The Quantum Threat is National. The Readiness Gap is Local

America's transition to quantum-resistant security is underway. For state and local governments, the more difficult challenge may be building the institutional capacity to respond.

The United States is preparing for a fundamental change in cybersecurity. Advances in quantum computing threaten to undermine widely used cryptographic systems that protect sensitive information, digital communications and critical infrastructure.

The federal government has established a transition framework. New cryptographic standards are available. Technology providers are developing solutions.

But a significant gap is emerging between national policy and state-level preparedness.

A recent investigation by the Howard Center for Investigative Journalism at Arizona State University and Scripps News examined quantum readiness across all 50 states. The findings were striking: only four states had an active post-quantum cryptography migration plan, another 14 were developing or committed to developing one, and 32 had not demonstrated an active commitment to migration.

The challenge is no longer simply whether the technology exists. It is whether the institutions responsible for protecting essential services can organize, fund and execute the transition.

The infrastructure behind the encryption

State and local governments operate an extraordinary range of interconnected systems. Water and wastewater facilities, public utilities, emergency communications, transportation networks, healthcare systems and government information platforms all depend on digital infrastructure.

Many of these systems were designed for long operational lifecycles. Their technology environments often combine modern cloud platforms with legacy equipment, specialized industrial controls and vendor-managed systems.

Quantum readiness introduces a new consideration into this infrastructure landscape.

Organizations must understand where vulnerable cryptography exists, which systems depend on it, how long sensitive information must remain protected and what operational changes will be required to transition.

This is not necessarily a simple software upgrade. It is a coordinated modernization effort involving technology, procurement, risk management and institutional planning.

A different kind of infrastructure challenge

The National Institute of Standards and Technology has already finalized its first three post-quantum cryptography standards. Its migration guidance establishes a path toward retiring vulnerable cryptographic algorithms, with a broad transition horizon extending to 2035 and earlier action for higher-risk systems.

Yet standards alone do not create readiness.

State agencies and municipalities must navigate fragmented technology environments, constrained budgets, competing operational priorities and procurement processes that were not designed around an emerging cryptographic threat.

The question is not simply which quantum-resistant technology to purchase.

It is how to establish a practical transition strategy across thousands of systems, multiple agencies and an ecosystem of commercial technology providers.

That requires coordination among government leadership, cybersecurity professionals, infrastructure operators, systems integrators and technology companies.

The commercial opportunity behind the readiness gap

For the technology sector, the emerging state and local readiness gap represents more than demand for new cybersecurity products.

It creates a need for cryptographic discovery, infrastructure assessment, migration planning, systems integration and long-term security management.

Many of the necessary technologies are already emerging from established cybersecurity companies, specialized innovators and federally supported research programs.

The challenge is connecting those capabilities with institutions that need them—and translating technical innovation into solutions that can be evaluated, procured, financed and deployed.

This is where market development becomes as important as technological development.

Readiness begins before the deadline

No one knows precisely when a quantum computer capable of breaking today's widely deployed public-key cryptography will become operational.

But the uncertainty surrounding that date does not eliminate the need for preparation. Sensitive information intercepted today may remain valuable for years, and large-scale cryptographic migration can take considerable time.

For state and local governments, the immediate priority is not to replace every system overnight. It is to establish visibility, identify critical dependencies, prioritize long-lived risks and develop an executable transition plan.

The quantum transition will ultimately be measured not only by advances in computing or cryptography, but by the ability of institutions to adopt new capabilities at scale.

The standards are arriving. The technology is advancing. The next challenge is building the capacity to act.