GAO’s Quantum Readiness Report Has Three Dates Worth Keeping
The October public release exposes gaps found in an earlier audit. Its inventory, funding and testing findings offer a practical way to read post-quantum readiness claims.
A newly public GAO report says none of 24 reviewed federal agencies had fully addressed all three preparatory practices for post-quantum cryptography. The finding belongs to an audit conducted from February 2024 through September 2025. It is not a fresh October 2026 measurement of agency readiness.[1]
Audit, publication and correction
The chronology has three separate milestones. GAO issued its sensitive report in September 2025. The public version was released on October 6, 2026. An October 14 erratum clarified wording about coordination with agencies to remove sensitive information. The correction did not create a new audit or additional recommendations.[1][2]
GAO assessed three practical jobs: maintain a prioritized inventory of systems using vulnerable cryptography, determine the funding needed to migrate priority systems and test post-quantum cryptography in agency environments. The framework is useful because each job needs a different kind of evidence. An inventory is not a budget, and neither is a successful integration test.[1]
Why an inventory changes the budget
Only one of the 24 agencies fully addressed the applicable inventory activities in the review. No agency fully addressed the funding practice. GAO describes incomplete inventories and missing or uncertain cost information as problems for funding estimates. A number can look precise while still resting on an incomplete list of systems.[1]
The report’s practical lesson is a dependency chain. If a team does not know where cryptography is used, it cannot reliably identify what must change. Without that scope it cannot confidently estimate the work. And without testing it cannot show that replacement components operate correctly in the surrounding service.[1]
A question to ask of any readiness claim
A useful inventory entry would identify the service, algorithm, implementation, supplier, owner and migration dependency. For example, updating a network connection does not establish that an application’s signed files or embedded verifier have changed too. The relevant unit is the complete trust path that a user depends on, rather than the most visible setting.
The next question is what evidence exists now. An agency might have made progress since the audit period; the older finding alone cannot establish either completion or continued failure. A current assessment should show dated inventory coverage, approved funding assumptions and test results for the same systems.
A transition test should record what passed and what failed. For an illustrative signing workflow, an authorized artifact should verify, a changed artifact should fail and a signature for a different release should not be accepted as permission to deploy this one. The test asks about enforcement where the result is used, not just whether a cryptographic key can produce a signature.
Read the public report as evidence of the earlier review and as a guide to the work that must be demonstrated. Keep the audit date beside the findings and ask for current operational evidence before making a present-day readiness judgment.