GSA, Treasury begin quantum-safe migration as OMB deadline nears

GSA and Treasury both announced post-quantum cryptography initiatives Tuesday, but the two efforts sit at very different points on the doing-versus-talking spectrum, and that difference matters for anyone selling to or securing federal systems.

GSA's work has procurement teeth. The agency is expanding its Physical Access Control System lab under the FIPS 201 Evaluation Program to test quantum-resistant technologies for physical access control and employee identification. The lab's findings feed directly into GSA's approved products list for PACS, which means vendors who want to sell building-access products to the government will eventually need to demonstrate quantum resistance. "The enhanced lab infrastructure represents an entirely new capability, requiring extensive research and development," wrote Dan Pomeroy, GSA's deputy associate administrator for technology policy. It's not a working group. It's a testing pipeline that will shape the federal PACS market.

GSA is also modernizing the FICAM architecture to support quantum-resistant algorithms, with an emphasis on crypto agility, the ability to swap encryption methods as standards evolve. An interagency working group held its first meeting August 12, drawing 40 participants from 17 agencies, and plans to meet biweekly to address non-human identities and automation alongside other modern identity features in the PQC environment. GSA will host a PQC Summit on September 16 to bring federal leaders and vendors together.

Treasury's Quantum-Readiness Task Force, by contrast, is in an earlier phase. Secretary Scott Bessent launched the public-private initiative to accelerate the financial sector's transition to quantum-safe technology, organized into three workstreams: sector alignment and PQC transition, third-party and vendor readiness, and digital assets and emerging technology risk. Deborah Guild, chair of the Financial Services Sector Coordinating Council, described the task force as setting "the conditions for industry and government to align priorities." That's convening language, useful but several steps removed from the procurement infrastructure GSA is building.

Both efforts trace to Trump's June 22 executive order, which requires agencies to migrate high-value assets and high-impact systems to post-quantum cryptographic keys by December 31, 2030, and to PQC digital signatures by the end of 2031. The Office of Management and Budget followed with guidance instructing agencies to submit PQC Migration Plans within 120 days, a deadline now roughly 30 days away. Those plans must cover cryptographic system inventories as well as migration strategy and workforce training. Phase two, slated for 2027, 2028, calls for pilot programs and early migrations of prioritized systems, with plan refinement based on lessons learned.

For practitioners, the near-term watchpoints are the September 16 GSA summit and the OMB plan deadline, plus any early signal from the PACS lab about testing criteria. The 2030 migration deadline is far enough away to feel abstract, but the approved products list work GSA is doing now will determine which vendors have a federal market to sell into. Treasury's task force matters more for the financial sector than for the federal contracting community directly, though its third-party and vendor readiness workstream could eventually shape expectations for financial services suppliers, many of whom also sell to the government.