- CISA and a working group are urging organizations to begin transitioning to post-quantum cryptography
- The groups identify five priorities, including raising awareness, developing national strategies and advancing R&D.
- Explore emerging cyber threats at the 2026 Homeland Security Summit on Nov 10
The Cybersecurity and Infrastructure Security Agency and the G7 Cybersecurity Working Group are urging governments and organizations to begin transitioning to post-quantum cryptography, or PQC.
The threat posed by quantum computing is forcing government agencies to rethink how they protect sensitive information and critical systems.
As DHS continues to prioritize cyber defense and homeland security technology, the transition to post-quantum cryptography is becoming an increasingly important component of federal cybersecurity. The 2026 Homeland Security Summit will bring together government and industry leaders to discuss emerging cyber threats, technology modernization and strategies for strengthening the nation’s security posture. Register your spot for the event.
Why Is CISA Calling for Post-Quantum Cryptography Action?
CISA warned Thursday through its Preparing for the Post-Quantum Era: A Call to Action publication that advances in quantum computing could eventually enable cryptographically relevant quantum computers to break public-key cryptography currently used to protect digital infrastructure.
While the timeline for such quantum computers remains uncertain, the groups said the potential threat should no longer be treated as distant. Instead, governments and businesses should begin planning their PQC migrations to avoid exposure to quantum threats while providing long-term protection of confidential data.
In addition to quantum-related risks, the groups warn that delaying migration could cause organizations to lose competitive advantages or potentially face exclusion from certain contracting opportunities, including public procurement.
What Does CISA Recommend for PQC Migration?
CISA and the G7 Cybersecurity Working Group recommend that organizations adopt a phased, risk-based approach to post-quantum cryptography migration, beginning with identifying critical data and assets, inventorying cryptographic assets, mapping dependencies, and developing a transition plan. The groups also recommend incorporating quantum-safe capabilities into routine technology refresh cycles and purchasing products that integrate PQC protections where possible.
The joint call to action identifies five priority areas to accelerate the transition: raising awareness, developing national strategies, advancing research and development, strengthening public-private partnerships, and integrating PQC into cybersecurity requirements.
How Are Federal Agencies Advancing Post-Quantum Cryptography?
Federal agencies are already taking steps to prepare their systems for the post-quantum era. The Department of War is seeking commercially available, software-based encryption capabilities that can support its PQC transition without requiring hardware changes, with implementation targeted by Dec. 31, 2029.
The Federal Aviation Administration is also seeking industry support to transition the National Airspace System, including air traffic control infrastructure and IT and business systems, to PQC. The effort includes a focus on crypto-agile security but also highlights challenges involving legacy infrastructure, system compatibility and vendor capabilities.
At the government-wide level, a June 2026 executive order directed federal agencies to accelerate the transition to PQC, designate migration leads and develop plans for high-value assets and high-impact systems. The order also tasked NIST with providing implementation guidance and launching a pilot migration project.
