US Agencies Face Gaps in Quantum Readiness

A recent audit report from the Government Accountability Office (GAO) found that none of 24 major US federal agencies had completed initial preparations for quantum threats, highlighting risks to the cryptography protecting digital credentials and identity authentication systems[1].

Published on 6 October and revised on 14 October, the report assesses three areas: inventories of vulnerable cryptographic systems, funding assessments and testing of post-quantum cryptography (PQC). Only one agency had fully addressed the inventory requirements, and none had tested PQC in its operating environment.

The GAO identified shortages of cryptographic expertise, inadequate inventory processes and shortfalls in funding as the principal reasons for lack of progress.

For identity systems, the threat extends beyond the confidentiality of encrypted information. The GAO explains that a sufficiently capable quantum computer could enable attackers to derive private keys from public keys, forge authentication certificates and impersonate users. This could undermine the cryptographic trust supporting digital credentials and access controls.