,,ii #aagth ,,congress #b;d ,session ,s4 #deib ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ba1 #bjbb,ms4 ,hassan 7for herself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to encourage the migration of ,federal ,government information technology systems to quantum-resistant cryptography1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,quantum ,computing ,cybersecurity ,preparedness ,act4 #b4 ,findings2 sense of ,congress 7a7 ,findings ,congress finds the following3 7#a7 ,cryptography is essential for the national security of the ,united ,states and the functioning of the economy of the ,united ,states4 7#b7 ,the most widespread encryption protocols today rely on computational limits of classical computers to provide cybersecurity4 7#c7 ,quantum computers might one day have the ability to push computational boundaries1 allowing us to solve problems that have been intractable thus far1 such as integer factorization1 which is important for encryption4 7#d7 ,the rapid progress of quantum computing suggests the potential for adversaries of the ,united ,states to steal sensitive encrypted data today using classical computers1 and wait until sufficiently powerful quantum systems are available to decrypt it4 7b7 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 a strategy for the migration of information technology systems of the ,federal ,government to post-quantum cryptography is needed2 and 7#b7 the governmentwide and industrywide approach to post-quantum cryptography should prioritize developing applications1 hardware intellectual property1 and software that can be easily updated to support cryptographic agility4 #c4 ,definitions ,in this ,act3 7#a7 ,classical computer ,the term classical computer means a device that accepts digital data and manipulates the information based on a program or sequence of instructions for how data is to be processed and encodes information in binary bits that can either be #js or #as4 7#b7 ,director of ,,cisa ,the term ,director of ,,cisa means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#c7 ,director of ,,nist ,the term ,director of ,,nist means the ,director of the ,national ,institute of ,standards and ,technology4 7#d7 ,director of ,,omb ,the term ,director of ,,omb means the ,director of the ,office of ,management and ,budget4 7#e7 ,executive agency ,the term executive agency has the meaning given the term ,executive agency in section #aje of title #e1 ,united ,states ,code4 7#f7 ,information technology ,the term information technology has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#g7 ,post-quantum cryptography ,the term post-quantum cryptography means a cryptographic system that-- 7,a7 is secure against decryption attempts using a quantum computer or classical computer2 and 7,b7 can interoperate with existing communications protocols and networks4 7#h7 ,quantum computer ,the term quantum computer means a computer that uses the collective properties of quantum states to perform calculations4 #d4 ,inventory of cryptographic systems2 migration to post-quantum cryptography 7a7 ,inventory 7#a7 ,establishment ,not later than #ahj days after the date of enactment of this ,act1 the ,director of ,,omb shall establish1 by rule or binding guidance1 a requirement for each executive agency to establish and maintain an inventory of each cryptographic system in use by the agency4 7#b7 ,additional content in rule or binding guidance ,in the rule or binding guidance established by paragraph 7#a71 the ,director of ,,omb shall include1 in addition to the requirement described under that paragraph-- 7,a7 a description of information technology to be prioritized for migration to post-quantum cryptography2 7,b7 a description of the information required to be reported pursuant to subsection 7b72 and 7,c7 a process for evaluating progress on migrating information technology to post-quantum cryptography1 which shall be automated to the greatest extent practicable4 7#c7 ,periodic updates ,the ,director of ,,omb shall update the rule or binding guidance established by paragraph 7#a7 as the ,director determines necessary4 7b7 ,agency reports ,not later than #a year after the date of enactment of this ,act1 and on an ongoing basis thereafter1 the head of each executive agency shall provide to the ,director of ,,omb1 the ,director of ,,cisa1 and the ,national ,cyber ,director an inventory of all information technology in use by the executive agency that is vulnerable to decryption by quantum computers1 prioritized pursuant to the guidance issued under subsection 7a77#b74 7c7 ,migration and assessment 7#a7 ,migration to post-quantum cryptography ,not later than #a year after the date on which the ,director of ,,nist has issued post-quantum cryptography standards1 the ,director of ,,omb shall issue guidance requiring each executive agency to develop a plan to migrate information technology of the agency to post-quantum cryptography4 7#b7 ,designation of systems for migration ,not later than #ij days after the date on which the guidance required by paragraph 7#a7 has been issued1 the ,director of ,,omb shall issue guidance for agencies to-- 7,a7 designate information technology to be migrated to post-quantum cryptography2 and 7,b7 prioritize information technology designated under subparagraph 7,a71 on the basis of the amount of risk posed by decryption by quantum computers to that technology1 for migration to post-quantum cryptography4 7d7 ,interoperability ,the ,director of ,,omb shall ensure that the designations and prioritizations made under subsection 7c77#b7 are assessed and coordinated to ensure interoperability4 7e7 ,report on post-,quantum cryptography ,not later than #ae months after the date of enactment of this ,act1 the ,director of ,,omb shall submit to ,congress a report on the following3 7#a7 ,a strategy to address the risk posed by the vulnerabilities of information technology systems of executive agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach that encryption4 7#b7 ,the amount of funding needed by executive agencies to secure the information technology systems described in paragraph 7#a7 from the risk posed by an adversary of the ,united ,states using a quantum computer to breach the encryption of information technology systems4 7#c7 ,a description of ,federal civilian executive branch coordination efforts led by the ,national ,institute of ,standards and ,technology1 including timelines1 to develop standards for post-quantum cryptography1 including any ,federal ,information ,processing ,standards developed under chapter #ce of title #dd1 ,united ,states ,code1 as well as standards developed through voluntary1 consensus standards bodies such as the ,international ,organization for ,standardization4 7f7 ,report on migration to post-,quantum cryptography in information technology systems ,not later than #a year after the date on which the ,director of ,,omb issues guidance under subsection 7c77#b71 and annually thereafter until the date that is #e years after the date on which post-quantum cryptographic standards are issued1 the ,director of ,,omb shall submit to ,congress1 with the report submitted pursuant to section #ceec7;c7 of title #dd1 ,united ,states ,code1 a report on the progress of executive agencies in adopting post-quantum cryptography standards4 #e4 ,determination of budgetary effects ,the budgetary effects of this ,act1 for the purpose of complying with the ,statutory ,pay-,as-,you-,go ,act of #bjaj1 shall be determined by reference to the latest statement titled ,budgetary ,effects of ,,paygo ,legislation for this ,act1 submitted for printing in the ,congressional ,record by the ,chairman of the ,house ,budget ,committee1 provided that such statement has been submitted prior to the vote on passage4