CISA, NSA and NIST urge organizations to start quantum-readiness planning
21 AUGUST 2023, ARLINGTON
CISA, the NSA and NIST jointly published the factsheet "Quantum-Readiness: Migration to Post-Quantum Cryptography." CISA's alert announcing it describes the audience as organizations in general, with particular emphasis on those that support critical infrastructure, and says they should begin early planning for migration to post-quantum cryptographic standards.
The alert lists four recommended actions: create a quantum-readiness roadmap, conduct a cryptographic inventory, perform risk assessment and analysis, and engage with technology vendors. Security Magazine, writing on 29 August 2023, adds that the factsheet advises assessing supply-chain reliance on quantum-vulnerable cryptography and reviewing NIST's draft standards, and notes that NIST planned to release the first set of post-quantum standards in 2024. The factsheet does not define a numbered phase model.
Technology owners across the public and private sectors are affected, with critical infrastructure operators named first. The factsheet carries no legal mandate; it is guidance.
The standards NIST promised arrived on 13 August 2024. The federal requirements that formalize several of these steps, for example inventory and roadmap duties, appear in the 2026 OMB memorandum and executive order covered in other entries.
Why it matters. This is voluntary guidance, but it gives executives a simple four-step starting list: roadmap, inventory, risk assessment and vendor engagement. Later federal requirements formalized several of these steps, so organizations that follow the factsheet early should be better placed. Critical infrastructure operators should expect scrutiny of their progress.