| Abstract: |
Context: Digital transformation in government, driven by technologies such as the Internet of Things (IoT), artificial intelligence, and cloud computing, has significantly increased the exposure of sensitive data and challenged traditional security models. With the advent of quantum computing, classical cryptographic algorithms are expected to become vulnerable, requiring new strategies for data protection and governance. Goal: This study investigates how public policies and regulatory frameworks can adapt to post-quantum threats, with a focus on privacy, security, and accountability in the Brazilian federal government. Method: A qualitative and exploratory approach was adopted, comprising three stages: (i) a systematic literature review (2020–2025) conducted in accordance with the PRISMA 2020 guidelines, (ii) a comparative analysis of international regulations LGPD, GDPR, and HIPAA and (iii) a case study of the Brazilian federal government based on the results of the 2023 and 2025 self-assessment reports conducted by the Ministry of Management and Innovation in Public Services (MGI). Results: The review identified 23 primary studies, grouped into three main dimensions: (i) technological infrastructure, focused on post-quantum protocols and continuous authentication; (ii) governance and regulation, emphasizing the integration of innovation and compliance; and (iii) advanced protection methods, such as lattice-based cryptography, quantum key distribution (QKD), and blockchain. GDPR remains the most prescriptive framework, while LGPD adopts an intermediate approach and HIPAA follows a sector-specific model. In the federal government context, the findings indicate an early and uneven stage of organizational maturity, with significant gaps in cryptographic inventory, key management, and security event correlation. Conclusion: The study demonstrates that building a quantum-resilient governance model in the public sector requires the integration of validated technical mechanisms, adaptive regulation, and an institutional culture of accountability. A structured transition roadmap aligned with NIST CSF 2.0 and LGPD is proposed, encompassing cryptographic inventory, hybrid algorithm adoption, crypto-agility, and continuous capacity building. The evidence suggests that quantum-regulatory resilience in the public sector is not a one-time effort, but an evolving process that integrates science, regulation, and institutional practice to ensure security and trust in the post-quantum era. |