In Simple Terms
A powerful future computer might be able to unlock some information that is protected today. An attacker could steal encrypted data now and keep it until that becomes possible. Governments and the military need to find where they rely on older protections and replace them carefully, without interrupting essential work. Some of their most important systems face a deadline at the end of 2030.
The Risk Begins Before the Breakthrough
Many digital communications and files are protected by mathematical methods that make them extremely difficult to read without the right key. Advances in quantum computing have raised the possibility that a sufficiently powerful quantum computer could eventually break some of the methods in use today. That does not mean all encrypted data is exposed now, or that anyone knows exactly what capabilities potential adversaries have. The timing and scale of any change remain uncertain, which is why preparing early matters.
At the TechNet Indo-Pacific conference in Honolulu, Matt McFadden, vice president of cyber at GDIT, described a threat often summed up as “harvest now, decrypt later.” An attacker following this approach would not need to read stolen data right away. They could save copies and wait for their tools to improve. Sensitive information may remain valuable for years, so delaying the moment when stolen data can be read does not make the loss harmless to the organization that once held it.
How much a breach matters can depend on how long the data remains useful and sensitive. Information that quickly loses its value may not pose the same risk as records that must remain secret for a long time. Organizations therefore need to ask more than whether their systems are protected today. They also need to consider how long their information must stay secure—and whether a hostile party might keep encrypted copies until it can decipher them.
McFadden noted that the extent of US adversaries’ progress in this area is not fully known. That uncertainty is not evidence that every adversary already has a quantum computer capable of breaking encryption. It does, however, leave organizations planning for a possibility with potentially serious consequences. Waiting for complete certainty could leave too little time to change the complex systems that support communications, services, and military operations.
What Does Quantum-Resistant Encryption Mean?
Post-quantum cryptography is a term for a collection of mathematical algorithms intended to protect networks and systems against attacks that could use quantum computers. The goal is not to make every organization use a quantum computer. It is to update the protections that existing systems rely on, so they are not left vulnerable to a new way of solving computational problems.
This transition involves more than simply installing a new program. Encryption is woven into many parts of digital infrastructure. It may be used to establish the keys that let two parties exchange data securely, or to create digital signatures that help confirm where a file or message came from and whether it has been altered. Different components may therefore need different algorithms, and organizations first need to know where encryption is used before they can decide what to update and in what order.
The US government set federal deadlines for this work in an executive order issued on June 22. Under the schedule it established, high-value assets and high-impact systems should use post-quantum cryptography for key establishment no later than December 31, 2030. The deadline for using it with digital signatures is 2031. The different dates show that the transition is not being treated as a single change that applies to every cryptographic function at once.
These dates are more than milestones on a technology calendar: they mean that the organizations concerned must begin well ahead of time. Assessments, planning, and coordination with vendors may need to happen in stages, and some systems cannot be changed easily or without testing. The later an organization discovers that an important system depends on a particular encryption method, the less time it has to address that dependency before the deadline.
Start With an Inventory: You Can’t Update What You Don’t Know You Have
One of the first obstacles begins with a deceptively simple question: what needs protection and updating? An organization may not have a complete picture of all the applications, devices, and networks that use encryption, or of the certificates associated with them. McFadden warned that the transition is difficult to carry out when an organization does not know what it has. He described building a comprehensive inventory as a foundational step, not an administrative task that can be put off until the end of the project.
That inventory should identify the relevant parts of the technical environment, show where encryption is present and how it is used, and record which certificates applications, devices, and networks rely on. The list is useful for more than counting assets: it helps decision-makers see how those assets are connected. Updating one application, for example, may depend on a device, a network, or a service supplied by an outside party. Treating that application as if it existed in isolation would not be enough.
Knowing what assets an organization has also helps it set priorities. It may need to distinguish a high-value system from one with a smaller impact, as well as information that must remain secret for many years from information whose value changes quickly. This understanding helps direct effort toward systems where a breakdown or data exposure could have the greatest consequences. But prioritizing does not replace the need for a complete picture: a critical dependency may be a small component that goes unnoticed unless the relationships among systems are examined.
Reliance on outside vendors is another challenge that can emerge quickly. An application or device may contain components the organization does not directly control, and making a change may require information or updates from the company that supplies it. McFadden therefore called for system owners to work with external vendors and supply chains, and for organizations to establish a governance team to drive compliance and oversee preparations for change.
Cryptographic Agility Without Disrupting the Mission
Choosing a new algorithm is not enough if replacing it later would be extremely difficult. That is why cryptographic agility matters: the technical environment should be designed so it can switch from one encryption method to another when needed, while systems continue to perform their jobs. Col. Tasika Davis, director of cyber operations and warfighter communications at US Air Forces in Europe, described the quantum transition as an additional threat to account for when designing a resilient architecture.
Agility does not mean changing security protections on a whim. It means avoiding dependence on a single option that would be hard to replace. If an algorithm or component needs an update, the organization should be able to make the change in an orderly way without losing communications or undermining the system’s ability to do its job. That concern is especially important in environments where a lengthy outage or a sudden drop in performance is unacceptable.
Building that flexibility starts with understanding the entire technical environment, not looking at one device or application in isolation. A system’s components may be spread across different networks, services, and organizations, and a change in one part can affect others. Davis therefore emphasized assessing the environment as a whole in light of potential threats, then planning a coordinated response across an integrated architecture. This broader view helps prevent an update to one component from creating operational problems in another component that depends on it.
The challenge becomes more complex when the platforms that need updating are not fixed in one place for long periods. Changing protections on a mobile or distributed platform calls for a different approach from updating a stable, centralized environment. Planning must account for keeping communications available and enabling the system to continue its mission during the transition. There is no quick fix for this challenge, but it makes clear why preparing cannot be reduced to buying a program or announcing a deadline.
A Whole-of-Organization Effort
Because encryption may be built into applications, devices, and networks managed by different groups, the transition cannot be left to the cybersecurity team alone. System owners need to understand what their systems rely on, vendors need to provide the necessary information and updates, and supply chains need to be part of the plan. Without that cooperation, an organization may be held up by a component whose details it does not have or that it cannot change on its own.
A governance team can assign responsibilities, track inventory work, connect priorities to the deadlines, and make sure updates fit operational needs. Having a clear coordinating group can also reveal dependencies among parts of the digital infrastructure, rather than leaving each team to work from a separate list that does not connect with anyone else’s plans. This is especially important when an external vendor supplies a component that cannot be replaced quickly.
Even with careful planning, organizations must balance two goals: strengthening security and keeping systems operational. A change that improves protection but disrupts an essential mission does not fully achieve its purpose. At the same time, avoiding changes to preserve continuity could leave information exposed to future risks. The answer is a phased transition, guided by an understanding of assets and threats, that allows organizations to make and test changes without harming critical functions.
The deadlines—December 31, 2030, for key establishment and 2031 for digital signatures—give organizations a clear timetable, but they do not automatically resolve the technical and organizational complexities. Serious preparation begins with understanding what an organization uses today, identifying what needs to change, and coordinating with every party that controls part of the solution. The clearer that picture is, the less the transition will depend on surprises and the better positioned the organization will be to protect both its data and its missions.
The Bottom Line
Preparing for the age of quantum computing is not a matter of waiting until today’s encryption can be broken. It is a planning race that starts before that point. The possibility that encrypted data could be collected now and deciphered later makes the information’s useful lifetime an important security concern, even though adversaries’ capabilities and the timing of their advances remain uncertain. The US government has set deadlines: December 31, 2030, for using post-quantum cryptography in key establishment for high-value assets and high-impact systems, and 2031 for digital signatures. Meeting those goals will require a thorough inventory of applications, devices, networks, and certificates; cooperation with vendors and supply chains; and flexible systems that can be updated without disrupting missions. As the warnings raised in Honolulu make clear, the first step is knowing what an organization has and what its work depends on. A transition cannot be well managed if critical parts of the system remain unknown.