Quantum Computing Cybersecurity Preparedness Act

Quantum Computing Cybersecurity Preparedness Act

This bill addresses the migration of executive agencies' information technology systems to post-quantum cryptography. Post-quantum cryptography is encryption strong enough to resist attacks from quantum computers developed in the future. The bill does not apply to national security systems.

The Office of Management and Budget (OMB) shall issue guidance on the migration of information technology to post-quantum cryptography.

Each executive agency must maintain an inventory of all information technology in use by the executive agency that is vulnerable to decryption by quantum computers.

After the National Institutes of Standards and Technology (NIST) has issued post-quantum cryptography standards, the OMB shall issue guidance requiring each executive agency to develop a plan to migrate information technology of the agency to post-quantum cryptography.

OMB shall submit to Congress a report on

• a strategy to address the risk posed by the vulnerabilities of information technology of executive agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach such encryption;
• the funding needed by executive agencies to secure such information technology from the risk posed by an adversary of the United States using a quantum computer to breach the encryption; and
• a description of federal civilian executive branch coordination efforts led by NIST, including timelines, to develop standards for post-quantum cryptography.

Quantum Computing Cybersecurity Preparedness Act

This bill addresses the migration of executive agencies' information technology systems to post-quantum cryptography. Post-quantum cryptography is encryption strong enough to resist attacks from quantum computers developed in the future.

The Office of Management and Budget (OMB) shall establish a requirement for each executive agency to establish and maintain an inventory of each cryptographic system in use by the agency.

Each executive agency must provide to the OMB, the Cyber and Infrastructure Security Agency, and the Office of the National Cyber Director an inventory of all information technology in use by the executive agency that is vulnerable to decryption by quantum computers.

After the National Institutes of Standards and Technology (NIST) has issued post-quantum cryptography standards, the OMB shall issue guidance requiring each executive agency to develop a plan to migrate information technology of the agency to post-quantum cryptography.

OMB shall submit to Congress a report on

• a strategy to address the risk posed by the vulnerabilities of information technology systems of executive agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach such encryption;
• the funding needed by executive agencies to secure such information technology systems from the risk posed by an adversary of the United States using a quantum computer to breach the encryption of information technology systems; and
• a description of federal civilian executive branch coordination efforts led by NIST, including timelines, to develop standards for post-quantum cryptography.

Quantum Computing Cybersecurity Preparedness Act

This bill addresses the migration of executive agencies information technology systems to post-quantum cryptography. Post-quantum cryptography is encryption strong enough to resist attacks from quantum computers developed in the future.

Not later than one year after the National Institutes of Standards and Technology (NIST) has issued post-quantum cryptography standards, the Office of Management and Budget (OMB) shall begin to prioritize the migration of agency information technology systems to post-quantum cryptography.

Not later than one year after the date of the enactment of this bill, the OMB shall submit to Congress a report on

• a strategy to address the risk posed by the vulnerabilities of agency information technology systems to the potential capability of a quantum computer;
• the funding necessary to secure such information technology systems from the threat posed by adversarial access to quantum computers; and
• a description and analysis of ongoing coordination efforts with international standards development organizations and consortia to develop standards for post-quantum cryptography, including any federal Information Processing Standards.