US GAO warns agencies lack quantum defences for digital identity

None of the federal government’s 24 major agencies had fully completed the initial preparations needed to protect their systems against future quantum computing attacks, and none had tested quantum-resistant cryptography in their own IT environments, according to a Government Accountability Office (GAO) audit. The findings raise concerns about the security of federal identity and authentication systems, digital credentials, and sensitive government information as agencies approach an October 22 deadline to submit plans for transitioning to post-quantum cryptography. The 60-page audit found widespread failures to identify vulnerable cryptographic systems, develop reliable funding estimates, and test replacement technologies. GAO’s findings are based on an earlier investigation that produced a sensitive report in September 2025 which was reissued with revisions this week. GAO evaluated the 24 agencies covered by the Chief Financial Officers Act against three preparatory practices drawn from Office of Management and Budget (OMB) guidance. The results showed that only one agency had fully developed a prioritized inventory of vulnerable cryptographic systems. Twenty-one had partially completed their inventories, one had minimally addressed the requirement, and another had not addressed it. None had fully completed assessments of the funding needed to transition to quantum-resistant systems. Twenty-one had produced incomplete assessments, while three had not prepared any. The findings were particularly stark for testing. Twenty-three agencies had not addressed either of GAO’s two testing activities. The remaining agency conducted market research to identify potential vendor implementations but had not tested post-quantum cryptography in its operating environment. GAO also found that 18 agencies reported lacking the cryptographic expertise needed to develop their inventories and had not established plans to close those workforce gaps. The shortcomings extended to the information agencies maintained about their own technology. Most inventories failed to identify all high-value assets or high-impact systems, while a majority did not account for certain systems containing information expected to remain mission-sensitive in 2035 or systems providing access control through public-key infrastructure. Some agencies also lacked accurate information about the cryptographic algorithms, software, operating systems, and hosting environments supporting their systems. Without this information, agencies cannot reliably identify which technologies must be upgraded, which require replacement, or how to prioritize systems containing sensitive information. The implications extend beyond the confidentiality of encrypted data to the infrastructure used to establish and verify digital identities. GAO warned that a sufficiently powerful quantum computer could compromise systems that authenticate users, machines, and software by defeating widely used public-key cryptography. An attacker could potentially derive a server’s private cryptographic key from its public key, forge authentication certificates, and impersonate privileged users to gain access to sensitive systems. The resulting access could allow unauthorized modification, destruction, or collection of government information. Such vulnerabilities are especially relevant to federal identity and access management systems, which rely on digital certificates and cryptographic signatures to verify credentials and authorize access to government facilities and information systems. The threat is not that quantum computers would directly defeat fingerprint or facial recognition technology, but rather that they could compromise the cryptographic protections used to authenticate credentials, establish trusted communications, and verify the integrity of digitally signed identity and biometric records. GAO specifically identified logical access controls that can authenticate individuals using personal identification numbers, cards, biometrics, or other tokens. The potential consequences extend to Personal Identity Verification (PIV) credentials, which incorporate biometric information alongside cryptographic keys and certificates. GAO also emphasized the threat known as harvest now, decrypt later, in which adversaries collect and preserve encrypted communications today for possible decryption once sufficiently powerful quantum computers become available. Although no cryptographically relevant quantum computer is known to exist, GAO said some industry experts believe one could emerge as soon as the 2030s, although estimates vary widely. The risk is especially consequential for government information that must remain confidential for decades. The audit comes as agencies face more demanding obligations under the Trump administration’s June 2026 executive order on advanced cryptographic attacks and accompanying OMB Memorandum M-26-15. The memorandum requires agencies to submit migration plans to OMB and the Office of the National Cyber Director within 120 days of its June 24 issuance, establishing an October 22 deadline. It directs agencies to prioritize high-impact systems, high-value assets, sensitive information, and cryptographic access controls. The government’s migration schedule calls for planning and discovery through 2027, pilot programs and early deployments through 2028, and migration of prioritized systems to post-quantum key establishment by the end of 2030. Digital signature migration for those priority systems is scheduled for 2031, with remaining systems targeted for completion by 2035. The memorandum does not apply to national security systems, which are governed separately. The newly revised audit report does not determine whether the agencies have corrected the specific deficiencies identified in the earlier review. GAO made 89 recommendations to 23 agencies in its sensitive report, addressing such deficiencies as incomplete inventories, inadequate funding assessments, and missing transition processes. The recommendations also involved the Cybersecurity and Infrastructure Security Agency. Twelve agencies agreed with GAO’s recommendations, two partially agreed, seven neither agreed nor disagreed, and one disagreed with three of its four recommendations. The Department of the Interior did not respond to the original report.