Federal IT Buyers Told to Expect PQC by Default

The U.S. cyber defense agency is telling federal agencies to prioritize quantum readiness in newly released guidance advising agencies to add post-quantum encryption capabilities to procurement requirements for cloud services, collaboration tools, networking infrastructure and endpoint security.

See Also: New Trend in Federal Cybersecurity: Streamlining Efficiency with a Holistic IT Approach

The Cybersecurity and Infrastructure Security Agency on Friday published the first of what it described as a series of guidelines intended to steer agencies toward quantum-resistant technologies. The initial guidance focuses on identifying broad technology product categories where post-quantum cryptography support is already available or expected to mature quickly.

A CISA official told Information Security Media Group the agency plans to “update the product categories list periodically as needed” with new government and industry trends as products increasingly incorporate post-quantum cryptography. Experts said vendors should use the initial publication as a baseline to begin immediately embedding post-quantum requirements into product roadmaps and long-term support plans rather than waiting for product-level mandates.

“It is a difficult tightrope for CISA to walk,” said Crick Waters, CEO of quantum cybersecurity firm Patero. The agency must balance a need to publish a manageable, high-level product category list while still giving agencies and engineers enough direction to identify concrete post-quantum solutions they can actually deploy (see: Trump Cybersecurity EO Scrambles Post-Quantum Preparation).

CISA’s initial categories include cloud services, web software, networking hardware and software, as well as endpoint security technologies. Officials said the categories reflect where cryptography serves as a foundational component of authentication, encrypted communications and system integrity across federal environments.

Analysts said the wide variety of categories appears to be intentional, so agencies can have flexibility while signaling where post-quantum capabilities should be treated as a baseline expectation for public sector IT products and services. Agencies that begin embedding post-quantum requirements into contracts now, they said, are far less likely to face rushed retrofits or procurement gaps.

The guidance also lays the groundwork for future compliance with National Security Memorandum-10 and federal post-quantum migration mandates, according to public-sector cybersecurity analysts. Those call for agencies to inventory cryptographic systems, prioritize systems most exposed to “harvest now, decrypt later” risks and complete enterprise-wide migration of vulnerable cryptography across networks by 2035.

Some analysts warned that while federal guidance and standards establish a framework for post-quantum adoption, many products remain immature, costly, invalidated or dependent on broader ecosystem readiness, complicating real-world integration. Misinterpreting inventory listings as deployment-ready solutions could lead to delays, insecure configurations or compliance failures if agencies fail to account for crypto-agility, vendor coordination and end-to-end validation, said Eric Adolphe, founder and CEO of Forward Edge-AI.

“While product inventories may list PQC-enabled capabilities, these often require manual configuration, lack validation and fail to ensure seamless operation within diverse, legacy-rich environments,” said Adolphe. He said CISA should provide clear technical specifications, validated product registries and interoperability guidance tailored to government procurement needs to make the product category list actionable.

“Without this, buyers face ambiguity in selecting truly compliant, deployment-ready solutions,” he added.

CISA did not provide a timeline for releasing a product-level list or additional technical criteria, but officials said the agency expects the guidance to evolve as post-quantum implementations stabilize.