CISA Post-Quantum Considerations for Operational Technology

CISA’s Post-Quantum Considerations for Operational Technology is a CISA guidance document that looks at how future quantum computers could weaken the public-key cryptography that industrial control systems and other operational technology (OT) depend on. It tells owners and operators how to limit that exposure while device-level migration catches up.

The document builds on these efforts by examining the specific risks that quantum computing could pose to industrial control systems (ICS) and other operational technology (OT). The target audience for this document is U.S. critical infrastructure owners and operators that rely on OT systems, networks, and other environments that have cryptographic dependencies today or will have them in future. For organizations that connect plants, substations, pumping stations or remote sites over shared networks, the most practical part of the guidance is about protecting those connections.

What does CISA’s Post-Quantum Considerations for Operational Technology guidance recommend?

CISA recommends four lines of action: limit OT’s exposure through strong network segmentation, use quantum-resistant algorithms where appropriate, build crypto-agility into applications and protocols, and include quantum risk in update and upgrade lifecycles. The guidance treats this as planning work to start now, not something to postpone until a quantum computer arrives.

In CISA’s words, OT vendors, owners, and operators should plan for emerging CRQC capabilities and implement mitigations, including minimizing OT exposure to quantum threats via strong OT network segmentation, using quantum-resistant algorithms where appropriate, ensuring crypto-agility in applications and protocols, and applying quantum mitigation considerations to platform update schedules and upgrade lifecycles.

This fits CISA’s broader message to critical infrastructure. “Critical infrastructure and government leaders must be proactive and begin preparing for the transition to post-quantum cryptography now,” said Mona Harrington, acting Assistant Director of the National Risk Management Center at CISA.

Which OT cryptography use cases does CISA say are at risk from quantum computers?

CISA identifies three areas of exposure: OT’s connections to IT, public-key encryption and decryption, and public-key signing, validation and identity functions. OT generally relies on cryptography less than IT does, but the cryptography it does use often sits at the most sensitive points.

The guidance states that operational technology (OT) platforms, networks, and environments are often less dependent on cryptography than information technology (IT) platforms but may be vulnerable to cryptanalytically relevant quantum computer (CRQC)-enabled intrusions in rare critical instances. It adds that OT specifically may be vulnerable due to connectivity or association with IT platforms as well as direct or indirect dependencies on public-key cryptographic features including encryption and decryption, signing and validation schemas, and identity and access management mechanisms.

Mapping the categories to real OT assets

• Encryption and decryption: tunnels between control centers and remote sites, links from historians to cloud analytics, and vendor or engineer remote access sessions.
• Signing and validation: signed firmware and software updates, and signed configuration or logic downloads to controllers.
• Identity and access management: certificate-based authentication of devices, gateways and users, including access brokers that sit between IT and OT.

More broadly, CISA warns that cyber intrusions and compromises leveraging future quantum computing capabilities may threaten data confidentiality and integrity or undermine important access controls dependent on public-key cryptography. The confidentiality risk matters right away. Encrypted OT traffic that crosses public or shared networks today could be recorded and decrypted later, so the risk window opens before any quantum computer exists.

Why does CISA expect OT to be among the last systems to migrate to post-quantum cryptography?

OT equipment runs for decades, has to stay available and often depends on the vendor for any cryptographic change, so it will migrate more slowly than IT. That is why the guidance emphasizes exposure reduction and lifecycle planning over immediate device replacement.

Several features of OT drive this. Controllers, RTUs and protection relays stay in service far longer than IT refresh cycles. Patching or replacing them needs outage windows and safety revalidation. The cryptography inside them is usually under the vendor’s control, not the operator’s. This is why CISA ties quantum mitigation to platform update schedules and upgrade lifecycles rather than calling for immediate upgrades.

Earlier joint guidance already pointed in this direction. The CISA, NSA and NIST quantum-readiness factsheet notes that prioritization should be given to high impact systems, industrial control systems (ICSs), and systems with long-term confidentiality needs, and that organizations should also begin to ask their vendors how they are addressing quantum-readiness and supporting migration to PQC.

At national level, CISA has looked at the problem through the lens of National Critical Functions:

• 55 National Critical Functions analyzed (CISA, 2022): CISA analyzed how each of the 55 NCFs is vulnerable to quantum computing capabilities. CISA ranked each NCF as high, medium, or low priority based on the urgency of its dependencies on the current cryptographic standards, the scope and scale of organizations and systems that will require updates, and the relative costs to organizations to upgrade to the new standard.

For operators, Sector Risk Management Agencies are the natural partners for turning this national prioritization into sector-specific decisions about which functions and assets come first.

How do network segmentation and quantum-resistant VPNs reduce OT exposure to quantum threats?

Segmentation shrinks the number of places where quantum-vulnerable cryptography guards OT traffic. Quantum-resistant tunnels then protect the few conduits that remain, so traffic between sites, the cloud and remote users stays confidential even if it is recorded today and attacked later.

Segmentation is not new to OT, but the quantum angle gives it a specific job: every connection crossing an OT boundary is somewhere that public-key key exchange protects data in transit. Fewer and better-defined conduits mean fewer places that need quantum-resistant protection. CISA’s newer connectivity guidance supports this design approach:

• 8 principles (CISA and NCSC-UK, January 14, 2026): this guidance outlines eight principles to use as a framework to design, secure, and manage connectivity into OT environments.

CISA and the UK National Cyber Security Centre (NCSC-UK), in collaboration with federal and international partners, have released Secure Connectivity Principles for Operational Technology (OT). NCSC-UK’s CTO Ollie Whitehouse put it this way: “it is vital cyber security is treated as a foundational requirement that supports physical safety outcomes, uptime and service continuity”.

What makes a tunnel quantum-resistant

The part of a VPN that is vulnerable to quantum attack is the public-key key exchange. Symmetric payload encryption is not the weak point. NIST’s standard for the post-quantum replacement is FIPS 203:

• FIPS 203, published August 13, 2024, three parameter sets (NIST): This standard specifies a key-encapsulation mechanism called ML-KEM. At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer. In order of increasing security strength and decreasing performance, these are ML-KEM-512, ML-KEM-768, and ML-KEM-1024.

A common design is a hybrid key exchange, which combines a classical exchange with ML-KEM so the session stays protected as long as either one holds. Quantum Network’s Quantum Gateway follows this pattern: it combines a classical part and an ML-KEM part into one session key, encrypts at Layer 3 and works alongside existing firewalls and routers instead of replacing them.

Applying this to the three typical OT connection types

Where OT sites run isolated or air-gapped networks, the same tunnel principle applies to internal links between segments. The design choice is less about the algorithm and more about where the conduits are and whether existing inspection points stay in the traffic path.

Why are OT and IoT devices excluded from CISA’s PQC product categories list?

CISA’s PQC product categories list only covers traditional IT products, mostly the kind the federal government buys, so OT and IoT devices fall outside its scope. CISA states explicitly that these devices should still be moving to PQC.

The list exists because of a presidential order. On June 6, 2025, President Trump issued Executive Order 14306 that directed DHS, acting through CISA, to publish a list of product categories of widely available products that support post-quantum cryptography (PQC).

• Deadline of December 1, 2025 (EO 14306, via CISA): By December 1, 2025, the Secretary of Homeland Security, acting through the Director of the Cybersecurity and Infrastructure Security Agency (CISA), and in consultation with the Director of the National Security Agency, shall release and thereafter regularly update a list of product categories in which products that support post-quantum cryptography (PQC) are widely available.

The lists focus on categories of available products, typically acquired by the federal government, that utilize cryptographic algorithms. The exclusion is stated in a note: the above lists exclude categories of hardware and software products, such as operational technology (OT) and internet of things (IoT) devices, that are not considered traditional IT products. These also should be transitioning to PQC standards as well but are out of scope for these lists.

The practical effect for OT owners is that the list still matters, just indirectly. Networking hardware such as proxy servers, routers, firewalls, switches, appliances appears in the categories, and that kind of equipment sits at the edge of OT networks. CISA’s Acting Director Madhu Gottumukkala said that “to stay ahead of these emerging risks, organizations must prioritize the procurement of PQC-capable technologies.” For OT, this means asking for PQC capability in the connectivity layer now and adding it to OT device specifications as vendors catch up.

How should OT owners turn CISA’s guidance into a migration plan?

Start with an inventory of where public-key cryptography protects OT traffic and access. Then protect the external conduits first and build PQC requirements into vendor and lifecycle decisions. This order follows CISA’s own recommendations and reflects how slowly OT changes.

1. Inventory cryptographic dependencies. Record every tunnel, certificate, signed update mechanism and remote access path that crosses an OT boundary.
2. Rationalize conduits. Use the Secure Connectivity Principles for Operational Technology to cut the number of connections into OT zones before deciding which ones to upgrade.
3. Protect links in transit first. Move site-to-site, edge-to-cloud and remote access tunnels to hybrid key exchange based on FIPS 203. This is the part that does not depend on field-device vendors.
4. Demand crypto-agility. Prefer equipment and software whose algorithms can be updated in the field, because future revisions of the standards are likely.
5. Write PQC into lifecycles. Add PQC support for signing, updates and authentication to procurement specifications for the next generation of controllers and gateways.

Taken together, CISA’s guidance makes clear that OT does not have to wait for its slowest assets. Segmentation and quantum-resistant protection of connections between sites, cloud environments and remote users can reduce exposure now, while device-level migration follows equipment lifecycles.