CISA's quantum page says federal agencies must keep a current inventory of IT vulnerable to quantum decryption, and that CISA maintains a list of product categories that support or plan to support post-quantum standards. It is federal guidance, but the practices are easy for private teams to copy.
What the page says
- Quantum decryption capable of breaking modern public-key encryption does not yet exist, but agencies and critical infrastructure operators must begin preparing now.
- CISA's guidance under 6 U.S.C. section 1526 requires each federal agency to establish and maintain a current inventory of IT vulnerable to quantum decryption. CISA assesses inventory submissions from Federal Civilian Executive Branch agencies.
- CISA works with NIST's NCCoE to evaluate automated cryptographic discovery and inventory tools that can streamline federal inventories.
- CISA develops and updates a list of product categories that support, or plan to support, post-quantum standard algorithms, including hardware and software categories with example types of widely available products.
- It links to further material, including a call to action, a DHS roadmap and NIST's migration FAQ, and mentions a G7 Cyber Expert Group roadmap for the financial sector with suggested timelines to reduce harvest now, decrypt later risk.
I did not fetch the product category list itself, so this post does not describe its contents.
Who it binds
The inventory duty applies to federal agencies. It does not bind a private company by itself. If you sell to agencies, expect questions that echo it. If you do not, treat it as a worked example of a sensible first step.
What to reuse
An inventory is the common thread. Copy the shape:
- A current list, not a one-time spreadsheet. Name an owner and a refresh cadence.
- Coverage of IT that uses quantum-vulnerable public-key cryptography, not just cryptographic products.
- Evidence of assessment: someone reviews submissions and follows up.
- Tooling to automate discovery where possible, since manual lists go stale.
Using the product category list
When you buy, look for the categories on CISA's list that apply to you, such as the kinds of products in your stack, and ask each vendor where they stand. This turns a vague worry into a procurement check. Read the official list, because categories change.
What is not claimed here
Nothing on this page makes post-quantum migration a legal requirement for you. Check your contracts and regulators for obligations that apply to your business.
Putting it to work
Pair the inventory with data lifetime. A list of algorithms is useful. A list ranked by how long the protected data must stay secret is what lets you decide.
Quick check
Does CISA's inventory duty apply to private companies?
The page describes it for federal agencies. Private companies may face it through contracts or sector rules, so check your own.
What is the product category list for?
It shows categories of hardware and software that support or plan to support post-quantum standards, so buyers know what to ask about.
Sources
Last reviewed: 19 October 2026.
