The Government Accountability Office told lawmakers that the Office of the National Cyber Director should lead policy and initiatives related to securing systems from post-quantum computing threats.
In its report to Congress published publicly on Tuesday, GAO said assigning the ONCD as a centralized office for quantum efforts would lead to better-defined roadmaps that allocate resources and hold participants accountable.
GAO Identifies Shortcomings in Current PQC Strategies
The congressional watchdog noted in its report that various documents issued over the past several years to counter quantum threats have identified three central goals, but also presented challenges.
The key goals that GAO identified based on its review of various strategy documents are:
- Standardize post-quantum cryptography for conventional and quantum computers
- Migrate government systems to PQC
- Encourage all economic sectors to prepare for quantum computing threats
GAO noted that the documents it reviewed do not fully define a strategy to counter quantum threats. For instance, the documents do not establish performance measures for all three goals.
During her appearance in front of Congress on Tuesday, Marisol Cruz Cain, the agency’s director of information and cybersecurity, explained to legislators that while critical infrastructure operators know the risks associated with quantum computing, there are no documented impacts specific to federal government operations.
“Unless we have done a complete risk assessment to find out where our vulnerabilities are and the threats that they pose and how to mitigate it, we are not even prepared to start to protect our systems and transition them to PQC,” the official revealed.
GAO attributed the issues to the lack of a single federal organization to provide oversight and coordination across all quantum efforts.
Cruz Cain also highlighted the importance of confirming a new national cyber director to be in charge of developing and implementing national strategies and ensuring that federal agencies are aware of what needs to be done to strengthen security against quantum computing.
