OPG_FY26_Post-Quantum Cryptography And Federal Identity Management Support Services (PQC)

The General Services Administration's (GSA) Office of Government-wide Policy (OGP) Federal Identity and Cybersecurity Division coordinates the government-wide civilian agency execution of identity credential and access management (ICAM) policies and standards. In this role GSA steers the implementation of ICAM to align with the Federal Identity Credential and Access Management (FICAM) Architecture updating governance guidance synthesizing data from agency ICAM programs and coordinating the federal government's interactions with external organizations to promote consistent ICAM strategy and practices across agencies. The rapid advancement of quantum computing poses a significant and urgent threat to the cryptographic foundations that underpin federal identity systems. A cryptographically relevant quantum computer (CRQC) once realized will have the capability to break widely used asymmetric cryptographic algorithms; including those currently used to protect Personal Identity Verification (PIV) credentials Public Key Infrastructure (PKI) certificates and physical and logical access control systems across the federal government. Adversaries are already conducting harvest-now decrypt-later attacks capturing encrypted federal data today with the intent to decrypt it once quantum computing capabilities mature.