Is Your State Government Prepared for Quantum Computing?

Quantum computers will likely one day be capable of breaking the encryptions that protect public data — social security numbers, health care information, as well as access to state and local public safety and emergency service systems. That day — known as Q-Day — could come as soon as 2029.

The Howard Center identified:

Actively preparing

Committed

Aware

No action

Not enough information

Tap or click any state for the full assessment. Small Northeastern states are labeled at right.

Methodology

In order to assess how ready state governments are for post-quantum computers being able to break encryptions, The Howard Center categorized whether each state was requiring, actively working towards, committing to, or merely acknowledging the need to migrate all state agencies to post-quantum cryptography (PQC).

For all 50 states, The Howard Center:

Reviewed each publicly available information security policy or encryption standard
Identified and reviewed any publicly available strategic IT or cybersecurity plan
Searched each state government's website for any mention of “quantum” and reviewed relevant results
Filed a public records request with every state for “any post-quantum cryptography readiness plan, implementation roadmap, migration timeline, or policy adopted or in development”

In total, more than 200 documents were reviewed. Each state was then classified by the strongest available evidence at the time of writing.

States were graded on a scale:

Green — Actively preparing: These states have current, official policies requiring state agencies to migrate to PQC or have directly confirmed the existence of an official and active migration plan.

Yellow — Committed: These states have formally committed to developing a plan for state agencies to migrate to PQC, or the development of a migration plan is in process.

Orange — Aware: These states have demonstrated an understanding of the risks posed by quantum computing but have not committed to developing a PQC migration plan. The quantum threat has been named by a task force, an advisory body, an official statement or a state website, and the state may be researching or evaluating whether a plan is needed.

Red — No action: These states show no evidence of agency-wide preparation. Reporters found no post-quantum requirement, plan or acknowledgment in these states’ public policies, strategies or records response. A state also falls here when its only quantum activity is economic or workforce focused.

Not Enough Information: These states could not be ranked on the evidence available. Either the public records request had not been fulfilled at the time of writing, or the state withheld the determining records under a security exemption and would not confirm or deny that a plan exists.