The answer, up front
Operational technology faces the hardest post-quantum migration of any environment, and the systems at risk run power grids, water plants and factory lines. In late October 2024 CISA, with the Department of Homeland Security, published "Post-Quantum Considerations for Operational Technology," warning that long equipment lifecycles, slow patching cycles, strict safety testing and end-of-life operating systems make OT far harder to move than ordinary IT 1. The practical message for operators is to segment networks, build crypto agility into new platforms, protect remote access first, and begin cryptographic inventories now 1.
Why OT is the hard case
Operational technology uses less encryption than IT, but it stays exposed through its links to IT networks and through specific critical functions 1. The obstacles are structural. Industrial equipment can have a service life measured in decades, patching windows are rare and tightly controlled, safety rules require extensive retesting after any change, and much of the installed base runs operating systems that are no longer supported 1. A control system bought today may still be in service when quantum risk becomes real, so purchasing decisions now carry long-term exposure.
What CISA recommends
CISA's recommendations are advisory, not a mandate 1. They include segmenting OT networks to limit how far an attacker can move, building crypto agility so algorithms can change without replacing infrastructure, protecting remote access points first, layering classical and post-quantum protections during the transition, writing a transition roadmap, and adopting the NIST post-quantum standards finalized in August 2024 1, 3. Practitioners disagree on urgency, which operators should weigh against their own risk: some argue the quantum threat is real and present, while others say OT teams have more immediate security gaps to close first 1.
A gap worth noting
CISA's January 2026 list of product categories that should support post-quantum cryptography explicitly leaves OT and IoT devices outside its current scope 2. In plain terms, the buyer's checklist that federal agencies will use does not yet cover the industrial devices most exposed to the migration problem. Operators cannot assume a vendor's product is covered simply because it appears post-quantum ready in other categories.
What this means for operators
Owners and operators of industrial control systems and SCADA in energy, water and wastewater, and manufacturing should treat long equipment lifecycles as the central planning fact. The two steps available today need no vendor or finished standard: locate where cryptography is used across the environment, and build crypto agility requirements into new equipment purchases so future algorithm changes do not require ripping out hardware.
How ArcQubit approaches it
ArcQubit treats discovery as the first move in any OT environment, because an operator cannot protect cryptography it cannot see. QuCode builds the cryptographic inventory across IT and OT surfaces, and QuTrust holds the prioritized migration plan so segmentation, remote-access hardening and phased upgrades proceed in a defensible order rather than all at once.