The government made a list of what "quantum-safe" products look like

When someone asks whether a company is "quantum-ready," the honest answer used to be a question of its own: ready compared to what? There was no shared picture of what a quantum-safe product even looks like. In January 2026, the US government started drawing one.

What happened

CISA, the US government's cybersecurity agency, published a list of the kinds of technology that support, or are moving to, the new post-quantum encryption standards. It was put together with the National Security Agency, and it followed an executive order that told the government to help buyers find products that are ready.

First, the background in one line: a powerful enough quantum computer, which does not exist yet but is being built, could break the encryption that protects almost everything online today. New standards to replace it were finalized in 2024. The question now is which products actually use them.

What is on the list

Not specific brands, but categories, grouped by what they do:

• Cloud services
• Web software and browsers
• Networking hardware and software
• Endpoint and device security

For each one, the list points at the two jobs encryption quietly does: setting up a private connection so no one can listen in, and proving who you are and that data was not tampered with.

Why it matters

This is the government beginning to define "quantum-ready" as something you can shop for. It is guidance, not a mandate, so no one is forced to buy anything. But it is the start of quantum-readiness turning into a line on a purchasing checklist and a security questionnaire. When a bank or a partner asks a vendor whether their products are quantum-safe, a list like this is what the question gets measured against.

If you are choosing or renewing technology right now, it is a good reason to ask suppliers a plain question: does this support the post-quantum standards yet, and if not, when will it?