The answer, up front
Federal momentum on quantum technology does not start with hardware purchases. It starts with a question most organizations cannot yet answer: where does quantum-vulnerable cryptography live in our systems? Until you can answer it with evidence, any quantum adoption plan stays a strategy on paper 1, 2.
Last verified: Sep. 30, 2026.
Why government momentum becomes your accountability problem
When governments move from intent to execution, curiosity gives way to requirements. Audits follow. Evidence requests arrive. Deadlines appear.
The U.S. has already reached that stage on cryptography. Executive Order 14412 directs agencies to identify a post-quantum migration lead within 30 days 2. OMB's memo M-26-15 sets phase one, strategy, planning, and discovery, for 2026 to 2027 and focuses it on inventory 1. Agency plans are due 120 days after the memo, which is Oct. 22, 2026 1.
The order also tells the federal acquisition rulemaking council to propose a rule within 180 days, with contractor compliance by Dec. 31, 2030 2. If you sell to agencies, expect these questions to reach you through contracts. The details of each deadline are in Global Mandates and Deadlines.
Announcing adoption is easy. Proving readiness is hard.
Anyone can announce a quantum initiative. Proving readiness takes evidence. Expect pointed questions:
- Where do we still rely on algorithms that a quantum computer could break?
- Who owns each one, and is the fix ours or a supplier's?
- Can we show current, machine-readable evidence, not last year's spreadsheet?
For many organizations, the honest answers sit in spreadsheets, tribal knowledge, and inventories that no longer match reality. That gap is where quantum initiatives stall.
Cryptography is the first fault line
Government roadmaps agree on one point: you cannot migrate what you cannot inventory. The U.S. puts inventory in its first phase 1. Canada's federal roadmap makes identification a core phase 4. The UK NCSC sets 2028 as the point by which large organizations should finish a discovery exercise 5. CISA published a strategy for automated discovery and inventory tools for the same reason 3.
The standards side is settled. NIST approved FIPS 203, 204, and 205 on Aug. 13, 2024, giving you algorithms to migrate to 6. What remains is finding what to replace.
That is harder than it sounds. Cryptography embeds itself in legacy systems, microservices, third-party libraries, internal tools, and forgotten code paths. Public-key algorithms such as RSA and elliptic-curve cryptography often sit inside authentication flows, APIs, build pipelines, and vendor dependencies. Manual discovery does not scale to that complexity, and it does not produce audit-grade evidence. The Seven Places Quantum-Vulnerable Cryptography Hides shows where to look first.
What this means for executives and the board
ArcQubit guidance: treat quantum readiness as a governance item, not a technology purchase.
- Ask for the exposure number. What share of our cryptography is quantum-vulnerable, and how do we know?
- Fund the long-lead work first. Inventory, evidence, and migration planning cannot compress into one budget cycle.
- Assign an accountable owner. One named executive, with security engineering behind them.
- Separate what you fix from what suppliers fix. Supplier-owned cryptography needs a vendor conversation, not an engineering ticket.
Decisions for the next 90 days
- Set the scope. Start with high-value systems and data that must stay confidential for many years. OMB starts there too 1.
- Choose a discovery method. Combine automated scans with supplier evidence and manual review. Automation reduces effort but cannot reach everything.
- Agree on the evidence format. Pick a structured, machine-readable record that auditors and governance tools can read. The cryptographic inventory guide covers the fields.
- Start imperfect. Canada advises beginning with an initial, incomplete inventory and improving it over time 4.
Questions to ask your team this week
- Can we list every place we use RSA or elliptic-curve cryptography? How current is that list?
- Which findings belong to suppliers, and have we asked them for post-quantum roadmaps?
- If an auditor asked for evidence tomorrow, what would we hand over?
- Who owns the answer when the list changes?
A worked example
Consider a regional services firm preparing for a federal contract renewal. The buyer asks how the firm will meet post-quantum requirements. The security team has a vendor list and a certificate spreadsheet, but no record of algorithms inside its own applications or third-party libraries.
The team runs discovery on its customer portal first, because that system holds long-lived data. The scan finds RSA key exchange in an old integration, an elliptic-curve signature in a build pipeline, and a vendor SDK with no post-quantum plan. Each finding gets an owner and a priority.
The firm now answers with facts: what it found, what it will fix, and which vendors it has asked for a timeline. This example is illustrative, not a real engagement.
Common mistakes
- Buying before mapping. Hardware or platform spend does not reduce exposure you have not found.
- Waiting for a mandate. Readiness is long-lead work. Late starters discover that inventory and evidence cannot be rushed.
- Treating one scan as the inventory. Systems and vendor software change. Plan to rescan.
- Ignoring supplier-owned cryptography. Your migration ends when your suppliers finish.
Once readiness exists, adoption gets deliberate
With cryptographic visibility in place, you can make sound choices about the rest: which quantum providers to evaluate, how to keep integrations vendor-agnostic, and how to balance work across classical and quantum systems. That strategic work depends on readiness, not the reverse. Discovery is the foundation. See the Migration Roadmap for what comes next.
How ArcQubit approaches it
This box describes ArcQubit's own method. Keep it separate from the guidance above.
ArcQubit's QuCode is enterprise discovery and inventory, sold directly by ArcQubit as fixed-scope work. It produces a Quantum Exposure Report, a ranked list in which each finding names the software, algorithm, location, exposure score, and whether your team or a supplier has to fix it. Findings map to NIST FIPS 203, 204, and 205. QuTrust then serves as the migration system of record, keeping the roadmap and evidence current. The AI & Quantum Consulting team supports the strategic side through expert-led engagements.