How IT vendors should approach the federal post-quantum cryptography market

With a deadline for federal agencies to implement their post-quantum cryptography (PQC) strategies by 2035, government cyber experts are actively working on charting their course in the post-quantum world to come.

 Because some previously accepted cybersecurity solutions will be phased out as a part of this move toward a quantum world, there are opportunities for IT vendors.

This post-quantum focus was underscored in the recently released Cyber Strategy for America. Last fall, the Defense Department in a November 2025 memo to senior Pentagon leadership, combat commands, and field activity directors, laid the groundwork for migrating to PQC. This guideline memo built on the Quantum Computing Cybersecurity Preparedness Act of 2022, which requires agencies to assess how they use potentially vulnerable cryptography and develop a PQC transition timeline.

Defense cybersecurity requirements

Under the defense memo, agencies will be required to receive cryptographic intake and deployment approval before testing, evaluating, piloting, investing in, using, or deploying “quantum resistant or quantum resilient technologies.”

DOD has banned the use of certain technologies in providing confidentiality, authenticity, or integrity in defense networks and communications, including:

• Quantum key distribution (QKD)
• Solutions combining QKD with other cryptographic key establishment
• Quantum communications or networking
• Non-local quantum randomness generation
• Non-FIPS random number generation

DOD is also phasing out several previously accepted cybersecurity solutions. They will not test, pilot, use, or procure commercial solutions for these technologies:

• Cryptographic pre-shared keys (PSK) solutions that are not provisioned through NSA Key Management Infrastructure for Type 1 devices. This will be phased out by December 31, 2030.

• Symmetric key establishment protocols, symmetric key agreement protocols, and symmetric key distribution protocols. These will be phased out by December 31, 2031. DOD will not test, pilot, use, or procure commercial solutions of this type for quantum resistance.

Potential sales plays for IT vendors

With this understanding, what is the best way forward for IT vendors supporting the Defense Department?

Reach out to PQC migration leads. These leads are assessing the current state of cryptographic systems for PQC migration and are responsible for PQC acquisition requirements. These PQC leads will likely sit somewhere within component CIO offices.

Assist with inventory phase and get in early. PQC migration requires identification, inventory and reporting of all cryptographic systems across defense networks. These systems include national security systems (NSS), non-NSS, business systems, weapons systems, cloud computing capabilities, mobile devices, physical access control systems, Internet of Things, unmanned systems, operational technology and all other cryptographic-related technology.  

Gathering an inventory of all cryptographic systems is a huge undertaking. It will likely require the assistance of technologies such as AI.

Pitch NIST algorithm-based solutions. Unlike the wider push for commercial solutions across the DOD, when it comes to PQC the department wants to help ensure any solution they are using is based on the approved NIST algorithms. To help ensure solutions use NIST-approved algorithms is the only way to sell PQC-related technologies to the DOD.

DARPA leads the way. PQC is very much in the research and development phase across the department, and DARPA’s Quantum Benchmarking Initiative, which has $282 million in funding for fiscal 2026, is currently the largest PQC-related program in the Defense Department.

The PQC initiative has opportunities not solely related to PQC solutions themselves, but any technology that can help support research, development, test, and evaluation efforts around the technology. This opens opportunities for solutions related to red teaming, AI, project management and other supportive technologies and solutions.

Quantum security efforts exist now. Quantum computing and sensing are an R&D play. Because the Defense Department intends to be fully quantum secure by 2031, opportunities related to quantum computing, quantum sensing and quantum networking are in preliminary R&D stages and will likely take longer to mature.

Speak directly to R&D program needs, it’s useful to know where some of the emphasis is being directed toward.

NSF National Quantum Virtual Laboratory. This program supports infrastructure and testbeds to develop quantum technologies in academic settings. Pilots include quantum frontiers, quantum information science (QIS) workforce education and training, and outreach activities.

Department of Energy (DOE) QIS Support Technology and Infrastructure: The QIS program includes facilities such as the Nanoscale Science Research Center, quantum computing and networking testbeds, foundries for superconducting qubits, and technologies producing isotopes for quantum systems.

Civilian quantum R&D plays are limited to these two agencies (NSF and DOE) and their initiatives. Potential sales avenues here would be restricted to solutions for learning content management, hardware (i.e., computing, sensing and networking), and data collection/analysis.

A 2031 deadline for PQC compliance across federal agencies is not as far off as it seems, given the scope of the inventory and analysis of cyber systems required of agencies. Combined with the fact that some previously accepted technologies will be eliminated, vendors need to start working on their PQC sales strategies now and look at these federal requirements as new opportunities to grow their business.

Grier Egan and Joshua Iseler are senior market intelligence analysts for immixGroup, a public sector business of Arrow Electronics. immixGroup delivers mission-driven results through innovative technology solutions for public sector IT. immixGroup can assist you in discovering the specifics surrounding PQC opportunities. We can help you find where agencies are focusing their attention and how to make the correct contact by reaching out to us here.