Treasury launches task force to prepare financial sector for quantum cyber threats

The Treasury Department announced a new effort Monday to help the financial sector replace widely used cryptographic tools that could eventually be broken by quantum computers.

The Quantum-Readiness Task Force will bring together government officials, financial institutions, market infrastructure operators and technology providers to coordinate the shift to post-quantum cryptography. Those protections are designed to withstand attacks from both conventional computers and future, more powerful quantum systems.

Financial institutions are widely considered high-value targets for hackers because they hold vast amounts of money and sensitive data and operate payment systems whose disruption can ripple across the economy.

A sufficiently advanced quantum computer could break many of the cryptographic tools that protect financial records, payment systems and market transactions. The technology does not yet exist, though cyber adversaries can collect encrypted information today and retain it in hopes of decrypting it once quantum capabilities improve, in a practice commonly dubbed “harvest now, decrypt later.”

The Treasury task force will divide its work among coordinating the financial sector’s broader post-quantum transition, assessing the readiness of technology vendors and other third parties and examining risks involving digital assets and emerging technologies.

Treasury said the group will also work to identify critical dependencies, improve interoperability and promote “cryptographic agility,” or the ability to replace encryption methods as security standards and threats change.

“Post-quantum cryptography readiness is no longer a future-proofing exercise — it is a present-day risk control,” said Deborah Guild, chair of the Financial Services Sector Coordinating Council and head of technology at PNC Financial Services Group. Guild said organizations will need to prioritize their most important systems while managing dependencies throughout the financial ecosystem.

The task force builds on a roadmap released in January by the G7 Cyber Expert Group, which is co-chaired by Treasury and the Bank of England. The roadmap calls on financial institutions to inventory where cryptography is used, assess their most sensitive systems and data, develop migration plans and test quantum-resistant technology.

The G7 document points to 2035 as a general target for completing the financial sector’s transition, though it describes that timeline as nonbinding and subject to change as quantum technology develops.

Treasury’s announcement also follows President Donald Trump’s June executive order directing the federal government and critical infrastructure sectors to accelerate preparations for quantum-backed cyber threats.

The Office of Management and Budget subsequently told agencies to inventory their cryptographic systems and account for software vendors and other third parties in their migration plans, as Nextgov/FCW previously reported.

Federal agencies have also begun applying those instructions to individual systems. The General Services Administration said Monday that it is updating the government’s identity and access-management framework and expanding security testing for federal building credentials to accommodate quantum-resistant technology.