GSA updates FICAM, PACS for post-quantum migration
The framework and lab updates are planning-stage moves; fielded quantum-resistant systems are still years away.
TL;DR
GSA announced Monday it will update the Federal Identity, Credential and Access Management framework to incorporate quantum-resilient algorithms and expand its FIPS 201 Physical Access Control System lab to test quantum-resistant solutions for federal building access. The moves follow a June executive order mandating post-quantum cryptography migration. Both announcements concern planning and testing infrastructure, not fielded systems. Agencies and contractors won't see operational changes until standards and procurement vehicles catch up.
The General Services Administration's Monday announcement is the first visible step agencies have taken since the June executive order on post-quantum cryptography, but it's worth being precise about what was actually announced.
GSA said it will update the Federal Identity, Credential and Access Management framework (the government's foundational identity architecture) to include quantum-resilient algorithms that maintain backward compatibility with existing systems. Separately, the FIPS 201 Evaluation Program's Physical Access Control System lab will expand its testing capabilities to cover quantum-resistant solutions for federal building access, including employee badges, visitor passes, and access codes.
Both moves are planning and testing plays, not deployments. The FICAM update means GSA is scoping how identity standards will incorporate post-quantum algorithms; the PACS lab expansion means the testing infrastructure is being built out. Neither changes what a federal CISO or facility manager does on Monday. The press release itself acknowledged the timeline, calling the transition "a complex, multiyear process that requires careful coordination across government."
That's a fair characterization. The June EO set direction; GSA's announcement is the architecture phase. NIST has published the algorithms, but the procurement vehicles, implementation guidance, and compliance frameworks that turn algorithms into operational systems are still being assembled. For the practitioners who will eventually deploy these systems, the relevant milestone isn't this press release. It's when GSA publishes the updated FICAM technical profile and when the PACS lab begins issuing test results that agencies can cite in procurement. Neither has a date yet.
Published ·Updated ·Deep Fathom