Federal Agencies Unprepared for Quantum Cyber Threats, GAO Reports

• •GAO found zero out of 24 federal agencies prepared for quantum threats.
• •A cryptographically relevant quantum computer could emerge by the 2030s.
• •The GAO issued 89 recommendations to improve agency readiness for quantum cryptography.

The Government Accountability Office (GAO) has reported that none of the 24 federal agencies reviewed are fully prepared for the impending threat posed by quantum computers capable of breaking current encryption methods. The report highlights that agencies have not established necessary inventories of vulnerable cryptographic systems or developed plans for transitioning to quantum-resistant cryptography. Experts estimate that a cryptographically relevant quantum computer (CRQC) could be developed as soon as the 2030s, posing a significant risk of data compromise. The GAO made 89 recommendations to improve agency readiness, but noted that agencies lack expertise, processes, and funding assessments for post-quantum cryptography (PQC). The report is a public version of a sensitive document released in September 2025, which did not reflect recent agency actions. The risks include potential data harvesting by malicious actors, who could decrypt sensitive information once a CRQC becomes available.