Quantum-safe in practice: your first 90 days before the federal PQC mandate

Federal contractors face a 2030 target. Allies also move toward PQC. France's cybersecurity agency plans to require PQC for products entering certification starting in 2027. 

If your organization connects to government systems, or depends on a supplier that does, "PQC compliant" can become a procurement requirement. This requirement reaches financial services, healthcare, insurance and other industries that never sell directly to a federal agency. 

David Luber knows both sides of this problem. He spent more than 38 years at the National Security Agency, retiring in 2025 as Director of Cybersecurity. He also served as Executive Director of U.S. Cyber Command. Today he is Executive Cyber Advisor, National Security, at World Wide Technology.  

At the ONUG AI Networking Summit, he joined Kate Kuehn, Area Vice President, Global Cyber Advocacy at WWT, for a fireside chat. They discussed what the transition requires in practice. 

They were clear on the hype and why organizations that wait for the machine to arrive will be too late to protect data that must stay confidential into the next decade.

Here is a 90-day plan for CISOs, network leaders and risk teams. 

1. Find your cryptography before you try to fix it 

Discovery is the first step, and it is where most programs stop. Do you know where your cryptographic materials are? Certificates, keys, libraries, protocols and their hardware exist across applications, network devices and vendors. This is an asset-management problem before it is a cryptography problem. 

Within 90 days, make a first-pass inventory of cryptographic assets. Rank the assets by data sensitivity and by the time the data must stay confidential. Flag the equipment that you must replace, not upgrade. This decision affects budget and lead times. 

In practice, discovery combines automated scanning of networks, code and endpoints with vendor questionnaires to build a cryptographic bill of materials: a living record of which algorithms are in use, where they run and who owns them. Most organizations get stuck because cryptography is buried in third-party libraries, firmware and vendor products that scanners cannot see, and because no single team owns the result.

2. Map your federal connectivity and your supply chain 

When a contract includes "PQC compliant," the requirement changes how you connect. Start by listing every connection into government systems and every partner, supplier and customer that your own readiness depends on. Your PQC posture is only as strong as your weakest vendor. 

Then ask each of them the same questions. What is your transition plan? Who owns the plan? How do you manage certificate lifecycles? Partners will not all move at your speed. Find out early which partners will be late. 

Make the plan flexible. Deadlines and standards still change. A plan with fixed dates will be out of date in one year.  

Once compliance is a condition of the contract, PQC readiness stops being a roadmap item and becomes an audited deliverable, with attestations, evidence and renewal dates attached and your connection to government systems on the line. For partners who are behind, write PQC milestones into contracts and renewals, and protect the traffic you exchange with them at PQC-capable gateways while they catch up.

3. Test whether you can replace an algorithm 

Crypto agility is the ability to change algorithms without a multi-year emergency effort. It requires organizational readiness and technical readiness. You need a named owner, an agreed process for change, and the authority to schedule remediation with operations. 

For network teams, this is where the work becomes concrete. PQC changes how systems distribute keys. PQC can also affect existing network and infrastructure architecture. Post-quantum keys and signatures are much larger than today's, so handshakes grow, and older firewalls, VPNs, TLS inspection proxies and load balancers that expect smaller packets can fail or slow down. The network can also help: central points such as gateways, load balancers and SASE edges are natural places to deploy hybrid PQC first, and network traffic analysis shows which cryptography is actually in use.

Within 90 days, choose one representative environment. Test interoperability in this environment. A small test now shows the problems that a full migration shows later, under deadline pressure. 

How to weigh quantum against everything else 

Boards receive a long list of priorities: AI, operational technology, technical debt, and now quantum. Leaders should not treat quantum as a separate program competing for budget, but build it into work already funded: the asset inventory behind AI and OT security, the hardware refresh behind technical debt reduction, and the procurement language for every new system. Prioritize by how long your data must stay secret, because any system you buy today without crypto agility is technical debt you will pay for twice. 

These three steps fit alongside that list. None need a full migration budget. They give you the inventory, the dependency map and the test results.  Use these results to make the budget case with evidence. 

The takeaway 

Post-quantum cryptography will become a procurement requirement. Federal contractors face a compliance target in the next few years. Start now, even if your business does not sell directly to government. Find out where your cryptographic assets are. Build the agility to replace algorithms without a multi-year scramble. Extend your readiness plan across your supply chain.  

Where to begin

Start your first 90 days with WWT. Our four-hour PQC Readiness Workshop gives your security, network and risk leaders a completed WWT PQC Readiness Scorecard and a customized action plan for moving to NIST-selected algorithms, including a hybrid-mode strategy. When you are ready to test, use WWT's Advanced Technology Center (ATC) to validate PQC interoperability across multivendor network and security environments before you change production. Schedule a briefing or explore our quantum readiness resources.