Quantum computing is often discussed as a technology of the future, but the federal government is already treating its cybersecurity implications as a present-day concern.

Congress and federal agencies have been preparing for a transition to post-quantum cryptography (PQC), security methods designed to withstand attacks from sufficiently powerful quantum computers.

The message is clear: organizations should not wait for quantum computers to become a practical cybersecurity threat before preparing for them.

How Federal Quantum Policy Shifted from Research Investment to Cybersecurity Preparedness

The National Quantum Initiative Act of 2018 established a framework for advancing quantum research and development across federal agencies, academia, and the private sector.

While initially focused on innovation and maintaining U.S. leadership in quantum technologies, federal attention increasingly shifted toward preparing for the cybersecurity risks those advancements could introduce.

The Quantum Computing Cybersecurity Preparedness Act of 2022 marked an important step, directing federal agencies to identify potentially vulnerable cryptographic systems and develop plans for transitioning to post-quantum protections.

Why Is Quantum Computing a Threat to Modern Encryption?

Much of today's digital security depends on encryption that protects sensitive information, communications, financial transactions, and critical infrastructure. Certain widely used cryptographic methods rely on mathematical problems that conventional computers cannot solve efficiently.

Sufficiently powerful quantum computers could eventually solve some of those problems, leaving certain existing security methods vulnerable.

What is “Harvest Now, Decrypt Later”?

One major concern is known as “harvest now, decrypt later.”

Under this approach, attackers collect encrypted information today and store it in hopes that future quantum capabilities will allow them to decrypt it.

That creates a present-day risk for information that must remain confidential for years, including:

• Sensitive government information
• Intellectual property and trade secrets
• Research and development data
• Health records and other long-lived data

Preparing for quantum cybersecurity cannot begin the day quantum computers become capable of breaking existing encryption.

Federal Action on Post-Quantum Cryptography Is Accelerating

Congress

Congressional attention has continued through proposals such as the Quantum Encryption Readiness and Resilience Act, which seeks to evaluate quantum capabilities, identify vulnerable sectors, assess adoption of post-quantum protections, and develop mitigation strategies.

The Executive Branch

The executive branch has also accelerated preparations.

• In June 2026, Executive Order 14413, "Ushering in the Next Frontier of Quantum Innovation," directed federal agencies to advance quantum research, commercialization, workforce development, and domestic supply chains.
• Issued the same day, Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," addressed cybersecurity more directly. It established an accelerated federal transition to post-quantum cryptography, including migration requirements for certain high-value federal systems and additional guidance for federal contractors.

Key Executive Order 14412 Deadlines

These actions demonstrate that federal quantum policy is addressing not only technological innovation, but also how to protect existing systems and sensitive information as quantum capabilities advance.

Federal Guidance: The Transition Has Already Begun

The National Institute of Standards and Technology (NIST) has finalized three post-quantum cryptography standards designed to protect communications and digital signatures against attacks from sufficiently capable quantum computers.

NIST encourages organizations to begin implementing these standards now rather than waiting until existing encryption becomes vulnerable.

The agency's National Cybersecurity Center of Excellence is also developing practical migration guidance focused on identifying cryptography across organizational systems, assessing risk, and supporting the transition to quantum-resistant technologies.

For organizations, this does not mean replacing every encryption system tomorrow. It means understanding which systems, applications, devices, and vendors depend on cryptographic methods that may eventually need to change. The first step is knowing what needs to change.

What Should Organizational Leaders Be Doing Now? Five Steps for Organizational Leaders

Quantum readiness does not need to begin with a major technology purchase. It should begin with a conversation among leadership, cybersecurity, information technology, procurement, and other departments responsible for sensitive information and critical systems.

1. Understand where your organization uses encryption. Ask whether your technology teams have identified the systems, applications, devices, and services that depend on cryptography. Start with critical operations and sensitive information.
2. Identify information needing long-term protection. Consider which information would remain sensitive ten or twenty years from now, particularly intellectual property, research, government information, and certain personal records.
3. Ask vendors about quantum readiness. Organizations depend on encryption embedded in software, cloud services, communications platforms, and devices. Ask vendors whether they have a post-quantum transition roadmap and how future updates will be supported.
4. Build flexibility into future technology investments. Consider cryptographic agility, the ability to update cryptographic methods without rebuilding an entire system, when evaluating new technologies and long-term investments.
5. Assign ownership and build a roadmap. Identify who will track federal guidance, coordinate with vendors, prioritize critical systems, and incorporate quantum readiness into existing cybersecurity and modernization plans.

The goal is not to predict when quantum computers will become capable of breaking today's vulnerable encryption. It is to avoid discovering years from now that the organization must replace critical technology without having planned or budgeted for the transition.

Federal Post-Quantum Cryptography Resources & Guidance

Organizations do not have to develop their quantum-readiness strategies from scratch. NIST provides standards and practical resources to support the transition.

• NIST: Post-Quantum Cryptography: An overview of finalized standards, migration guidance, and developments in quantum-resistant cryptography.
• National Cybersecurity Center of Excellence: Migration to Post-Quantum Cryptography: Practical guidance on identifying vulnerable cryptographic systems, assessing risk, and planning migration.
• NIST: Post-Quantum Cryptography Standardization: Information about the federal standards supporting the transition to quantum-resistant cryptography.

Looking Ahead: Post-Quantum Migration is a Multiyear Effort

The transition to post-quantum cryptography will be a multi-year effort. Organizations that begin preparing now can incorporate quantum readiness into existing cybersecurity programs, technology replacement cycles, vendor relationships, and long-term investment decisions.

The federal government has already moved from discussing quantum cybersecurity risks to establishing standards and directing implementation.

Quantum computing may still be developing, but the work to protect our information from its future capabilities has already begun.

How Ice Miller Can Help

Ice Miller's Tech, Privacy & Cyber Risk and Government Contracts teams help organizations understand evolving federal cybersecurity requirements. That includes assessing post-quantum readiness, reviewing vendor contracts and building practical transition roadmaps. Contact our team.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.