,,ii #aaith ,,congress #b;d ,session ,s4 #ecac ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #f1 #bjbf,mr4 ,coons 7for himself and ,mr4 ,rounds7 introduced the following bill2 which was read twice and referred to the ,committee on ,energy and ,natural ,resources ,a ,,bill ,to require the ,federal ,energy ,regulatory ,commission to consider cybersecurity risks from quantum computers1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,quantum ,grid ,utility ,assurance and ,resilient ,defense ,act of #bjbf or the ,quantum-,,guard ,act of #bjbf4 #b4 ,definitions ,in this ,act3 7#a7 ,bulk-power system ,the term bulk-power system has the meaning given the term in section #bae7;a7 of the ,federal ,power ,act 7#af ,u4,s4,c4 #hbdo7a774 7#b7 ,commission ,the term ,commission means the ,federal ,energy ,regulatory ,commission4 7#c7 ,electric ,reliability ,organization ,the term ,electric ,reliability ,organization has the meaning given the term in section #bae7;a7 of the ,federal ,power ,act 7#af ,u4,s4,c4 #hbdo7a774 7#d7 ,high-value ,the term high-value1 with respect to an ,,it or ,,ot system1 means that the system is so critical to an organization that the loss or corruption of information within the system or loss of access to the system would have serious impacts on the ability of the organization to perform its mission or conduct business4 7#e7 ,information technology2 ,,it 7,a7 ,in general ,the term information technology or ,,it means any equipment or interconnected system or subsystem of equipment used in the automatic acquisition1 storage1 analysis1 evaluation1 manipulation1 management1 movement1 control1 display1 switching1 interchange1 transmission1 or reception of data or information4 7,b7 ,inclusions ,the term information technology or ,,it includes1 at a minimum1 computers1 ancillary equipment 7including imaging peripherals1 input1 output1 and storage devices necessary for security and surveillance71 peripheral equipment designed to be controlled by the central processing unit of a computer1 software1 firmware and similar procedures1 services 7including support services71 and related resources4 7#f7 ,operational technology2 ,,ot 7,a7 ,in general ,the term operational technology or ,,ot means any programmable system or device that-- 7i7 interacts with the physical environment 7or manages devices that interact with the physical environment72 and 7ii7 detects or causes a direct change through the monitoring or control of devices1 processes1 or events4 7,b7 ,inclusions ,the term operational technology or ,,ot includes1 at a minimum1 industrial control systems1 building management systems1 fire control systems1 and physical access control mechanisms4 7#g7 ,post-quantum cryptography2 ,,pqc ,the term post-quantum cryptography or ,,pqc means cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by any of-- 7,a7 a quantum computer 7as defined in section #c of the ,quantum ,computing ,cybersecurity ,preparedness ,act 7#f ,u4,s4,c4 #aebf note2 ,public ,law #aag-bfj772 or 7,b7 a classical computer 7as defined in that section74 7#h7 ,,pqc sandbox ,the term ,,pqc sandbox means a program for innovation and development with respect to the use of post-quantum cryptography in ,,it and ,,ot applications for the electric grid that-- 7,a7 assembles relevant stakeholders1 which may include operators of the bulk-power system1 ,,it and ,,ot vendors1 relevant ,federal agencies1 relevant ,state and local organizations1 and distribution utilities 7as defined in section #bag7;a7 of the ,federal ,power ,act 7#af ,u4,s4,c4 #hbdq7a7772 7,b7 addresses challenges in ,,pqc cybersecurity development and adoption2 7,c7 prioritizes activities that support1 encourage1 or enable ,,pqc integration into-- 7i7 existing systems2 and 7ii7 during the #e-year period beginning on the date of enactment of this ,act1 systems that are expected to be deployed within that #e-year period2 7,d7 may include briefings1 workshops1 software challenges1 hardware modeling1 grid simulations1 or red-teaming exercises2 and 7,e7 may be used to develop and test demonstrations1 proofs of concept1 interoperability between ,,it and ,,ot systems1 and pilot applications4 7#i7 ,reliability standard ,the term reliability standard has the meaning given the term in section #bae7;a7 of the ,federal ,power ,act 7#af ,u4,s4,c4 #hbdo7a774 7#aj7 ,secretary ,the term ,secretary means the ,secretary of ,energy1 acting through the ,office of ,cybersecurity1 ,energy ,security1 and ,emergency ,response4 #c4 ,,ferc consideration of cybersecurity risks from quantum computers ,beginning on the date of enactment of this ,act1 in reviewing a proposed reliability standard1 or a proposed modification to a reliability standard1 under section #bae of the ,federal ,power ,act 7#af ,u4,s4,c4 #hbdo7 or issuing an order under subsection 7d77#e7 of that section1 the ,commission shall-- 7#a7 consider-- 7,a7 cybersecurity risks from quantum computers2 and 7,b7 potential uses of post-quantum cryptography in ,,it and ,,ot systems to protect against those risks2 and 7#b7 take such action the ,commission determines to be appropriate based on that consideration4 #d4 ,,doe ,,pqc sandbox 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall establish a ,,pqc sandbox4 7b7 ,collaboration ,in establishing and maintaining the ,,pqc sandbox under subsection 7a71 the ,secretary may collaborate1 as appropriate1 with appropriate officials at other ,federal agencies4 7c7 ,outreach ,not later than #c years after the date of enactment of this ,act1 the ,secretary shall publish a report describing the outcomes of1 and recommendations arising from1 ,,pqc sandbox activities1 to encourage ,,pqc adoption by operators of the bulk-power system4 #e4 ,,pqc report 7a7 ,study ,the ,secretary1 in consultation with the ,electric ,reliability ,organization and other appropriate organizations1 shall conduct a study of cybersecurity risks to the bulk-power system from quantum computers1 including1 at minimum-- 7#a7 risks to ,,it and ,,ot systems2 and 7#b7 obstacles to transitioning high-value ,,it and ,,ot systems to ,,pqc4 7b7 ,requirements ,in conducting the study under subsection 7a71 the ,secretary shall-- 7#a7 develop recommendations for actions that the ,commission could take to ensure reliable operations of the bulk-power system2 and 7#b7 to the extent practicable1 correlate the high-value ,,it and ,,ot systems considered in the study with appropriate categories based on reliability standards1 such as impact categories relating to the ,bulk ,electric ,system 7as defined by the ,electric ,reliability ,organization71 so the results of the study may be readily applied by the ,electric ,reliability ,organization4 7c7 ,report 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall submit to the ,committee on ,energy and ,natural ,resources of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report on the study required under subsection 7a74 7#b7 ,form ,the report required under paragraph 7#a7 shall be in unclassified form1 but may include a classified annex4 7#c7 ,public availability ,the ,secretary shall make available to the public the unclassified portion of the report required under paragraph 7#a74