Cybersecurity Awareness Month is an opportunity for businesses to look beyond today's most visible threats and prepare for risks that are already taking shape, including the emerging cybersecurity implications of quantum computing.
Generative AI (GenAI) dominates many of the headlines today. Undoubtedly, GenAI is revolutionizing the way businesses transact commerce, and nearly every company is looking for a GenAI solution to leverage efficiencies for its operations. While much of the public discussion on innovation surrounds GenAI, businesses may not be tracking an arguably more groundbreaking technology and existential cybersecurity threat: quantum computing.
Quantum computers harness quantum physics to solve certain complex problems far faster than classical supercomputers. That potential could challenge the cryptographic assumptions protecting modern commerce, communications, transactions, and identity systems. This threat has a name: "Q-Day." Q-Day is the anticipated moment when a sufficiently powerful quantum computer can break public-key encryption – including RSA and related algorithms – used to secure internet communications, digital signatures, financial transactions, and identity systems. In practical terms, it marks the point at which quantum capability could defeat the public-key protections on which those systems rely. Industry assessments regard Q-Day as plausible as early as 2030.
On June 22, 2026, President Trump, citing quantum computing's "transformational capabilities" and national-security implications, signed two executive orders. EO No. 14412, "Securing the Nation Against Advanced Cryptographic Attacks," directs government-wide migration to post-quantum cryptography (PQC) and extends compliance obligations to federal contractors. EO No. 14413, "Ushering in the Next Frontier of Quantum Innovation," addresses the development and commercialization of quantum technologies. Together, the White House's executive orders signal that the federal government no longer views the quantum threat as theoretical; the executive orders establish a concrete timetable for migrating to post-quantum cryptography and reach beyond federal agencies to contractors, vendors, and critical infrastructure operators.
Of course, these orders are just the start. As with any revolutionary technology, however, it is better to be ahead than behind. This alert explains why the threat of quantum computing is relevant today and what steps businesses should take now to prepare.
Why the Urgency Is Now: "Harvest Now, Decrypt Later"
The urgency begins well before Q-Day and is upon us now. Nation-states and other sophisticated adversaries can intercept and stockpile encrypted data today for future decryption – a "harvest now, decrypt later" (HNDL) risk expressly identified in EO No. 14412.
Some data harvested in encrypted form today may not have value to threat actors a few years down the road when quantum computing enables its decryption, but data that must remain confidential beyond Q-Day – including trade secrets and other intellectual property, privileged communications, and health and financial records – is at risk already. Data in the hands of threat actors from prior breaches that were previously considered "low-risk" because the data was encrypted may warrant reassessment as the potential for quantum computing to defeat the encryption draws nearer.
The Standards Are Ready. The Administration Has Set the Agenda.
Two developments remove the case for waiting: post-quantum cryptography (PQC) standards have been established, and the federal government has set a timetable.
First, the standards are final. In August 2024, the National Institute of Standards and Technology (NIST) established Federal Information Processing Standards (FIPS) 203, 204, and 205, its first post-quantum cryptography standards. As such, organizations have the capability to begin protecting systems today, in accordance with these FIPS.
Second, the federal government has set a timetable. EO No. 14412 requires each federal agency to designate a PQC migration lead, inventory high-value assets, and adopt PQC for key establishment by year-end 2030 – which, unsurprisingly, coincides with projections for Q-Day. It also directs the Federal Acquisition Regulation (FAR) Council to propose rules requiring covered federal contractors to meet FIPS, including PQC-compliant algorithms, by year-end 2030, together with contractor-vulnerability-disclosure requirements.
The executive orders do not directly bind most private businesses, but NIST guidance may become a benchmark for private-sector practice, and the Cybersecurity and Infrastructure Security Agency's (CISA) forthcoming "cryptographic bill of materials" guidance may become a market expectation.
All in all, the 2030 timetable is one that businesses would be prudent to plan around because enterprise-wide cryptographic migration will require significant time and effort. Provided below are recommendations for immediate actions a business can take, so as to prepare for the inevitable Q-Day.
Recommendations for Immediate Action
Businesses must adopt a framework for quantum readiness that assigns accountability, identifies inventoried cryptographic assets, prioritizes long-lived sensitive data, and sets realistic, but necessarily swift, milestones. Immediate actions to consider include the following:
1. Appoint a PQC Program Owner and Establish Governance
Designate an accountable owner with authority across information technology (IT), security, legal, procurement, and business units; require regular reporting to senior leadership and the board; and integrate quantum risk into enterprise risk management.
2. Conduct a Comprehensive Cryptographic Inventory (CBOM)
Catalog systems, applications, vendors, and repositories using public-key cryptography; record applicable standards and classify assets by sensitivity and confidentiality lifecycle, including trade secrets, unpublished inventions, privileged communications, and access credentials.
3. Develop and Execute a PQC Migration Roadmap
Build a phased roadmap prioritizing long-lived data exposed to HNDL collection and systems controlling operational access; set milestones, budgets, and testing protocols; and consider hybrid classical/PQC protections where available.
4. Mandate Cryptographic Agility for All New Deployments
Require every new system, application, and procurement to support algorithm changes without wholesale replacement to avoid adding new legacy constraints and to enable adoption of evolving NIST standards.
5. Strengthen Vendor and Supply Chain Contract Provisions
Engage vendors on PQC roadmaps and include readiness requirements in procurement and renewals, including NIST-algorithm support, cryptographic-component disclosure, vulnerability notice, audit rights, and remedies for non-compliance.
6. Review and Align Cyber Insurance Coverage
Review coverage for gaps or exclusions involving quantum-enabled attacks and later decryption of stolen data, and be prepared to present a documented PQC strategy at renewal.
7. Monitor Evolving Technological and Regulatory Requirements
Monitor NIST, CISA's cryptographic bill-of-materials guidance, FAR Council rulemaking, implementation guidance under both orders, international requirements, and technological milestones affecting Q-Day. Companies using or transferring quantum-enabling technologies internationally also should evaluate export-control and research-security exposure.
Conclusion: Don't Let AI Eclipse Quantum Readiness
Q-Day may be several years away, but HNDL means data intercepted today may already be exposed. NIST's final standards and the federal timetable make a documented, prioritized PQC program prudent for businesses. The last thing to do is pour all resources into GenAI while forgetting to invest in PQC. Businesses should instead pair GenAI-driven innovation with cryptographic agility, aiming to migrate to a post-Q-day environment in anticipation of protecting sensitive information and assets.
For questions regarding the quantum-computing landscape, post-quantum readiness, and risk mitigation, please contact Bruce C. Doeg, Steve F. Wood, Dominic Rota, Madison "MJ" McMahan, or any member of Baker Donelson's Quantum Technology Group.
October is National Cybersecurity Awareness Month
Observed annually in October, Cybersecurity Awareness Month is a collaborative effort between the public and private sectors to raise awareness about cybersecurity. It was launched in 2004 by the U.S. Department of Homeland Security (DHS) and the National Cyber Security Alliance (NCSA).
Throughout Cybersecurity Awareness Month, we will provide proactive tips and information in order to mitigate your cyber risks.