Policy

GSA Issues a Buyer's Guide for Post-Quantum Cryptography

GSA's 2025 buyer's guide helps federal agencies acquire quantum-resistant cryptography and write crypto agile selection criteria, so vendors should expect matching language in procurement.

ArcQubit Team··2 min read·Updated September 18, 2026
  • post-quantum cryptography
  • crypto-agility
  • federal compliance
  • for government

GSA issues a buyer's guide for post-quantum cryptography

2025, WASHINGTON

The General Services Administration publishes a Post-Quantum Cryptography Buyer's Guide dated 2025. GSA's own page describes it as a resource to help federal agencies and procurement professionals navigate acquisition of quantum-resistant cryptography. The page frames the aim as making post-quantum protection "buyable and adaptable" by building quantum-resistance expectations into IT contracts and vehicles such as the Multiple Award Schedule and governmentwide acquisition contracts. It says the guide explains what to ask for when selecting post-quantum tools and services.

The guide addresses the federal acquisition workforce, industry vendors and contractors, agency procurement officials, and organizations evaluating post-quantum-capable products. GSA lists selection criteria such as accuracy and speed, user experience and compatibility, compliance support, risk-based prioritization, and strong remediation guidance and vendor support. A PQC Roadmap, also dated 2025, sits alongside the guide, and both live on GSA's buy.gsa.gov documentation system.

GovCIO Media, in an article of 19 June 2026, says GSA offers the buyer's guide through buy.gsa.gov and also a quantum information science and technology guidebook, so that agencies can write technical requirements and ensure acquisitions support crypto agile approaches. In the same article, GSA's Rosa Underwood describes agency readiness as running from not prepared to partially prepared. GovCIO also reports that larger departments such as the Pentagon command more resources for finding cryptographic assets, while smaller agencies struggle with staff, funding and expertise.

Why it matters. Vendors selling to federal agencies should expect procurement language to reflect the criteria in this guide. Any organization buying security products can borrow the guide's questions to test vendor claims. The GovCIO reporting suggests smaller agencies may lean heavily on such resources, so vendors should expect questions from buyers with limited in-house expertise.

Frequently asked questions

The federal acquisition workforce, agency procurement officials, industry vendors and contractors, and organizations evaluating post-quantum-capable products. GSA lists criteria such as accuracy, speed, compatibility, compliance support and vendor support.

Expect procurement language to reflect the guide's criteria. GovCIO reports smaller agencies struggle with staff, funding and expertise, so vendors should expect detailed questions from buyers with limited in-house post-quantum knowledge.

Sources

  1. General Services Administration, "Post-quantum cryptography (agency page)," accessed Oct. 2, 2026.
  2. GovCIO Media, "Agencies Go Beyond Planning as Post-Quantum Deadlines Near," Jun. 19, 2026.

Turn the headline into a plan.

Wherever you are on the 2030 to 2035 timeline, QuTrust builds you a migration roadmap.