How long information must remain protected
How long an organization will need to transition its systems
When quantum computing threats may become operational

Information requiring protection for 15 or 20 years may already be at risk if it is intercepted today and decrypted in the future. Likewise, a complex government system requiring years of planning, procurement, testing and modernization may not be ready if migration begins only after a credible quantum threat materializes.

The question for state governments is not simply when a cryptographically relevant quantum computer will arrive. It is whether they can complete the necessary preparations before that happens. There is a related question to this discussion. How long will it take to actually prepare for the era of post-quantum computing?

A well-planned migration for a relatively large enterprise is estimated by one expert as requiring four to 15 years if the migration stays on a disciplined schedule. The National Institute of Standards and Technology (NIST) reinforces the urgency in its October 2026 report, Transition to Post-Quantum Cryptography Standards. NIST observes that moving from new cryptographic standards to their widespread integration into information systems has historically taken 10 to 20 years. That is a very wide swath which again emphasizes how much is unknown regarding the advancements in quantum computing.

What Is at Risk?

Modern cybersecurity depends on several types of cryptographic protection. Of particular concern are widely deployed public-key cryptographic algorithms, which are extraordinarily difficult for conventional computers using currently known practical methods.

However, a sufficiently powerful quantum computer could solve these problems efficiently, undermining the security assumptions on which current algorithms depend. These algorithms support important government capabilities and services, including secure website communications, virtual private networks, digital certificates, identity and access management, software authentication and digital signatures. These security controls exist across state government business processes. For example, IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies mandates encryption for data in transit and at rest.

The implications extend beyond protecting confidential information. Public-key cryptography also helps establish whether a digital communication, software update or transaction can be trusted. If an attacker can compromise the cryptographic mechanisms used to establish that trust, the integrity and authenticity of government systems may be threatened.

Fortunately, the transition to quantum-resistant cryptography is already underway. In 2024, NIST finalized three foundational post-quantum cryptography standards. These standards provide an important foundation for transitioning away from quantum-vulnerable public-key cryptography. NIST specified dates for compliance in publication NIST IR 8547. While these deadlines do not automatically apply to state governments, they signal the direction of federal cybersecurity standards and create important considerations for state technology planning, procurement and modernization. However, adopting new algorithms involves more than substituting one mathematical method for another. States must consider the applications, devices, protocols, certificates, key-management systems and third-party services that depend on existing cryptography.

The challenge is enterprise-wide and will require coordinated planning across cybersecurity, enterprise architecture, procurement, application development and technology operations.

Threats That Begin Today

Although quantum computers capable of breaking widely deployed public-key cryptography are not yet available, certain risks associated with their future development are already present.

Two scenarios illustrate why preparation cannot wait.

Harvest Now, Decrypt Later (HNDL). In this scenario, malicious actors intercept or acquire encrypted information today and retain it until future quantum computing capabilities allow them to decrypt it. The information may include sensitive citizen records, financial information, health information, confidential government communications or other data that must remain protected for many years. The threat is particularly significant because improving encryption in the future cannot necessarily protect information that has already been captured.

A September 2025 Federal Reserve research paper, “Harvest Now Decrypt Later”: Examining Post-Quantum Cryptography and the Data Privacy Risks for Distributed Ledger Networks, examines this present-day risk and the potential limitations of future cryptographic upgrades in protecting previously collected information.

Trust Now, Forge Later (TNFL). This scenario concerns the future compromise of digital signatures and other cryptographic mechanisms used to establish authenticity and trust. Once a sufficiently capable quantum computer can derive vulnerable private signing keys from public keys, attackers may be able to forge signatures on software updates, digital documents, certificates or transactions. This is why some experts consider TNFL to be worse than HNDL.

This could allow malicious activity to appear legitimate to systems that continue trusting compromised cryptographic methods. The consequences could extend beyond disclosure of confidential information to the integrity of government operations and the trustworthiness of digital services.

These scenarios demonstrate that the quantum cybersecurity challenge involves three essential protections: confidentiality, integrity and authenticity. For state governments, all three must be addressed in post-quantum readiness planning.

States Are Beginning to Act

Quantum computing is already on the radar of state CIOs, but formal readiness efforts remain limited. The 2026 NASCIO State CIO Survey asked state CIOs about the status of quantum computing in their state governments. Seventy-three (73) percent reported monitoring developments without having taken formal action. These findings suggest that awareness is growing, but most states have not yet established comprehensive quantum-readiness programs.

Status of Quantum Computing in States

respondents allowed to make multiple selections

73%
Monitoring developments (no formal action yet)

26%
Partnering with universities or research institutions

18%
Policy discussions are underway

Engaging with federal agencies or interstate peers	14%
Post-quantum cryptography/quantum-safe security initiative underway	14%
Planned but not yet started	12%
Advisory team or working group formed	10%
No current plans	8%
Budget or funding allocated for quantum-related activities	6%
Quantum readiness assessment completed on operations and workforce	4%
Enterprise policy or strategy established	2%
Proof of concept or sandbox environment established	2%
State employee awareness or training programs are underway	2%

Source: The 2026 NASCIO State CIO Survey

NASCIO’s preliminary examination identified several examples that illustrate different approaches to readiness which can be mimicked and reused to give states a jump start.

Massachusetts: Incorporating PQC into statewide IT strategy
Massachusetts provides an example of a formal strategic commitment. The Commonwealth’s 2026–2028 statewide IT strategy explicitly identifies preparation for and deployment of post-quantum cryptography as a technology priority.

Minnesota: Developing a practical migration roadmap
Minnesota’s 2025 Technology Advisory Council Report recommends preparing for post-quantum encryption through several concrete activities.

Inventorying cryptographic methods
Assessing vulnerabilities
Developing a phased migration plan aligned with NIST standards
Incorporating PQC considerations into procurement and vendor relationships

The state’s recommendations provide a useful example of how states can translate awareness into an actionable planning framework.

Pennsylvania: Bringing quantum readiness into policy discussions
Pennsylvania legislative testimony in February 2026 recommended assessing the state’s cryptographic posture and developing a migration roadmap.

Call to Action: What States Should Do Now

Preparing for post-quantum cryptography requires a coordinated, risk-based approach. State governments do not need to replace every cryptographic implementation immediately, but they should establish the foundation for a manageable transition. NASCIO recommends that states begin with the following actions.

1. Establish executive ownership and governance.

Assign responsibility for quantum cybersecurity readiness and establish collaboration among the state CIO, CISO, chief privacy officer, enterprise architects, agency technology leaders, procurement officials and other appropriate stakeholders. At a minimum, establish an enterprise architecture domain working group. Integrate PQC readiness into enterprise risk management, technology strategy and cybersecurity planning.

2. Develop and maintain a cryptographic inventory.

Identify where cryptography is used across applications, infrastructure, networks, identity systems, databases, devices and third-party services. Document algorithms, protocols, certificates, keys and cryptographic dependencies, risk level, mitigation and business criticality. Establish ownership and maintain the inventory as systems change. Review current hardware and software to identify what needs upgrading to support quantum-resistant encryption.

3. Conduct a quantum risk assessment.

Identify systems and information that depend on quantum-vulnerable cryptography. Evaluate the sensitivity and required protection period of the information, the criticality of affected government services and the time required to implement appropriate safeguards. Prioritize systems where long-lived sensitive information or essential trust relationships create the greatest exposure. Review data retention policies to evaluate what data is stored and for how long, focusing on sensitive information that could be targeted. Delete unnecessary data that is no longer needed to minimize exposure in the event of a quantum attack.

4. Establish cryptographic agility as an enterprise architecture requirement.

Develop standards and design patterns that allow cryptographic methods to be updated or replaced without extensive application redesign. Avoid hard-coded dependencies where practical and establish reusable cryptographic services, configurable interfaces and managed key and certificate capabilities.

5. Engage technology providers and update procurement requirements.

Ask vendors, cloud providers and service partners about their PQC migration plans, support for NIST standards and ability to update cryptographic implementations. States should also evaluate whether products being purchased or renewed today can support future cryptographic transitions, reducing the risk of introducing new technology dependencies that may become costly to replace.

6. Develop and test a phased migration roadmap.

Begin evaluating standardized post-quantum algorithms in representative environments. Test performance, interoperability, compatibility and operational impacts before deployment. Coordinate migration priorities with system modernization schedules and available resources. Prioritize systems that protect information requiring long-term confidentiality, particularly communications that could be intercepted today and decrypted in the future. Systems supporting critical identity, authentication and digital trust functions should also receive early attention because of their complex dependencies and replacement cycles.

7. Build awareness and sustain the effort.

Provide education for technology, cybersecurity, architecture and procurement teams. Monitor developments in quantum computing, cryptographic research and federal standards. Review readiness plans regularly and adjust priorities as the threat environment evolves.

Quantum computing presents both opportunities and risks for state government. Over time, states will explore innovative applications that may improve public services, strengthen analytical capabilities and address complex challenges. But the cybersecurity implications demand attention today. The transition to post-quantum cryptography will be a multiyear undertaking involving technology, governance, procurement, workforce capabilities and enterprise architecture. Waiting for a cryptographically relevant quantum computer to arrive before beginning that work would place government information and services at unnecessary risk. States should begin by understanding their cryptographic environments, identifying vulnerabilities and establishing risk-based migration plans. Equally important, they should use this transition as an opportunity to strengthen their enterprise architectures for continual adaptation.

Post-quantum readiness is not simply about replacing today’s vulnerable cryptographic algorithms. It is about building the enduring ability to change cryptography as threats, technologies and standards evolve.

The threat environment will not stand still. Neither can state government. The time to prepare is now.