GAO: 24 US agencies unprepared for quantum threats to digital identity

A GAO audit found that none of the 24 major federal agencies fully completed initial preparations to protect systems from quantum attacks, and none tested post-quantum cryptography in their own environments. Only one agency fully inventoried vulnerable cryptographic systems, and 18 reported lacking the needed expertise. Agencies face an October 22 deadline to submit migration plans to OMB.

• None of the 24 agencies tested post-quantum cryptography in their own IT environments
• Only one agency fully developed a prioritized inventory of vulnerable systems
• 18 agencies reported lacking cryptographic expertise to build inventories
• GAO issued 89 recommendations to 23 agencies; signature migration due by 2031