GAO assessed the 24 CFO Act agencies against OMB memo M-23-02, which since 2022 has required an annual inventory of systems using quantum-vulnerable cryptography. Only one agency had a complete inventory of its priority systems (22 partial, 1 none). On testing post-quantum algorithms in their own environments, 23 agencies had done nothing and one had only started market research; 16 said testing was premature because most vendors had not yet added the new algorithms to their products. Only five used automated discovery tools. None of the six agencies examined in depth fully passed an accuracy check, and the OMB migration cost estimate of about $7.1 billion (2025–2035) relies on assessments the agencies acknowledged were inaccurate. GAO's 89 recommendations sit in a sensitive version issued in September 2025; only 12 agencies fully agreed to them.

Targets for central government (policy aims, not law): by end-2026, quantum risk in each organisation's risk management and a cryptography policy; by end-2027, harvest-now-decrypt-later risk addressed and a draft migration plan; by end-2028, quantum-safe procurement requirements; by end-2030, high-risk systems migrated and software and firmware quantum-safe by default; by end-2035, medium-risk systems migrated. The cabinet expects a cryptographically relevant quantum computer between 2029 and 2035 and states the date is uncertain; the Dutch intelligence service AIVD advises preparing for one as early as around 2030.

NSA still does not recommend QKD or other quantum cryptography to protect national security systems, and points to quantum-resistant algorithms instead. The new wording is softer: it drops the 2020 line that NSA did not expect to certify QKD products, and adds that physical degradation can erode security after certification. CNSA 2.0 itself is unchanged and contains no QKD option; ML-KEM-1024 remains the key-establishment algorithm.

After several related papers estimated key-recovery costs below the claimed security levels for all five Classic McEliece parameter sets, BSI said the scheme's security is "substantially lower than previously assumed" and should not be used in new designs. It also said no practical attack is currently possible and that hybrids with a classical scheme still provide at least classical security. BSI prefers ML-KEM or FrodoKEM, will recommend HQC once standardised, and plans to revise its TR-02102-1 guidance in early 2027. Classic McEliece is not a NIST standard; the ML-KEM standard most organisations are adopting is not affected.

Google's documentation still lists hybrid X25519MLKEM768 as off unless enabled, with the switch to on-by-default planned "starting in October 2026" for load balancers with no SSL policy or a policy without a post-quantum setting. Admins can set ENABLED now or DEFERRED to postpone the change to October 2027. We first flagged this date in Edition #6. If you run Google Cloud application or proxy load balancers, check old clients and middleboxes that may reject the larger handshake before the default changes.

IonQ agreed to acquire network-microsegmentation vendor Elisity in an all-stock deal worth up to $1.3 billion and describes the combination as complete quantum security. An independent review found no FIPS 140-3 certificate or validation queue entry for IonQ's or ID Quantique's post-quantum products, no published ML-KEM implementation details, no post-quantum certificate or signature products, and cryptographic inventory only on Elisity's roadmap. Segmentation can contain devices that cannot be upgraded, but it does not protect recorded traffic. Treat "quantum security" bundles the way you would any vendor claim: ask for validation certificates and documentation (see Block 5).

Europol rates harvest-now-decrypt-later risk high for governments, medium to high for companies and low to medium for citizens, and says it found no clear evidence of systematic exploitation at scale; long-lived, high-value data is the plausible target. Its technical point is useful for prioritising: under TLS 1.2 with RSA key transport, stealing one server private key later can decrypt every recorded session, whereas TLS 1.3 and SSH forward-secret exchanges force an attacker to break each session separately. Recommendations: disable TLS 1.0/1.1, enforce forward secrecy, limit how long you retain data, pilot hybrid post-quantum key exchange, and rotate keys and re-encrypt older stored ciphertexts. On timing, Europol says the arrival date is uncertain but "should not be the main concern," because adaptation takes years. Its companion report rejects predictions that quantum computing will end cryptocurrencies but notes there is no cryptographic fix for wallets whose public keys are already exposed.