CISA warns that industrial systems face special obstacles in post-quantum migration
OCTOBER 2024, ARLINGTON
CISA published "Post-Quantum Considerations for Operational Technology" in late October 2024. The CISA page itself carries no date; Industrial Cyber reports it on 29 October 2024. Operational technology (OT) means the systems that run physical processes such as power grids and factory lines.
The paper warns that OT faces particular obstacles in moving to post-quantum cryptography. According to Industrial Cyber, these include legacy equipment with decades-long lifespans, long patching cycles and strict safety testing, widespread use of end-of-life operating systems, and hardware that is hard to replace in live operations. Industrial Cyber reports these recommendations: segment OT networks to limit attacker access, build crypto agility (the ability to change algorithms without replacing infrastructure) into new platforms, protect remote access points first, layer classical and post-quantum protections, begin inventory and planning now, adopt zero trust architecture, and pilot post-quantum and hybrid approaches. Organizations should write their own transition roadmaps and use the NIST algorithms released in 2024. Owners and operators of industrial control systems and SCADA in energy, utilities, manufacturing, transportation and healthcare are affected, along with OT vendors and manufacturers.
Industrial Cyber quotes two practitioners with sharply different views. Tom Marsland of Cloud Range said the quantum threat to existing cryptography is real. John Terrill, chief information security officer at Phosphorus, called the paper "just a shiny new distraction," arguing that OT teams have more immediate problems. CISA's January 2026 product-category list explicitly leaves OT and IoT devices outside its current scope, according to Infosecurity Magazine.
Why it matters. Equipment with decades-long lifespans bought today may still be in service when quantum risk becomes real, so purchasing decisions now carry long-term exposure. The guidance is advisory, and practitioners disagree on urgency. Operators should expect OT to lag IT, which suggests building crypto agility requirements into new equipment purchases.