Preparing Federal Data for the Post-Quantum Era
By Matt Trudewind and Bill Rulo
How NetApp helps Federal Agencies adopt PQC and meet requirements today
Bottom line: Adversaries can collect encrypted federal data today and keep it until future quantum computers can unlock it. Agencies therefore need to begin updating the systems that protect long-lived mission data now. NetApp helps protect that data where it is stored, accessed, moved, and recovered—without requiring agencies to replace their existing storage infrastructure. |
|---|
Harvest now, decrypt later: The threat is already underway
Most encryption works like a digital lock: authorized users have the key, while everyone else sees unreadable data. Quantum computers could eventually open some of today’s widely used locks much faster than conventional computers. Post-quantum cryptography, or PQC, replaces those vulnerable locks with new mathematical protections designed to resist both conventional and quantum attacks.
Quantum computing is no longer just a research topic for labs, academia, and science fiction. For federal agencies, especially Intelligence Community (IC) and the Department of War (DoW) - the security implications are becoming very real, very quickly.
The concern is not simply what a quantum computer can do today. The bigger concern is what adversaries are already doing in preparation to utilize quantum computers to decrypt and unlock data in the near future.
One of the most urgent risks is called a harvest-now-decrypt-later attack. An adversary steals encrypted data or network traffic today, stores it, and waits until a sufficiently capable quantum computer can break the public-key encryption protecting it. That future point is sometimes called Q-Day. Data that appears unreadable today could then be exposed after it has already left the agency’s control.
This threat attack matters more for federal agencies because some mission and intelligence data must remain confidential for decades, potentially longer than the encryption protecting it remains safe. Examples include intelligence reporting, defense plans, weapons-system information, National Security System (NSS) data, citizen records, and long-term archives.
That is why post-quantum cryptography, or PQC, is not just a future compliance exercise. It is an existing and substantial threat to data security that agencies need to plan for now. Federal agencies cannot control when Q-Day will occur, however they can control whether the mission data they are protecting today will still be protected when Q-Day arrives.
Federal PQC guidance is moving into acquisition decisions
Federal policy is moving PQC from long-range planning into near-term acquisition and deployment decisions. White House Executive Orders 14306 and 14412 establish direction for strengthening cybersecurity and preparing for advanced cryptographic attacks. For National Security Systems, NSA’s Commercial National Security Algorithm Suite 2.0, or CNSA 2.0, identifies approved algorithm families and expected transition milestones. The practical message for system owners and vendors is clear: identify where vulnerable cryptography is used, plan the transition, and include PQC readiness in budgets and procurements now.
The transition timeline is especially important for IC and DoW customers. NSA’s CNSA 2.0 guidance identifies January 1, 2027, as the target for new National Security System acquisitions to be CNSA 2.0 compliant where required; December 31, 2030, as the target for equipment and services that cannot support CNSA 2.0 to be phased out; and December 31, 2031, as the target for CNSA 2.0 algorithms to be mandatory for National Security Systems, subject to the applicable policy, mission, and implementation guidance.
Be aware there is some nuance here. The January 1, 2027 date is referenced in the NSA CNSA 2.0 FAQ, while the CNSSP-15 (Committee on National Security Systems Policy No. 15) is currently the policy anchor. Because of that, some agencies may treat the 2027 milestone as strong acquisition guidance rather than a hard requirement across every environment. But for NSS, procurement cycles, and mission systems being designed today, the practical takeaway is clear: PQC readiness is becoming a near-term purchasing decision, not a distant roadmap item.
What NIST standardized—and why it matters
In August 2024, the National Institute of Standards and Technology (NIST) finalized its first three PQC standards after a multi-year international process. The standards identify quantum-resistant methods for two basic security functions: creating protected connections and proving that a user, system, certificate, or software update is authentic. Over time, these methods will replace vulnerable public-key algorithms such as Rivest-Shamir-Adleman (RSA), Elliptic-Curve Cryptography (ECC), and Digital Signature Algorithm (DSA).
- The three standards address two practical needs. Module-Lattice-Based Key-Encapsulated Mechanism (ML-KEM) helps two systems establish a shared secret for a protected connection. Module-Lattice-Based Digital Signature Algorithm (ML-DSA) and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) provide quantum-resistant digital signatures that help verify identity and confirm that software, messages, or certificates have not been altered. The table below maps the formal standard names to those everyday functions.
The initial NIST PQC standards
Standard | Algorithm | Primary use |
|---|
FIPS 203 | ML-KEM | Key establishment, including TLS and encrypted communications |
FIPS 204 | ML-DSA | Digital signatures, authentication, and certificates |
FIPS 205 | SLH-DSA | Hash-based digital signatures and code-signing use cases |
These standards matter to storage because federal data is exposed through more than the media on which it resides. Risk also arises when administrators manage systems, applications access data, storage systems replicate data, certificates authenticate connections, and software or firmware is verified.
NIST has also made clear that agencies and organizations should begin migrating systems to quantum-resistant cryptography now, and that cybersecurity products, services, and protocols will need updates as organizations identify where vulnerable algorithms are used.
NetApp perspective: The data layer belongs in the PQC plan
NetApp provides data infrastructure software and systems that organizations use to store, manage, protect, and move data across data centers, remote locations, and cloud environments. Its core storage operating system, ONTAP, provides the software capabilities that control how data is accessed, replicated, encrypted, and recovered.
A lot of the PQC conversation focuses on networks, browsers, PKI, and applications. Those are all important. But for federal agencies, the data/storage layer is just as critical.
Why? Because storage is where the mission data lives.
An agency’s PQC plan must protect more than websites and network connections. Storage systems are where mission data remains for years or decades, where administrators manage it, and where copies move between locations for continuity and recovery. If those management and data-transfer paths continue to use vulnerable cryptography, the agency has closed only part of the security gap.
That is where NetApp can help.
Beginning with ONTAP 9.18.1, NetApp can use NIST-standardized post-quantum methods for specific ONTAP connections. This includes replication connections for on premises or cloud-based ONTAP instances. In practical terms, these capabilities are intended to protect selected administrative and data-movement paths that use supported TLS and certificate workflows. Agencies should validate the exact platform, protocol, certificate, and deployment requirements for each use case. The connections administrators use to manage storage and the connections systems use to move protected copies of data should also be evaluated. The relevant underlying standards are ML-KEM for establishing protected connections and ML-DSA for digital signatures and authentication.
Many storage operations depend on protected connections and digital certificates. These include the connection an administrator uses to manage a storage system, the connection two systems use to copy data for backup or recovery, and the certificates systems use to confirm that they are communicating with a trusted endpoint. PQC updates the public-key protections inside supported workflows; it does not replace every form of encryption in the storage environment.
End-to-end PQC capabilities without a rip-and-replace model
A software-based delivery model can reduce transition effort for supported systems. Agencies may be able to add PQC capabilities through an ONTAP upgrade rather than deploying a separate appliance or replacing the storage platform.
NetApp currently provides end-to-end PQC encryption for all mission and enterprise workloads for both new and existing customers at no additional cost. That is a big deal for federal agencies facing tight timelines, constrained budgets, and complex procurement processes.
Practical federal PQC use cases NetApp helps address
- Management of storage systems: Administrators can manage ONTAP through System Manager GUI and APIs using quantum-resistant TLS and certificate mechanisms.
- Safe replication of data: Data replication workflows for backup and DR can use quantum-resistant algorithms to help protect data as data moves between storage systems.
- Safe access to data: Client-to-storage access protocols, including File, Block, and Object, can benefit from quantum-resistant cryptography provided through IPsec and TLS.
- Encryption at rest: NetApp has used AES-256 to encrypt stored data for well over a decade. Current guidance considers AES-256 resistant to known quantum attacks when it is configured and implemented appropriately. This protection addresses data stored on the system, while PQC primarily updates the public-key methods used to establish trusted connections, exchange keys, and verify identities.
- Layered encryption for classified environments: NetApp Volume Encryption (NVE) provides software-based AES-256 encryption, while NetApp Storage Encryption (NSE) uses self-encrypting drives for hardware-based AES-256 encryption, enabling a layered encryption model validated by the NSA Commercial Solutions for Classified program for hosting top secret data.
Why NetApp is different
Federal cryptographic transitions are routine. When agencies moved from FIPS 140-2 to FIPS 140-3, NetApp’s crypto-agile architecture enabled customer to adopt new validated cryptographic module through an ONTAP software upgrade rather than a hardware refresh. This helped reduce costs, complexity, and operational impact.
NetApp provided an easy path for existing customers utilizing software encryption at rest to do this. A simple upgrade to ONTAP 9.15.1 or later automatically updates the NetApp cryptographic module to a FIPS 140-3 validated module without any impact to existing deployed systems. In other words, NetApp has a history of helping our customer easily transition to new cryptography without impacting existing missions, workflows and operations.
When it comes to the transition to PQC specifically, some vendors may be able to say they support quantum resistant encryption in a narrow use case. But federal customers should ask a more important question: Where does that PQC support actually apply?
Does it protect only CLI access? Only Fiber Channel? Only one management path? Only a narrow protocol? Or does it extend across the operational realities and use cases of how agencies manage, access, move, and protect data?
NetApp differentiation is that PQC support is broader than a single interface or isolated protocol. NetApp supports PQC end-to-end across GUI-based management, API access, replication, certificate authentication, TLS-based operations, client-to-storage encryption in transit, and storage-level encryption. That means agencies are not limited to protecting only one administrative workflow or one data path. The data is protected throughout the entire workflow path, not just for one workload. Whether it’s file, block, or object protocols, from the time data leaves the client endpoint until the data lands on the storage device, it is secure with NetApp’s unique end-to-end PQC encryption.
Because NetApp supports PQC as part of ONTAP core software and capabilities, this helps existing customers move toward quantum-resistant operations for their data layer without adding cost or complexity through a separate purchase.
Key questions every agency should ask
Which data must remain confidential for decades? |
|---|
Which storage workflows rely on vulnerable public-key cryptography? |
Which systems will still be operational beyond 2030? |
Are current acquisition programs evaluating PQC readiness? |
Does the platform support future cryptographic transitions without hardware replacement? |
The bottom line
For federal agencies, PQC is not only about preparing for Q-Day. It is about protecting long-lived mission data from adversaries who may already be collecting encrypted information today.
The government guided timeline is fast approaching. NIST standards are available. CNSA 2.0 is shaping procurement expectations. IC and DoW agencies need solutions that help them modernize cryptography without disrupting mission operations.
NetApp helps federal customers take a practical, data-centric approach to post-quantum readiness. Supported PQC capabilities protect selected management, authentication, and replication workflows, while established AES-256 controls continue to protect data at rest. Together, these controls support a layered strategy for safeguarding the data layer where mission information ultimately resides. NetApp delivers these capabilities through ONTAP software updates at no additional cost for new and existing customers, enabling agencies to prepare for the post-quantum era today - without waiting for a rip-and-replace cycle tomorrow.
The Data Layer Should Be Part of Every PQC Roadmap
Most discussions about post-quantum cryptography focus on networks, applications, and PKI. Federal agencies must also evaluate the infrastructure where mission data is stored, protected, replicated, and recovered.
As agencies build their post-quantum roadmaps, they should ask whether their data infrastructure can:
- Protect long-lived mission data from harvest-now-decrypt-later threats.
- Support evolving quantum-resistant standards.
- Adapt to future cryptographic requirements through software-driven crypto-agility.
- Enable modernization without disrupting ongoing operations.
The agencies that prepare their data layer today will be better positioned to secure mission outcomes tomorrow.
