ASPR Signals New Quantum Guidance Amid Health Cyber Threats The health agency is the latest to provide guidance on post-quantum cryptography amid a government-wide focus to get ahead of quantum threats. The Administration for Strategic Preparedness and Response (ASPR) is preparing to release post-quantum cryptography (PQC) migration guidance to help hospitals and public health organizations prepare for emerging cyber threats. “We’re working very closely with our private sector partners, and we’re about to release guidance documents in terms of how to prepare and mitigate quantum-related threats,” said ASPR Senior Cybersecurity Advisor for Critical Infrastructure Bob Bastani at GovCIO Media & Research’s Health IT Summit. ASPR, a division of the Department of Health and Human Services, updated its Risk Identification and Site Criticality (RISC) tool earlier this year to include a cybersecurity assessment. The updated toolkit, known as RISC 2.0, includes resources to help health systems and public health partners better assess their cybersecurity posture amid growing ransomware threats. Bastani said RISC 2.0 does not currently include PQC guidance, but cybersecurity leaders can use best practices such as inventorying data and systems to better prepare their organizations for a future PQC migration. CDW Healthcare Industry Strategist Nelson Carreira echoed the need for organizations to begin or advance their PQC migration strategies. Carreira said threat actors are already collecting encrypted data with the intention of decrypting it once quantum computers are capable of breaking current encryption methods, a tactic known as “harvest now, decrypt later.” “PQC migration is something you should start today, because it’s going to be a massive threat,” said Carreira. “The sooner you can get started, the better. NIST has the algorithms posted, so leverage your partners to help you migrate because it is a huge endeavor.” The Value of Communication, Transparency As cybersecurity shifts from being solely the