[{"data":1,"prerenderedAt":139},["ShallowReactive",2],{"news-\u002Fnews\u002Fcisa-operational-technology-post-quantum":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":95,"date":96,"description":97,"draft":98,"extension":99,"faqs":8,"findingsSource":8,"geo":100,"image":8,"industries":102,"keyFindings":8,"meta":107,"modified":96,"navigation":108,"path":109,"pullquote":8,"recommendations":8,"references":110,"related":120,"seo":127,"seoTitle":128,"signposts":8,"slug":129,"stats":8,"stem":130,"tags":131,"tldr":137,"__hash__":138},"news\u002Fnews\u002Fcisa-operational-technology-post-quantum.md","CISA Warns Industrial Operators That Quantum Risk Hits Plant Systems Hardest","ArcQubit Team","",null,{"type":10,"value":11,"toc":86},"minimark",[12,17,29,33,42,46,61,65,72,76,79,83],[13,14,16],"h2",{"id":15},"the-answer-up-front","The answer, up front",[18,19,20,21,25,26,28],"p",{},"Operational technology faces the hardest post-quantum migration of any environment, and the systems at risk run power grids, water plants and factory lines. In late October 2024 CISA, with the Department of Homeland Security, published \"Post-Quantum Considerations for Operational Technology,\" warning that long equipment lifecycles, slow patching cycles, strict safety testing and end-of-life operating systems make OT far harder to move than ordinary IT ",[22,23,24],"span",{},"1",". The practical message for operators is to segment networks, build crypto agility into new platforms, protect remote access first, and begin cryptographic inventories now ",[22,27,24],{},".",[13,30,32],{"id":31},"why-ot-is-the-hard-case","Why OT is the hard case",[18,34,35,36,38,39,41],{},"Operational technology uses less encryption than IT, but it stays exposed through its links to IT networks and through specific critical functions ",[22,37,24],{},". The obstacles are structural. Industrial equipment can have a service life measured in decades, patching windows are rare and tightly controlled, safety rules require extensive retesting after any change, and much of the installed base runs operating systems that are no longer supported ",[22,40,24],{},". A control system bought today may still be in service when quantum risk becomes real, so purchasing decisions now carry long-term exposure.",[13,43,45],{"id":44},"what-cisa-recommends","What CISA recommends",[18,47,48,49,51,52,54,55,58,59,28],{},"CISA's recommendations are advisory, not a mandate ",[22,50,24],{},". They include segmenting OT networks to limit how far an attacker can move, building crypto agility so algorithms can change without replacing infrastructure, protecting remote access points first, layering classical and post-quantum protections during the transition, writing a transition roadmap, and adopting the NIST post-quantum standards finalized in August 2024 ",[22,53,24],{},", ",[22,56,57],{},"3",". Practitioners disagree on urgency, which operators should weigh against their own risk: some argue the quantum threat is real and present, while others say OT teams have more immediate security gaps to close first ",[22,60,24],{},[13,62,64],{"id":63},"a-gap-worth-noting","A gap worth noting",[18,66,67,68,71],{},"CISA's January 2026 list of product categories that should support post-quantum cryptography explicitly leaves OT and IoT devices outside its current scope ",[22,69,70],{},"2",". In plain terms, the buyer's checklist that federal agencies will use does not yet cover the industrial devices most exposed to the migration problem. Operators cannot assume a vendor's product is covered simply because it appears post-quantum ready in other categories.",[13,73,75],{"id":74},"what-this-means-for-operators","What this means for operators",[18,77,78],{},"Owners and operators of industrial control systems and SCADA in energy, water and wastewater, and manufacturing should treat long equipment lifecycles as the central planning fact. The two steps available today need no vendor or finished standard: locate where cryptography is used across the environment, and build crypto agility requirements into new equipment purchases so future algorithm changes do not require ripping out hardware.",[13,80,82],{"id":81},"how-arcqubit-approaches-it","How ArcQubit approaches it",[18,84,85],{},"ArcQubit treats discovery as the first move in any OT environment, because an operator cannot protect cryptography it cannot see. QuCode builds the cryptographic inventory across IT and OT surfaces, and QuTrust holds the prioritized migration plan so segmentation, remote-access hardening and phased upgrades proceed in a defensible order rather than all at once.",{"title":7,"searchDepth":87,"depth":87,"links":88},2,[89,90,91,92,93,94],{"id":15,"depth":87,"text":16},{"id":31,"depth":87,"text":32},{"id":44,"depth":87,"text":45},{"id":63,"depth":87,"text":64},{"id":74,"depth":87,"text":75},{"id":81,"depth":87,"text":82},"Analysis","2026-09-22","CISA guidance says operational technology faces the hardest post-quantum migration: long lifecycles, slow patching, legacy systems. What OT operators should do now.",false,"md",[101],"arlington",[103,104,105,106],"Cross-Sector","Critical Manufacturing","Energy","Water and Wastewater Systems",{},true,"\u002Fnews\u002Fcisa-operational-technology-post-quantum",[111,114,117],{"label":112,"url":113},"Industrial Cyber, \"DHS and CISA prescribe proactive steps toward post-quantum cryptography across OT environments,\" Oct. 29, 2024.","https:\u002F\u002Findustrialcyber.co\u002Fcisa\u002Fdhs-and-cisa-prescribe-proactive-steps-toward-post-quantum-cryptography-across-ot-environments\u002F",{"label":115,"url":116},"Infosecurity Magazine, \"CISA Releases List of Post-Quantum Cryptography Product Categories,\" Jan. 26, 2026.","https:\u002F\u002Fwww.infosecurity-magazine.com\u002Fnews\u002Fcisa-post-quantum-cryptography\u002F",{"label":118,"url":119},"National Institute of Standards and Technology, \"NIST Releases Finalized Post-Quantum Encryption Standards,\" Aug. 13, 2024.","https:\u002F\u002Fwww.hipaajournal.com\u002Fnist-releases-finalized-post-quantum-encryption-standards\u002F",[121,124],{"label":122,"url":123},"Seven Places Quantum-Vulnerable Cryptography Hides","\u002Fblog\u002Fseven-places-quantum-crypto-hides",{"label":125,"url":126},"Where to Start a PQC Migration","\u002Fblog\u002Fpqc-migration-where-to-start",{"title":5,"description":97},"CISA Warns OT Faces Hard Quantum Migration","cisa-operational-technology-post-quantum","news\u002Fcisa-operational-technology-post-quantum",[132,133,134,135,136],"critical infrastructure","operational technology","energy sector","cryptographic discovery","crypto-agility","CISA's guidance on post-quantum cryptography for operational technology warns that long equipment lifecycles, slow patching, and end-of-life systems make industrial migration the hardest, so operators should segment networks and start inventories now.","QvlgwHPTyv8biANoF9wqBrjhoFf7GHG7qNH8gZzy9is",1792182884925]