The US Government Accountability Office (GAO) reported that none of the 24 major federal agencies have fully implemented three key measures for transitioning to post-quantum cryptography. Only one agency completed an inventory of vulnerable systems, while 22 others did so only partially. Eighteen agencies cited a shortage of qualified cryptographers, and only six have initiated staff training programs.
Agencies also struggled with cost assessments and testing. While 21 departments prepared estimates for the transition, all were incomplete. No agency has successfully tested new algorithms in their environment, with 16 citing that vendors are still integrating new standards. The Office of Management and Budget previously estimated the transition cost at $7,1 billion for the 2025–2035 period.
The GAO warns of the 'harvest now, decrypt later' threat, where encrypted data is stored for future decryption by quantum computers. Experts estimate a 50% or higher probability of quantum machines capable of breaking current encryption appearing by 2040. The audit covered the period from February 2024 to September 2025 and included 89 initial recommendations.
In June 2026, President Donald Trump issued an executive order requiring federal agencies to accelerate the adoption of NIST-approved post-quantum cryptography. Critical systems must transition to new key establishment mechanisms by the end of 2030. Each agency is now required to appoint a dedicated official to oversee the migration process.
