,,ii #aaith ,,congress #ast ,session ,s4 #ccab ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #b1 #bjbe,mr4 ,peters 7for himself and ,mrs4 ,blackburn7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require the ,director of the ,national ,institute of ,standards and ,technology to develop guidance for upgrading information systems to post-quantum cryptography1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,quantum ,readiness and ,innovation ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce of the ,house of ,representatives4 7#b7 ,classical computer2 quantum computer ,the terms classical computer and quantum computer have the meanings given such terms in section #c of the ,quantum ,computing ,cybersecurity ,preparedness ,act 7,public ,law #aag-bfj2 #f ,u4,s4,c4 #aebf note74 7#c7 ,critical infrastructure sectors ,the term critical infrastructure sectors means the critical infrastructure sectors defined in the ,national ,security ,memorandum on ,critical ,infrastructure ,security and ,resilience 7,,nsm-#bb71 dated ,april #cj1 #bjbd4 7#d7 ,high-impact system ,the term high-impact system means a ,federal information system that holds sensitive information1 the loss of which would be categorized as high impact under ,federal ,information ,processing ,standards ,publication #aii 7relating to standards for security categorization of ,federal information and information systems71 as in effect on the day before the date of the enactment of this ,act4 7#e7 ,post-quantum cryptography ,the term post-quantum cryptography-- 7,a7 means those cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by either a quantum computer or classical computer2 and 7,b7 includes-- 7i7 the lattice-based digital signature algorithm specified in ,national ,institute of ,standards and ,technology ,federal ,information ,processing ,standards ,publication #bjd 7dated ,august #ac1 #bjbd2 relating to ,module-,lattice-,based ,digital ,signature ,standard71 or any successor standard2 7ii7 the module-lattice-based key encapsulation mechanism specified in ,national ,institute of ,standards and ,technology ,federal ,information ,processing ,standards ,publication #bjc 7dated ,august #ac1 #bjbd2 relating to ,module-,lattice-,based ,key-,encapsulation ,mechanism ,standard71 or any successor standard2 and 7iii7 any cryptographic algorithm or method implemented in accordance with ,national ,institute of ,standards and ,technology ,federal ,information ,processing ,standard ,publication #adj-c 7dated ,march #bb1 #bjai2 relating to ,security ,requirements for ,cryptographic ,modules71 or any successor standard1 operating within a zero trust architecture as described in ,national ,institute of ,standards and ,technology ,special ,publication #hjj-bjg 7dated ,august #bjbj2 relating to ,zero ,trust ,architecture71 or any successor standard4 7#f7 ,sector risk management agency ,the term sector risk management agency has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,guidance on upgrading to post-quantum cryptography 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology1 in consultation with the ,director of the ,office of ,science and ,technology ,policy1 shall establish guidance for upgrading information systems to post-quantum cryptography1 including guidance that is specifically tailored for critical infrastructure sectors4 7b7 ,requirement ,the guidance established pursuant to subsection 7a7 shall include standards and selection criteria to guide the procurement and deployment of commercial solutions for an entity seeking to upgrade to post-quantum cryptography4 7c7 ,dissemination of guidance 7#a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology shall make available to entities in the private sector the guidance established under subsection 7a74 7#b7 ,special ,publications ,the ,director may satisfy the requirement under paragraph 7#a7 through the publication of ,special ,publications4 7d7 ,coordination and assistance for industry-,led assessments of adoption of guidance 7#a7 ,in general ,if an industry sector representative1 who is part of the ,quantum ,economic ,development ,consortium1 decides to carry out an assessment of the adoption by the industry sector of the guidance established under subsection 7a71 the ,director of the ,national ,institute of ,standards and ,technology shall offer to collaborate on such assessment with such representative4 7#b7 ,technical ,assistance and ,interoperability ,frameworks ,if requested by the representative described in paragraph 7#a71 the ,director of the ,national ,institute of ,standards and ,technology shall support the assessment by providing-- 7,a7 technical and administrative support2 7,b7 test beds to support the assessment2 and 7,c7 interoperability frameworks4 7#c7 ,coordination ,assistance ,the ,director of the ,national ,institute of ,standards and ,technology may support an assessment described in paragraph 7#a7 by coordinating between stakeholders as the ,director considers necessary4 #d4 ,strategy for ,federal agency upgrade to post-quantum cryptography 7a7 ,national ,quantum ,cybersecurity ,upgrade ,strategy ,not later than #cfj days after the date of the enactment of this ,act1 the ,director of the ,office of ,science and ,technology ,policy1 in coordination with the ,director of the ,national ,institute of ,standards and ,technology and in consultation with the ,quantum ,economic ,development ,consortium1 shall develop a ,national ,quantum ,cybersecurity ,upgrade ,strategy that includes the following3 7#a7 ,a definition of a cryptographically relevant quantum computer4 7#b7 ,recommended standards to apply to determine whether a quantum computer meets such definition1 including-- 7,a7 the characteristics of such computers2 and 7,b7 the particular point at which such computers are capable of attacking real world systems that classical computers are unable to attack4 7#c7 ,guidelines for assessing the urgency of upgrading to post-quantum cryptography for each ,federal agency relative to-- 7,a7 the critical functions of each agency2 and 7,b7 the risk each agency faces should a cryptographically relevant quantum computer attack a system operated by the agency4 7#d7 ,recommended performance measures for upgrading to post-quantum cryptography for the following tasks3 7,a7 ,preparation for upgrading to post-quantum cryptography1 including-- 7i7 the adoption of hardware integrating quantum-resistant cryptographic algorithms2 and 7ii7 the deployment of software-only post-quantum cryptography overlays that meet or exceed security standards set forth in the ,federal ,information ,processing ,standards issued by the ,national ,institute of ,standards and ,technology4 7,b7 ,establishment of a baseline understanding of the data inventory1 including through the use of automated tools to identify assets4 7,c7 ,planning and execution of post-quantum cryptographic solutions1 including ensuring that data at rest and in motion is subject to appropriate protections4 7,d7 ,monitoring and evaluating the success of the upgrade and assessing the security of the system4 7#e7 ,a plan for implementing the above performance measures1 including evaluating and monitoring entities that are at high risk of quantum attacks1 including sector risk management agencies4 7b7 ,post-,quantum voluntary pilot program 7#a7 ,in general ,not later than #cfj days after the date of the enactment of this ,act1 the ,director of the ,office of ,science and ,technology ,policy shall establish a pilot program to provide planning1 technical1 and any other support the ,director considers appropriate to any covered entity that elects to participate in the program for the purpose of upgrading the systems of such covered entity to post-quantum cryptography4 7#b7 ,high risk entities ,the ,director shall encourage any covered entity that is at high risk of quantum attack to participate in the pilot program established under paragraph 7#a74 7#c7 ,requirements ,under the pilot program established under paragraph 7#a7-- 7,a7 not later than #ah months after the date of the establishment of the program1 not fewer than #a high-impact system of any covered entity participating in the program shall be upgraded to post-quantum cryptography in accordance with the recommended performance measures described in subsection 7a77#d72 and 7,b7 upon completion of the initial upgrade under subparagraph 7,a71 the head of the covered entity may upgrade-- 7i7 #a additional system in accordance with such performance measures2 or 7ii7 #b or more systems in accordance with such performance measures if the head notifies the ,director before initiating such upgrade4 7#d7 ,pilot program reports 7,a7 ,in general ,for each covered entity participating in the program established under paragraph 7#a71 the ,director1 in coordination with the head of such entity1 shall submit to the appropriate congressional committees-- 7i7 an initial report not later than #ahj days after the date on which the initial upgrade is completed under paragraph 7#c77;,a72 and 7ii7 an updated report annually until such date as the ,director considers appropriate4 7,b7 ,elements ,each report submitted under subparagraph 7,a7 shall describe-- 7i7 the actions of the head of the covered entity in carrying out the program2 and 7ii7 any planning1 technical1 or other support that the ,director provided to the head of the covered entity through the program4 7#e7 ,covered entity defined ,in this subsection1 the term covered entity means-- 7,a7 a sector risk management agency2 7,b7 a ,federal agency2 or 7,c7 a mission partner of a ,federal agency4 7c7 ,report to ,congress ,not later than #cfj days after the date of the enactment of this ,act1 the ,director of the ,office of ,science and ,technology ,policy shall submit to the appropriate congressional committees a report that includes the ,national ,quantum ,cybersecurity ,upgrade ,strategy developed under subsection 7a7 and a description of the pilot program established pursuant to subsection 7b77#a74