CISA's post-quantum roadmap: inventory, engage, prioritize
CISA's Post-Quantum Cryptography Initiative and its joint quantum-readiness guidance with NSA and NIST tell organizations what to do now — before the algorithms are everywhere. The three concrete steps.
The Cybersecurity and Infrastructure Security Agency (CISA) runs a Post-Quantum Cryptography Initiative to help critical-infrastructure and government organizations prepare for the migration. Its most cited output is the joint guidance with NSA and NIST, "Quantum-Readiness: Migration to Post-Quantum Cryptography," which is deliberately practical: it tells you what to do before the standards are fully rolled out.
The three moves CISA asks for now
- **Build a cryptographic inventory.** You cannot migrate what you cannot see. Discover where and how public-key cryptography is used — protocols, certificates, libraries, appliances, and embedded systems — and record it as a cryptographic bill of materials.
- **Engage your vendors and supply chain.** Ask suppliers about their post-quantum roadmaps now, so procurement and contracts start pulling the market toward quantum-safe products before you are forced to.
- **Prioritize by risk.** Rank systems by data sensitivity, confidentiality lifetime, and exposure — long-lived secrets protected by quantum-vulnerable key exchange go first, driven by harvest-now-decrypt-later.
The inventory is the artifact auditors and OMB expect
For US federal agencies, the cryptographic inventory is not just good practice — it is the deliverable behind OMB M-23-02's requirement to prioritize systems for post-quantum migration. Even outside government it is the foundation every serious migration plan is built on.
CISA's role is coordination and urgency rather than writing the cryptography — the algorithms come from NIST, and national-security requirements come from NSA's CNSA 2.0. What CISA adds is the message that the preparation work (inventory, vendor engagement, prioritization) has no reason to wait for anything, because none of it depends on the final algorithms being deployed.