The General Services Administration’s latest post-quantum update makes an important point that is easy to miss: migrating cryptography is not confined to websites, databases, and network tunnels. It reaches into the identity systems and physical access infrastructure that determine who—or what—can enter a building, use a service, or act with authority.
In its August 24 announcement, GSA described its work to modernize Federal Identity, Credential, and Access Management architecture. The agency is updating FICAM for quantum-resistant algorithms, expanding laboratory testing for physical access control systems, and coordinating an interagency working group on identity modernization in a post-quantum environment.
This is more than an algorithm-selection exercise. It is a cryptographic inventory and dependency-management problem.
Identity depends on cryptography in more places than most inventories show
An identity transaction may involve certificates, signatures, trust anchors, tokens, hardware, middleware, protocols, validation services, and upstream identity providers. A physical access system adds readers, badges, controllers, enrollment systems, and procurement requirements. Non-human identities add service accounts, devices, workloads, automation, and machine credentials.
If an organization records only its internet-facing certificates or approved algorithms, it does not yet have enough information to govern this transition.
A useful inventory must connect cryptographic evidence to the system that uses it, the business or mission function it supports, its owner, its suppliers, and the other components that depend on it. It must also distinguish what was actually observed from what is merely expected based on policy or documentation.
That distinction matters. A design document may say that a service uses an approved mechanism while a deployed component still negotiates an older protocol. A product specification may describe future PQC support that is not enabled in the installed release. A credential may be issued with one algorithm while relying on a chain, validation service, or hardware module with a different migration timeline.
Inventory must therefore be evidence-based and continuously maintained. An unobserved area is not proof that vulnerable cryptography is absent.
GSA is connecting crypto agility to interoperability
GSA says its FICAM modernization emphasizes crypto agility: the ability to change cryptographic methods as threats, standards, and implementations evolve. That is especially important in identity systems because independently managed components must continue to interoperate throughout a staged migration.
Crypto agility is sometimes described as a property of code. Operationally, it is also a property of governance.
An organization cannot change cryptography safely unless it can answer questions such as:
- Which identities and transactions depend on this algorithm or certificate chain?
- Which applications, devices, and vendors participate in each trust relationship?
- Which components can support classical and post-quantum mechanisms during transition?
- Where would a change break enrollment, authentication, authorization, or recovery?
- Who owns the decision, and what evidence demonstrates that the migration worked?
These questions require relationships, not a flat spreadsheet. They also require history. Teams need to know what changed, why it changed, who approved it, and whether subsequent observations confirmed the intended result.
Physical access brings procurement into the migration
GSA is also expanding its Physical Access Control System laboratory work to evaluate quantum-resistant solutions. Products used by federal agencies must meet security and interoperability requirements to qualify for the relevant approved-products list.
This creates a useful lesson for organizations outside government: cryptographic migration has to reach procurement and supplier management.
A team may control its own application code but not the cryptographic implementation embedded in a badge reader, appliance, managed identity service, hardware security module, or third-party platform. Those dependencies need their own readiness evidence and upgrade paths.
Procurement questions should become specific:
- Which cryptographic mechanisms does the product use today?
- Which components terminate, verify, or generate cryptographic operations?
- What post-quantum mechanisms are implemented, tested, or planned?
- Is support available in the deployed version or only on a roadmap?
- Can the supplier provide a cryptographic bill of materials?
- How will changes affect interoperability, certification, and support?
- What evidence will confirm that a fielded system uses the intended configuration?
A CBOM can help structure this exchange, but a CBOM should not be treated as a timeless label. Its scope, source evidence, creation time, and relationship to the deployed environment all matter.
Coordination is now becoming operational
GSA reported that the new FICAM modernization working group held its first meeting on August 12 with 40 participants representing 17 federal agencies. The group intends to meet every two weeks and address non-human identities, automation, and other modern identity concerns in a PQC environment.
That cadence is notable. Post-quantum preparation is moving from periodic strategy documents toward recurring operating governance.
The broader federal direction reinforces that change. Executive Order 14412 assigns agency PQC migration leads responsibility for cryptographic inventory management and migration planning. OMB Memorandum M-26-15 calls for prioritized migration, integration with existing governance, comprehensive asset management, and managed supply-chain risk.
Organizations supporting federal systems should not interpret the GSA announcement as a new blanket requirement for every identity product. It is a strong directional signal, however: identity, access, automation, physical security, and procurement are all entering the PQC operating model.
What teams should do now
Start by defining a bounded identity use case—for example, workforce authentication, workload identity, code signing, or building access—and trace its cryptographic dependencies.
Record the systems, credentials, algorithms, protocols, trust chains, hardware, suppliers, and owners involved. Preserve the source and time of each observation. Then evaluate transition readiness and create accountable work for the gaps.
Repeat that process across identity domains rather than attempting an undifferentiated enterprise-wide migration. The result should become a living canonical inventory, not a one-time worksheet.
How Vista Platform can help
Vista Platform is a self-hosted cryptographic system of record built around discovery, canonical inventory, evaluation, action, and proof.
Vista can bring evidence from connected discovery channels into a governed inventory, evaluate cryptographic and PQC state, connect findings to accountable work, and produce scoped CBOM evidence. This can help teams understand which observed cryptography supports affected assets and organize migration decisions without treating a discovery gap as proof of absence.
Vista tracks and governs post-quantum migration. It does not generate PQC keys or perform every migration on an organization’s behalf. Its role is to help make the cryptographic estate and the resulting work visible, traceable, and provable. More detail is available in Vista’s post-quantum overview.
The GSA update is a reminder that identity modernization begins before an algorithm is replaced. It begins when an organization can identify the cryptography involved, understand its dependencies, assign responsibility, and preserve evidence of the outcome.
Sources
- “GSA Leads the Transition to Quantum-Resistant Technology,” U.S. General Services Administration, August 24, 2026.
- “Securing the Nation Against Advanced Cryptographic Attacks,” The White House, June 22, 2026.
- “Execution of the Migration to Post-Quantum Cryptography,” Office of Management and Budget, June 24, 2026.