NASCIO: States shouldn’t wait to start preparing for cyber risks posed by quantum computing
State governments need to begin preparing now for the cybersecurity risks posed by eventual breakthroughs in quantum computing, according to a new report from the National Association of State Chief Information Officers.
The report released Tuesday argues that, though quantum computers capable of breaking today’s widely used encryption methods have not yet emerged, it’s time states begin preparing their systems by assessing existing vulnerabilities and developing a phased migration plan to systems that are capable of withstanding these threats. Quantum computing introduces a number of serious cybersecurity challenges for states, threatening the security of sensitive information, digital identities, government transactions and critical infrastructure, the report says.
Though the topic hasn’t yet risen to the level of a top 10 CIO priority nationally, the recent results of NASCIO’s annual State CIO Survey suggest states are beginning to recognize the need to prepare for quantum-related cybersecurity threats. Of the responding state chief information officers, 10% identified quantum computing as one of the most impactful emerging technologies over the next two to three years.
Despite this acknowledgement, 73% of state CIOs said in the survey that their states were monitoring quantum computing developments, but had taken no formal action. Just 14% of state CIOs said a post-quantum cryptography or quantum-safe security initiative was underway in their state.
However, the transition away from traditional encryption systems is time-sensitive: The report points to a 2021 claim that large organizations, such as states, could need four to 15 years to migrate their largest, enterprise systems to those with methods of post-quantum cryptography, a set of encryption algorithms designed to protect digital information from attacks by both traditional and future quantum computers.
The report points out that the U.S. Government Accountability Office said in an October 2026 report that most industry experts believe a quantum computer capable of breaking many of the public-key encryption methods used to protect sensitive information and communications — including banking data, government communications and health records — could happen by the early 2030s, if not sooner.
Researchers often refer to this potential turning point as “Q-Day.”
NASCIO said that by “Q-Day,” it will already be too late for governments to respond, and waiting until quantum computers pose a credible threat could leave states scrambling to protect sensitive information and critical government systems. This is especially true considering the rise in threats that are enabled just by the promise of quantum, including “harvest now, decrypt later” cyberattacks in which malicious actors collect encrypted government information and store it until quantum computers become powerful enough to decrypt it.
The report highlights a handful of states already undertaking this work, such as Minnesota, which has emerged as an early mover with its Technology Advisory Council recommending a statewide inventory of cryptographic systems and a phased transition to quantum-resistant encryption earlier this year. NASCIO also points to Massachusetts, which has incorporated post-quantum cryptography into its 2026-2028 statewide IT strategy, while Pennsylvania lawmakers have called for an assessment of the state’s cryptographic vulnerabilities and a migration roadmap.
To help states prepare for the transition, NASCIO outlines seven steps for developing a post-quantum cryptography strategy. The organization recommends that states first establish executive-level ownership of the effort, inventory the cryptographic systems and methods used across government networks and applications, and assess which systems and sensitive information are most vulnerable to future quantum attacks.
States should also prioritize cryptographic agility, which it defines as the ability to replace encryption methods without having to redesign entire systems. This step should include working with technology vendors to understand their plans for supporting quantum-resistant standards.
NASCIO then recommends that states develop phased migration roadmaps that prioritize migrating the most vulnerable systems first, test new cryptographic algorithms and incorporate post-quantum requirements into any future procurement and modernization projects.
Finally, states should invest in training for employees and create awareness campaigns so IT, cyber and procurement teams understand the risks and their role in preparing for the transition ahead.
“Quantum computing presents both opportunities and risks for state government. Over time, states will explore innovative applications that may improve public services, strengthen analytical capabilities and address complex challenges. But the cybersecurity implications demand attention today,” the report said. “Post-quantum readiness is not simply about replacing today’s vulnerable cryptographic algorithms. It is about building the enduring ability to change cryptography as threats, technologies and standards evolve.”
