"Our adversaries are using quantum. How advanced are their capabilities? We don't totally know." — Matt McFadden, vice president of cyber for GDIT
Executive Order 14412: firm dates, narrow tasks
The White House set deadlines for federal agencies in an executive order issued June 22 that focus the Pentagon’s work. By Dec. 31, 2030, high-value assets and high-impact systems must "use PQC for key establishment." A separate deadline requires agencies "to use PQC for digital signatures" by 2031. The order gives defense organizations a defined timetable and concentrates early effort on specific cryptographic functions rather than an open-ended rewrite of every system.
GDIT’s Matt McFadden on inventory, third parties, and "harvest now, decrypt later"
At the TechNet Info-Pacific conference in Honolulu, Matt McFadden warned that the principal technical and programmatic hurdle is knowing what exists today. "It's hard to migrate when you don't know what you have. So, really, the first step in this process is really having a comprehensive inventory," he said, listing certifications for apps, devices, and networks as part of that inventory work. McFadden repeated the familiar quantum-era worry: "harvest now, decrypt later," noting that adversaries can collect encrypted data today and wait until a quantum computer can break classical encryption.
He also emphasized supply-chain and third-party risk: "You're very reliant on third-party providers…you’ve got to really work together with the system owners, the third-party suppliers, your supply chains, and basically build that governance team to help drive" compliance and crypto agility.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePacific Air Forces’ Col. Tassika Davis on cryptographic agility and mapping systems
Col. Tassika Davis framed the challenge as architectural as well as cryptographic. "It’s just this one more threat vector that we have to be concerned about as we develop our resilient architecture," she said, and urged resilience that avoids degrading mission capability while upgrading defenses. That requires making architectures "cryptographically agile, so that we can shift and move and continue, and not degrade mission capability, while we are also providing the most current defense capabilities."
Davis said planning must begin with comprehensive mapping: "looking at it from the entire threat picture, and then planning against that." In short: know the IT ecosystem as it exists today before choosing where and how to insert post-quantum algorithms.
Pacific Fleet’s Capt. Victor Taylor on modernization windows and scale
Operational realities complicate any centralized schedule. Capt. Victor Taylor described platforms that do not remain in one place long and maintenance cycles that have evaporated. "Ships are being extended more than they have been. There are crises that are popping up everywhere. And we used to be in a period of [maintenance] availabilities, which means we had about nine months to a year to do modernization. Now you’ve got 45 days," he said.
That compression raises a set of execution problems: breaking large modernization efforts into modular, shorter windows; maintaining configuration management; staffing teams capable of work "at scale at multiple locations;" and re-scheduling continuously as operational demands change.
Quantum Sky’s Peter O’Donoghue: awareness, funding, and no single playbook
Peter O’Donoghue, Quantum Sky’s chief technology officer, pushed two practical imperatives: treat the threat as real and fund the work. "Q-Day isn't a thing that's going to be beyond our retirement. Q-Day is going to be a thing that happens…definitely within the next five years," he told Defense One after the panel. "So, then you need to plan for it. You need to actually fund it."
O’Donoghue noted the Pentagon released a post-quantum cryptography strategy earlier this year and suggested implementation "could be added to the Pentagon’s existing network modernization." He was explicit about approach: "There's no one-size-fits-all [solution], but I think each department, each agency needs to actually understand what the risk is and start buying it down and taking action. Like sitting on your hands and going into a kind of analysis paralysis is not the answer. Denying it is definitely not the answer either."
What this means for Pacific Air Forces, Pacific Fleet, and federal agencies
- Pacific Air Forces: must make cryptographic agility central to resilient architectures and map their IT ecosystems "from the entire threat picture" before migrating to PQC.
- Pacific Fleet: faces compressed maintenance windows and will need modular modernization plans, distributed teams, and tighter configuration management to retrofit ships within 45-day availabilities.
- Federal agencies (under Executive Order 14412): have concrete deadlines for PQC adoption on key-establishment (Dec. 31, 2030) and digital signatures (2031), and will need inventories, supplier governance, and funding to meet them.
The task before the Pentagon is procedural as much as technical: identify what must be protected, work with system owners and suppliers to design and schedule modular upgrades, and fund sustained execution before the clock on the executive order runs out. The people on the panel—service operators and private-sector technologists alike—left the question of pace unanswered, but their prescriptions were consistent: inventory, governance, agility, and money.
