,in the ,senate of the ,united ,states1 
,december #h1 #bjbb4  ,amendment3  ,that
 the bill from the ,house of            
,representatives 7,h4,r4 #gece7 entitled
 ,an ,act to encourage the migration of 
,federal ,government information        
technology systems to quantum-resistant 
cryptography1 and for other purposes41  
do pass with the following ,strike all  
after the enacting clause and insert the
 following3 #a4 ,short title ,this ,act 
may be cited as the ,quantum ,computing 
,cybersecurity ,preparedness ,act4  #b4 
,findings2 sense of ,congress  7a7      
,findings ,congress finds the following3
 7#a7 ,cryptography is essential for the
 national security of the ,united       
,states and the functioning of the      
economy of the ,united ,states4  7#b7   
,the most widespread encryption         
protocols today rely on computational   
limits of classical computers to provide
 cybersecurity4  7#c7 ,quantum computers
 might one day have the ability to push 
computational boundaries1 allowing us to

 solve problems that have been          
intractable thus far1 such as integer   
factorization1 which is important for   
encryption4  7#d7 ,the rapid progress of
 quantum computing suggests the         
potential for adversaries of the ,united
 ,states to steal sensitive encrypted   
data today using classical computers1   
and wait until sufficiently powerful    
quantum systems are available to decrypt
 it4  7b7 ,sense of ,congress ,it is the
 sense of ,congress that-- 7#a7 a       
strategy for the migration of           
information technology of the ,federal  
,government to post-quantum cryptography
 is needed2 and  7#b7 the governmentwide
 and industrywide approach to           
post-quantum cryptography should        
prioritize developing applications1     
hardware intellectual property1 and     
software that can be easily updated to  
support cryptographic agility4  #c4     
,definitions ,in this ,act3 7#a7 ,agency
 ,the term agency-- 7,a7 means any      
executive department1 military          

department1 ,government corporation1    
,government controlled corporation1 or  
other establishment in the executive    
branch of the ,government 7including the
 ,executive ,office of the ,president71 
or any independent regulatory agency2   
and  7,b7 does not include-- 7i7 the    
,government ,accountability ,office2 or 
7ii7 the governments of the ,district of
 ,columbia and of the territories and   
possessions of the ,united ,states1 and 
their various subdivisions4  7#b7       
,classical computer ,the term classical 
computer means a device that accepts    
digital data and manipulates the        
information based on a program or       
sequence of instructions for how data is
 to be processed and encodes information
 in binary bits that can either be #js  
or #as4  7#c7 ,director of ,,cisa ,the  
term ,director of ,,cisa means the      
,director of the ,cybersecurity and     
,infrastructure ,security ,agency4  7#d7
 ,director of ,,nist ,the term ,director
 of ,,nist means the ,director of the   

,national ,institute of ,standards and  
,technology4  7#e7 ,director of ,,omb   
,the term ,director of ,,omb means the  
,director of the ,office of ,management 
and ,budget4  7#f7 ,information         
technology ,the term information        
technology has the meaning given the    
term in section #cejb of title #dd1     
,united ,states ,code4  7#g7 ,national  
security system ,the term national      
security system has the meaning given   
the term in section #ceeb of title #dd1 
,united ,states ,code4  7#h7            
,post-quantum cryptography ,the term    
post-quantum cryptography means those   
cryptographic algorithms or methods that
 are assessed not to be specifically    
vulnerable to attack by either a quantum
 computer or classical computer4  7#i7  
,quantum computer ,the term quantum     
computer means a computer that uses the 
collective properties of quantum states1
 such as superposition1 interference1   
and entanglement1 to perform            
calculations4  #d4 ,inventory of        

cryptographic systems2 migration to     
post-quantum cryptography  7a7          
,inventory  7#a7 ,establishment ,not    
later than #ahj days after the date of  
enactment of this ,act1 the ,director of
 ,,omb1 in coordination with the        
,national ,cyber ,director and in       
consultation with the ,director of      
,,cisa1 shall issue guidance on the     
migration of information technology to  
post-quantum cryptography1 which shall  
include at a minimum-- 7,a7 a           
requirement for each agency to establish
 and maintain a current inventory of    
information technology in use by the    
agency that is vulnerable to decryption 
by quantum computers1 prioritized using 
the criteria described in subparagraph  
7,b72  7,b7 criteria to allow agencies  
to prioritize their inventory efforts2  
and  7,c7 a description of the          
information required to be reported     
pursuant to subsection 7b74  7#b7       
,additional content in guidance ,in the 
guidance established by paragraph 7#a71 

the ,director of ,,omb shall include1 in
 addition to the requirements described 
in that paragraph-- 7,a7 a description  
of information technology to be         
prioritized for migration to            
post-quantum cryptography2 and  7,b7 a  
process for evaluating progress on      
migrating information technology to     
post-quantum cryptography1 which shall  
be automated to the greatest extent     
practicable4  7#c7 ,periodic updates    
,the ,director of ,,omb shall update the
 guidance required under paragraph 7#a7 
as the ,director of ,,omb determines    
necessary1 in coordination with the     
,national ,cyber ,director and in       
consultation with the ,director of      
,,cisa4  7b7 ,agency reports ,not later 
than #a year after the date of enactment
 of this ,act1 and on an ongoing basis  
thereafter1 the head of each agency     
shall provide to the ,director of ,,omb1
 the ,director of ,,cisa1 and the       
,national ,cyber ,director-- 7#a7 the   
inventory described in subsection       

7a77#a72 and  7#b7 any other information
 required to be reported under          
subsection 7a77#a77;,c74  7c7 ,migration
 and assessment ,not later than #a year 
after the date on which the ,director of
 ,,nist has issued post-quantum         
cryptography standards1 the ,director of
 ,,omb shall issue guidance requiring   
each agency to-- 7#a7 prioritize        
information technology described under  
subsection 7a77#b77;,a7 for migration to
 post-quantum cryptography2 and  7#b7   
develop a plan to migrate information   
technology of the agency to post-quantum
 cryptography consistent with the       
prioritization under paragraph 7#a74    
7d7 ,interoperability ,the ,director of 
,,omb shall ensure that the             
prioritizations made under subsection   
7c77#a7 are assessed and coordinated to 
ensure interoperability4  7e7 ,office of
 ,management and ,budget reports  7#a7  
,report on post-quantum cryptography    
,not later than #ae months after the    
date of enactment of this ,act1 the     

,director of ,,omb1 in coordination with
 the ,national ,cyber ,director and in  
consultation with the ,director of      
,,cisa1 shall submit to the ,committee  
on ,homeland ,security and ,governmental
 ,affairs of the ,senate and the        
,committee on ,oversight and ,reform of 
the ,house of ,representatives a report 
on the following3 7,a7 ,a strategy to   
address the risk posed by the           
vulnerabilities of information          
technology of agencies to weakened      
encryption due to the potential and     
possible capability of a quantum        
computer to breach that encryption4     
7,b7 ,an estimate of the amount of      
funding needed by agencies to secure the
 information technology described in    
subsection 7a77#a77;,a7 from the risk   
posed by an adversary of the ,united    
,states using a quantum computer to     
breach the encryption of the information
 technology4  7,c7 ,a description of    
,federal civilian executive branch      
coordination efforts led by the         

,national ,institute of ,standards and  
,technology1 including timelines1 to    
develop standards for post-quantum      
cryptography1 including any ,federal    
,information ,processing ,standards     
developed under chapter #ce of title    
#dd1 ,united ,states ,code1 as well as  
standards developed through voluntary1  
consensus standards bodies such as the  
,international ,organization for        
,standardization4  7#b7 ,report on      
migration to post-quantum cryptography  
in information technology ,not later    
than #a year after the date on which the
 ,director of ,,omb issues guidance     
under subsection 7c77#b71 and thereafter
 until the date that is #e years after  
the date on which post-quantum          
cryptographic standards are issued1 the 
,director of ,,omb1 in coordination with
 the ,national ,cyber ,director and in  
consultation with the ,director of      
,,cisa1 shall submit to the ,committee  
on ,homeland ,security and ,governmental
 ,affairs of the ,senate and the        

,committee on ,oversight and ,reform of 
the ,house of ,representatives1 with the
 report submitted pursuant to section   
#ceec7;c7 of title #dd1 ,united ,states 
,code1 a report on the progress of      
agencies in adopting post-quantum       
cryptography standards4  #e4 ,exemption 
of national security systems ,this ,act 
shall not apply to any national security
 system4  #f4 ,determination of         
budgetary effects ,the budgetary effects
 of this ,act1 for the purpose of       
complying with the ,statutory           
,pay-,as-,you-,go ,act of #bjaj1 shall  
be determined by reference to the latest
 statement titled ,budgetary ,effects of
 ,,paygo ,legislation for this ,act1    
submitted for printing in the           
,congressional ,record by the ,chairman 
of the ,house ,budget ,committee1       
provided that such statement has been   
submitted prior to the vote on passage4 
,secretary