CISA publishes a post-quantum shopping list for agencies. Security professionals aren’t sold

CISA released guidance to steer federal procurement toward post-quantum cryptography, identifying product categories with available or encouraged PQC capabilities and acknowledging gaps in areas like digital signatures and authentication. Expert commentary highlights the immaturity of standards and protocols, the difficulty of cryptographic discovery and inventory, performance and interoperability tradeoffs, and the risk that “PQC-capable” claims reflect partial protection and marketing rather than verifiable, end-to-end quantum-safe security.