Seven national cyber agencies reframe post-quantum migration as an economic risk
The G7 Cyber Security Working Group's June call to action says the quantum threat is off the radar and under-resourced at most organizations, and it hands CISOs the wording to fund a cryptographic inventory this cycle.
The Watch · Security desk
What happened
- CISA and the G7 Cyber Security Working Group published "Preparing for the Post-Quantum Era: A Call to Action," a report prepared in June at the G7 Summit in France.
- The report states that a collective move to post-quantum cryptography works only if organizations treat the quantum threat as an economic and business risk rather than a purely cryptographic one.
- It concedes that quantum computing timelines are uncertain while identifying the harvesting of encrypted data now for decryption later as a threat that exists today.
- A Trump administration executive order moved federal agencies' internal PQC migration deadline from 2035 to 2030, while Google and other companies have set their own target at 2029.
- Seven agencies signed the report: CISA, the UK's NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's National Cybersecurity Office and Italy's ACN.
Why it matters
- Who has to decide decision The economic-risk phrasing is the sentence a CISO can put in a funding request, which moves PQC discovery out of the architecture backlog and into the queue that competes with fraud and downtime spend.
- Who's exposed exposure Anything with a multi-year confidentiality requirement is already exposed, because collection costs an adversary almost nothing while the decryption capability is still pending.
- What it limits constraint Once PQC lands in procurement requirements, the work shifts onto vendors and renewal cycles, which shortens how long an unregulated operator can defer on its own judgment.
- What doesn't add up contradiction If a chosen algorithm can fall to conventional or AI-assisted cryptanalysis, the funding case cannot be a one-time project with an end date, and that is a harder sell than a single migration.
Next story · Security · Oct 8
Ten agencies tie China-linked intrusions across several sectors to Integrity Technology GroupConfirmed13 publishers
The priority with teeth sits last on the working group's list of five: integrating PQC into cybersecurity requirements and procurement processes [6]. That turns a research topic into contract language, and contract language is what gets a control funded, through a vendor question, a renewal date or an audit finding. The group's diagnosis is financial rather than mathematical. It writes that the quantum threat "remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence" [9].
The federal migration date moved up by five years, from 2035 to 2030 [18]. Google's own target of 2029 sits inside that new deadline by one year, and inside the old one by six [21]. These are supply chain deadlines, not attacker deadlines: they land as security questionnaires and procurement clauses before the year printed on them, which is the practical reason an inventory started now costs less than one started in answer to a customer's renewal.
The report also pulls authentication into scope, warning that quantum computers could compromise authentication and assurance mechanisms by forging trusted data or stealing confirmation, putting secure communications and legal contracts at risk [5]. That is a different asset class from a transport session key. Code signing, document signing and long-lived trust roots have to stay verifiable years after the key was generated, so they belong near the top of an inventory rather than in the phase-two column.
Uncertainty in the algorithms themselves argues for inventory over algorithm shopping. Some of the NIST-selected algorithms have already been broken with traditional computers or AI, which is why the agency backs multiple algorithms and the concept of crypto-agility [17]. The deliverable that survives that churn is a map: where keys live, which algorithms and protocols consume them, when certificates expire. Inventorying and prioritizing critical systems is what governments have been recommending for years [13], and it holds its value even if a chosen algorithm fails and a second migration follows.
Progress so far splits along regulation. The transition is on schedule in the federal government and the highly regulated financial sector, and lagging in industries where owners and operators feel they have more immediate concerns [16]. Both groups face the same arithmetic, but only one of them has a regulator asking for evidence. The working group's answer is that this "can only be achieved with early engagement, coordinated planning and informed decision making across the public and private sectors" [12]. In budget terms, that means the inventory work falls to you and the schedule falls to your suppliers.
What to watch
- Whether federal contracts begin requiring PQC evidence from suppliers, and at which tier of subcontractor.
- Whether any signatory agency publishes migration dates for sectors outside critical infrastructure and finance.
- New cryptanalysis against a NIST-selected algorithm, which would reset vendor roadmaps mid-project.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption30
- Hype gap+10
- Incentives60
- Confidence68
Perspective Coverage
5 publishers- Builder
- Builder 22%
- Operator
- Operator 55%
- Investor
- Investor 23%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA and the G7 Cyber Security Working Group released "Preparing for the Post-Quantum Era: A Call to Action," highlighting the need for organizations and governments to begin transitioning to post-quantum cryptography to protect sensitive data, authentication systems and critical assets.
- [2]
The report acknowledged uncertain timelines for quantum computers but identified that threats such as harvesting current sensitive encrypted data to decrypt it in the future exist today.
- [3]
The report said organizations "can no longer afford to postpone" work transitioning critical systems and data to post-quantum forms of encryption.
- [4]
The report said leaders in government and industry must reframe the quantum threat from a distant future problem to a near-term threat demanding action across all sectors, not just critical infrastructure.
- [5]
The report warned that quantum computers could compromise authentication and assurance mechanisms by forging trusted data or stealing confirmation, jeopardizing secure communications and legal contracts.
- [6]
The call to action outlines five priorities: raising awareness of quantum risks and the importance of PQC; developing national strategies supporting PQC adoption and integration; advancing research and development for quantum-safe technologies; fostering public-private partnerships; and integrating PQC into cybersecurity requirements and procurement processes.
- [7]
The G7 report was signed by CISA, the UK's NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's National Cybersecurity Office and Italy's ACN.
- [8]
The working group's report was prepared in June at the G7 Summit in France.
- [9]
The report said: "The quantum threat remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence."
- [10]
The report said a successful and collective transition to PQC "can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk."
- [11]
The Trump administration issued an executive order directing agencies to boost the domestic quantum industry and to move internal timelines for migrating to PQC encryption from 2035 to 2030.
- [12]
The working group wrote that transitioning to PQC is a collective transition that "can only be achieved with early engagement, coordinated planning and informed decision making across the public and private sectors."
- [13]
Governments have for years urged industry to inventory and prioritize critical systems and shift to post-quantum cryptography algorithms.
- [14]
Seven national cybersecurity agencies signed the report.
- [15]
Google and other companies have opted to move their own PQC migration timelines to 2029.
- [16]
PQC work has proceeded on schedule in some areas, such as the federal government and the highly regulated financial sector, but has lagged in other industries where owners and operators feel they have more immediate concerns than quantum computers.
- [17]
Some NIST-selected algorithms have already been broken with traditional computers or AI, which is why the agency backs multiple algorithms and concepts like crypto-agility, allowing organizations to switch between them quickly.
- [18]
The executive order pulled the federal internal PQC migration date forward by five years.
- [19]
Cryptographers believe the algorithms selected by NIST and NSA will withstand attacks from a quantum computer, but since no such computer exists today, designing cryptographic protections against it requires guesswork and mathematical estimation.
- [20]
The post-quantum algorithms were originally designed by independent cryptographers and vetted by NIST and the NSA, and will be used to protect government systems and data.
- [21]
Google's 2029 target is one year inside the new federal date of 2030 and six years inside the original 2035 date.
Sources
5 independent publishers whose own reporting we read for this story.
- cisa.govPreparing for the Post-Quantum Era: A Call to Action
1 article · September 3, 2026
- cyberscoop.comThe G7 tells industry to hurry up and prep for post-quantum encryption
1 article · September 3, 2026
- infosecurity-magazine.comG7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules
1 article · September 4, 2026
- thecyberexpress.comG7, CISA Urge Urgent Shift to Post-Quantum Cryptography
1 article · September 6, 2026
- therecord.mediaG7 urges organizations to prepare for quantum cyber threats
1 article · September 4, 2026
Topics and entities
Topics
- Harvest Now, Decrypt Later Threat
- Government cybersecurity policy
- Post-Quantum Cryptography
Entities
- ANSSI
- G7 Cyber Security Working Group
- National Cybersecurity Agency (Italy)
- National Cybersecurity Office (Japan)
- Federal Office for Information Security
- European Commission
- Communications Security Establishment
- National Security Agency
- ENISA
- National Institute of Standards and Technology
- UK NCSC
- CISA