GAO's 2024-2025 Post-Quantum Audit of 24 Federal Agencies, Released 6 October 2026, Finds None Met All Inventory, Funding and Testing Practices Ahead of OMB's 22 October Migration Plans
In February 1997 the Government Accountability Office, then called the General Accounting Office, added the Year 2000 computing problem to its list of high-risk federal programs. Its auditors kept asking agencies the same unglamorous first question: which systems do you run, and which of them store dates in two digits? The repair work could start only after that list existed. Y2K had a fixed deadline that nobody could negotiate, and the inventory was finished because the calendar forced it.
Post-quantum migration asks the same first question without a fixed date. On 6 October 2026 GAO published GAO-27-108740, "Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat", the public version of a sensitive report it issued in September 2025 at the request of Senator Margaret Wood Hassan, ranking member of the Joint Economic Committee. The headline finding is short: during the audit, none of the 24 Chief Financial Officers Act agencies fully addressed the three practices GAO used to judge readiness. Set against the claims federal planning already relies on, the report reads as a test of how much of that planning has ground under it.
Practical takeaway. In audit work that ended in September 2025, GAO found one complete inventory of priority systems among 24 agencies, no agency that had tested post-quantum algorithms in its own environment, and funding assessments that 21 agencies called not fully accurate. Unless those gaps have been corrected since, they could weaken the migration plans due under OMB memo M-26-15 on 22 October 2026. Suppliers to federal agencies should expect questions about the cryptography inside their products to arrive before the agencies' own lists are complete.
What GAO-27-108740 measured at 24 agencies, and against which OMB guidance
GAO built its framework mainly from OMB memo M-23-02 of November 2022 and split it into three practices with eight activities. The first is a prioritized inventory of systems with vulnerable cryptography, covering high-value assets, high-impact systems, public-key access-control systems and any system holding data that would still be mission-sensitive if decrypted in 2035. The second is an annually updated estimate of the funding needed to move those systems. The third is testing: working with vendors to find candidate products, then testing post-quantum cryptography in the agency's own environment. The audit work covered February 2024 to September 2025, and GAO then spent a year with the Office of the National Cyber Director preparing the public text.
Which inventory gaps GAO found: one complete list, 19 agencies without automated tools
One agency fully addressed every applicable inventory activity. One agency had not built an inventory at all, and the other 22 had lists that left out priority systems. A majority of inventories missed high-impact systems, and most missed high-value assets. Several wrongly listed symmetric-key algorithms as vulnerable to a quantum computer, an error that fits the expertise gap GAO describes: eighteen agencies reported a lack of cryptographic expertise and had no plan to close it. Twenty-three agencies had no documented process for keeping the inventory current.
The tooling picture explains part of the problem. Five agencies used automated discovery tools; 19 did not, and officials at 15 agencies told GAO it was too early for such tools or that they were waiting for CISA to identify suitable ones. CISA said it expected to publish an assessment of discovery tools by December 2025. The vendor side of that market is moving fast; Quentir's Defense Monitor looked at what a cryptographic discovery product such as Sectigo Quantum Ready has to show a defense buyer. One department told GAO its unclassified systems support more than 4 million endpoints, which shows why a manual spreadsheet cannot carry the task.
How reliable is the $7.1 billion estimate OMB sent to Congress?
OMB used agency funding assessments to give congressional committees an estimate, developed by the National Cyber Director's office, of about $7.1 billion to migrate priority systems or replace legacy systems that cannot support post-quantum algorithms. OMB's own report noted that a significant share of that figure is legacy replacement. GAO's audit shows how soft the inputs are. No agency fully met the funding activity. Twenty-one agencies produced assessments and acknowledged that the data were not fully accurate; three produced none. Only one assessment was built on a complete inventory of priority systems, and a funding figure cannot be more complete than the list of systems it prices.
The $7.1 billion figure is therefore an uncertain estimate built on incomplete inventories, and GAO's findings do not show in which direction it errs. ONCD told GAO the inventory was designed as an iterative annual exercise that gains detail each year. That design is sensible for a multiyear program. It also means the number Congress received describes the inventories agencies had, which GAO found partial.
Why GAO rejected the argument that it was too early to test post-quantum cryptography
The testing findings are the starkest. One agency did market research on candidate vendor implementations and stopped there; the other 23 did neither testing activity. Sixteen agencies told GAO it was too early, because vendors were still in the early stages of building the algorithms into their products. Officials from one agency said their funding assessment was unreliable because products with post-quantum cryptography did not yet exist. ONCD officials said testing was voluntary for agencies, as mission and resources allow, and noted that NIST had not yet published its standards when GAO interviewed agencies in 2024. According to ONCD, several agencies interested in testing have worked with NIST's National Cybersecurity Center of Excellence, which kept that testing central and standardized; GAO's two testing activities concern each agency's own environment.
GAO did not accept that reasoning. OMB's guidance encouraging agency testing dates from November 2022, before the standards were final, and GAO points out that open-source tools for prototyping post-quantum cryptography have been available for at least four years, enough to begin testing before a fully validated commercial product exists. NIST approved FIPS 203, 204 and 205 in August 2024, inside the audit window. Validated, deployable products for every federal environment remain a separate question. The gap GAO describes is a gap in organizational capacity: expertise, documented process and a test plan.
Why an audit that ended in September 2025 lands two weeks before the M-26-15 plans of 22 October 2026
The public report arrives in an awkward position. As FedScoop noted on 7 October, it does not mention OMB memo M-26-15 of 24 June 2026, which asks every agency for a migration plan within 120 days, a deadline that falls on 22 October 2026, and sets 31 December 2030 for key establishment and 31 December 2031 for signatures on federal high-value and high-impact systems; national security systems follow separate rules. GAO's findings describe agencies as they stood a year before that memo. Some may have improved since; the report cannot say. What it does show is the starting point from which those plans must be written, and the 89 recommendations in the sensitive version give Congress a list to check them against. Twelve agencies agreed with their recommendations, two partially agreed, seven took no position, one disagreed with three of its four, and the Department of the Interior did not respond.
The people affected are ordinary. Social Security, tax, veterans and health files are exactly the data that would still matter in 2035, and an adversary that copies encrypted traffic today can wait. GAO does not call a cryptographically relevant quantum computer imminent. It reports that most industry experts expect one, possibly as soon as the 2030s, and cites a Global Risk Institute survey from December 2024 in which most of 32 experts put the probability of one by 2040 above 50 percent. The risk to citizens comes from the years in between, when records protected by today's public-key cryptography sit in someone else's storage.
How Quentir Reads It
GAO measured documented work, and the method matters as much as the score. In September Quentir looked at an assessment of ASEAN states that counted only what each government had verifiably done and excluded statements of intent; GAO applied the same discipline to the largest civilian agencies in Washington, and the results were sobering. The federal post-quantum program has strong instruments on paper, from M-23-02 to M-26-15 and the NIST standards. Its weak layer is the list of systems underneath them.
The next test arrives quickly. When the 22 October plans reach OMB, the useful question is how many rest on an inventory built with automated discovery and a documented maintenance process, and how many repeat the partial lists GAO saw. Congress now has the sensitive recommendations and a public baseline to compare against. For readers following this thread from inventory to procurement, the All-access membership puts every Quentir analysis linked here, and the paid editions behind them, under one subscription.
Sources: U.S. Government Accountability Office, GAO-27-108740, "Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat", published 6 October 2026 (full report); Office of Management and Budget, M-23-02, Migrating to Post-Quantum Cryptography, 18 November 2022; Office of Management and Budget, M-26-15, Execution of the Migration to Post-Quantum Cryptography, 24 June 2026; NIST, FIPS 203, 204 and 205 approved, August 2024; Grace Dille, "GAO: Federal Agencies Haven't Fully Prepared for PQC Transition", MeriTalk, 6 October 2026; Madison Alder, "Work needed to fortify systems against quantum threats, watchdog says", FedScoop, 7 October 2026. GAO's 1997 high-risk designation of the Year 2000 computing problem appears in its high-risk series update of February 1997.
Published intelligence, built to inform your own decisions. Published: October 8, 2026.