Quantum Readiness: This Is the Year to Start Preparing

For most firms, quantum computing still sounds like a problem for the future. (In simple terms, quantum computing is a new way of processing information that uses quantum mechanics to solve certain highly complex problems differently than traditional computers.) It belongs in research labs, national security briefings, or a Final Jeopardy question, not in a partner meeting about tax workflow, client portals, document retention, or cyber insurance. However, continuing to treat it as a future problem will become dangerous.

The issue is not that a quantum computer will break your firm's security protocols tomorrow, but that the accounting profession depends on long-lived confidential data, and the security systems protecting that data are already on a downward, transitional path. A breach of that information is not limited to one filing season. It can expose your firm and clients to identity theft, regulatory exposure, litigation risk, reputational damage, and client harm long after the original engagement is complete.

Quantum-readiness is not about buying a quantum computer. It is about understanding whether the tools your firm already uses are preparing for a world in which today’s standards may no longer be sufficient.

What quantum computing means to a non-physicist

Traditional computers process information using bits, which are represented as 0s and 1s. Quantum computers use quantum bits, or qubits, which rely on the properties of quantum physics. For certain types of mathematical problems, a sufficiently powerful quantum computer could be dramatically faster than a classical computer; in many cases, millions of times faster.

That matters because modern cybersecurity relies heavily on math. Public-key cryptography is used throughout the internet to establish secure connections, protect digital signatures, support certificates, authenticate systems, and exchange keys. These methods are considered secure today because classical computers cannot solve the underlying mathematical problems fast enough to make attacks practical.

A sufficiently advanced quantum computer changes that equation. Using quantum algorithms, an attacker with sufficient capability could undermine many public-key systems, all of which we use daily in our firms. Symmetric encryption, such as Advanced Encryption Standard (AES), is also affected, but the most urgent concern for business systems is the public-key infrastructure embedded in nearly every modern application. Many researchers, including those at Google, believe we will face this moment, also known as Q-Day, sooner rather than later.

This is why the cybersecurity community is moving toward post-quantum cryptography. Post-quantum cryptography does not mean cryptography that requires a quantum computer. It means cryptographic algorithms designed to run on today's classical computers while resisting known quantum attacks.

Why accountants should care

Accounting firms are high-value targets because we hold concentrated, verified, financially useful information. A single firm may possess Social Security numbers, bank account information, addresses, payroll data, tax transcripts, financial statements, loan documents, and business transaction records.

That data is valuable today, and some of it will remain valuable far into the future. This creates a 'harvest now, decrypt later' concern; an attacker steals encrypted data now, stores it, and waits until future technology can decrypt it. The attacker does not need quantum capability today to create future risk.

For accounting firms, this matters in several areas.

Client portals and document exchange systems depend on encryption to protect uploads, downloads, messages, and stored files. Firms often assume that if a vendor says data is encrypted, the risk is handled. Quantum readiness requires a deeper question: what encryption is used, where is it used, and is there a post-quantum migration plan?

Regulated data security obligations are expanding. Firms already need written security plans and must safeguard taxpayer data. Quantum readiness will not replace your current security protocols. Instead, it will become part of security governance: knowing what protects client data, how long that protection must last, and whether vendors are keeping pace with modern standards.

How the shift is likely to progress

The quantum transition will not happen overnight. It will unfold in stages, and firms should understand the difference between scientific milestones, cybersecurity standards, and practical implementation.

2024-2026: Standards and Planning

The most important shift has already occurred: post-quantum cryptography is no longer theoretical. National Institute of Standards and Technology (NIST) has finalized initial post-quantum cryptographic standards, including algorithms for key establishment and digital signatures. This period is about awareness, inventory, vendor questioning, and not panicking.

2026-2028: Vendor Roadmaps

During this period, more technology providers will begin adding post-quantum or hybrid cryptographic support. Firms should expect large cloud providers, certificate authorities, security vendors, financial platforms, and identity providers to move first. Smaller niche applications, including some tax and practice-management tools, may lag significantly.

2028-2030: Migration

Firms will need to update systems and confirm that critical vendors have implemented appropriate protections. Contracts, cyber insurance questionnaires, client security assessments, and regulatory expectations will begin asking more specific questions.

Beyond 2030: Risk Becomes Mainstream

No one can predict the exact date when a cryptographically relevant quantum computer will become available. Quantum risk should be treated with uncertain timing, high potential impact, and best managed through early preparation.

What "quantum-focused" or "quantum-supporting" tools really means

Accounting firms should be careful with marketing claims. A tool labeled 'quantum-safe' may mean very different things depending on the vendor.

A meaningful claim should be specific. Does the product support post-quantum cryptography? Does it have a plan for post-quantum certificates and signatures? Does it rely on third-party infrastructure that has its own migration timeline? Can the vendor explain whether stored client documents are protected in a way that reduces harvest-now, decrypt-later exposure?

Firms do not need every vendor to be fully post-quantum today. In many cases, the standards are still maturing. But firms should expect serious vendors to understand the issue and provide a credible migration roadmap.

Three key actions accounting firms should take in 2026

1. Build a cryptographic inventory tied to client data risk

Most firms have asset inventories, but few have cryptographic inventories. Firms should begin identifying where encryption, certificates, digital signatures, and key management are used. This does not need to be perfect on day one. Start with systems that access sensitive client information.

For each system, document the vendor, data type, retention period, encryption claims, authentication method, certificate dependency, and whether the vendor has a post-quantum roadmap. This inventory should connect to the firm's Written Information Security Plan (WISP).

2. Add quantum-readiness questions to vendor due diligence

Your firm does not control the cryptography inside most of the tools it uses. That makes vendor management essential. Add a short quantum-readiness section to vendor reviews. Ask vendors whether they follow post-quantum standards, and when they expect to update their certificates and libraries.

A vendor that cannot answer every question today is not automatically unacceptable. A vendor that has no awareness of the issue should be treated as a higher risk.

3. Update the firm's security roadmap for quantum readiness

Quantum readiness should not be a separate binder that no one reads. It should be incorporated into the firm's existing cybersecurity program. Add quantum risk to the annual risk assessment. Update vendor management procedures. Train leadership and IT staff on the difference between hype and practical action.

This is also a good time to modernize foundational controls. Firms that still rely on outdated protocols are not ready for a cryptographic transition. Quantum readiness starts with disciplined security basics today.

The bottom line

Quantum computing will not make accounting firms insecure overnight. But it will change the expectations behind the technology firms rely on every day. The firms that wait for a crisis will face a rushed, expensive, vendor-dependent migration. Firms that start today can turn quantum readiness into a manageable governance project.

For accountants, the message is practical: Quantum readiness is not science fiction. It is the next phase of protecting client trust.