Quantum Computing Cybersecurity Preparedness Act

Quantum Computing Cybersecurity Preparedness Act

This act addresses the migration of executive agencies' information technology systems to post-quantum cryptography. Post-quantum cryptography is encryption strong enough to resist attacks from quantum computers developed in the future. The act does not apply to national security systems.

The Office of Management and Budget (OMB) shall issue guidance on the migration of information technology to post-quantum cryptography.

Each executive agency must maintain an inventory of all information technology in use by the executive agency that is vulnerable to decryption by quantum computers.

After the National Institutes of Standards and Technology (NIST) has issued post-quantum cryptography standards, the OMB shall issue guidance requiring each executive agency to develop a plan to migrate information technology of the agency to post-quantum cryptography.

OMB shall submit to Congress a report on

• a strategy to address the risk posed by the vulnerabilities of information technology of executive agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach such encryption;
• the funding needed by executive agencies to secure such information technology from the risk posed by an adversary of the United States using a quantum computer to breach the encryption; and
• a description of federal civilian executive branch coordination efforts led by NIST, including timelines, to develop standards for post-quantum cryptography.

Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov