The answer, up front
Dam and hydropower operators have almost no post-quantum guidance written for them. No 2024 to 2026 source in the current reporting discusses post-quantum cryptography for dams directly, and the one dam-specific paper, from December 2023, covers quantum key distribution rather than post-quantum algorithms. Operators therefore have to reason across adjacent critical-infrastructure analysis, that older paper, and European regulation. The honest conclusion is that the sector's control systems carry the same long-lifecycle exposure as other operational technology, but with less tailored advice to lean on.
The critical-infrastructure read
The Bloomsbury Intelligence and Security Institute argued in March 2026 that the quantum debate centers on IT while the larger risk sits in operational technology that still uses RSA 1. It says resource-constrained devices with long service lives make post-quantum deployment technically and financially hard, that adversaries can collect encrypted OT traffic now and decrypt it later, and that quantum attacks on critical infrastructure look unlikely before 2030 but highly likely over the long term without proactive migration 1. The report does not name dams, so applying it to them is an inference.
The one dam-specific paper
The only dam-specific work predates the current window. Researchers from Oak Ridge and partner institutions wrote in Sensors in December 2023 that fewer than 3 percent of roughly 80,000 US dams generate power, and that modernization and remote network control widen the attack surface 2. They propose quantum key distribution as a defense and note that fiber loss and dam noise sources such as turbine vibration complicate deployment, but they do not evaluate post-quantum cryptography 2. Quantum key distribution is a physics-based approach, distinct from the algorithm migration that NIST standards describe.
The regulatory frame
European regulation supplies the supervisory context. An October 2025 International Water Power Magazine analysis says NIS2 places hydropower and dams under critical-infrastructure obligations and requires water utilities to run OT risk management, and it finds interconnected systems 15 to 20 years old carry the highest risk, with smaller utilities disproportionately exposed 3. That article never mentions quantum, so it supports the legacy-system picture only.
What this means for operators
With no tailored standard, the defensible path is the general one: inventory where public-key cryptography lives across dam control and monitoring systems, rank by data sensitivity and device replaceability, segment networks to narrow what must migrate first, and require crypto agility in new equipment so a future change does not mean replacing hardware in a live facility.
How ArcQubit approaches it
ArcQubit treats discovery as the first move where guidance is thin, because an operator cannot plan around cryptography it has not located. QuCode builds the inventory across OT and IT surfaces, and QuTrust holds the prioritized plan so segmentation and phased upgrades proceed in a defensible order.