S2558-119

1. Short title This Act may be cited as the The National Quantum Cybersecurity Migration Strategy Act of 2025..

2. Definitions In this Act: The term cryptography has the meaning given such term in the National Institute of Standards and Technology Special Publication 1800–21B (relating to mobile device security) and the National Institute of Standards and Technology Special Publication 800–59 (relating to guidelines for identifying an information system as a national security system). The term classical computer means a device that accepts digital data and manipulates the data based on a program or sequence of instructions for how such data is to be processed, and that encodes information in binary. The term quantum computer means a computer that uses the collective properties of quantum states, such as superposition, interference, and entanglement, to perform calculations. The term post-quantum cryptography means cryptographic algorithms or methods that are not specifically vulnerable to attacks by either a quantum computer or classical computer. The term critical infrastructure has the meaning given that term in section 1016(e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)). The term high-impact system means a Federal information system that holds sensitive information, the loss of which would be categorized as high impact under Federal Information Processing Standards Publication 199 (relating to standards for security categorization of Federal information and information systems), as in effect on the day before the date of the enactment of this Act. The term sector risk management agency has the meaning given the term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).

3. Strategy for Federal agency migration to post-quantum cryptography Not later than 180 days after the date of the enactment of this Act, the Subcommittee on the Economic and Security Implications of Quantum Information Science, as established by section 105 of the National Quantum Initiative Act (15 U.S.C. 8814a), in coordination with the Director of the National Institute of Standards and Technology and in consultation with the Quantum Economic Development Consortium, shall develop a National Quantum Cybersecurity Migration Strategy that includes the following: A definition of a cryptographically relevant quantum computer. Recommended standards for Federal agencies to apply to determine whether a quantum computer meets such definition, including— the characteristics of such computers; and the particular point at which such computers are capable of attacking real world cryptographic systems that classical computers are unable to attack. An assessment of the urgency for migration to post-quantum cryptography for each Federal agency relative to— the critical functions of each agency; and the risk each agency faces should a cryptographically relevant quantum computer attack a system operated by the agency. Performance measures for migration to post-quantum cryptography to be used by each Federal agency for each of the following 4 stages of migration: Preparation for migration to post-quantum cryptography. Establishment of a baseline understanding of the data inventory. Planning and execution of post-quantum cryptographic solutions, including ensuring that data at rest and in motion is subject to appropriate protections. Monitoring and evaluation of migration success and assessment of cryptographic security. A plan for evaluating and monitoring entities that are at high risk of quantum cryptographic attacks, including entities determined to be providers of critical infrastructure. Not later than 180 days after the date of the enactment of this Act, the Subcommittee on the Economic and Security Implications of Quantum Information Science shall establish a post-quantum pilot program that requires each sector risk management agency to upgrade not less than one high-impact system to post-quantum cryptography not later than January 1, 2027. Not later than 180 days after the date of the enactment of this Act, the Administrator of the Office of Electronic Government, in coordination with the Subcommittee on the Economic and Security Implications of Quantum Information Science, shall— survey the heads of Federal agencies for information relating to the cost of migration to post-quantum cryptography by the Federal agencies, including estimates for the personnel, equipment, and time needed to fully implement post-quantum cryptography, in alignment with the National Quantum Cybersecurity Migration Strategy developed pursuant to subsection (a); verify that the information provided under paragraph (1) is realistic and fiscally sound; identify the funding and resources necessary for Federal agencies to carry out the migration to post-quantum cryptography; and advise on how Federal agencies should encourage the adoption of post-quantum cryptography by the private sector. Not later than 1 year after the date of the enactment of this Act, the Director of the Office of Management and Budget and the Subcommittee on the Economic and Security Implications of Quantum Information Science shall jointly submit to Congress a report detailing their findings with respect to the post-quantum migration assessments required under subsection (a)(3), the pilot program established pursuant to subsection (b), and the survey on associated costs of executing the migration required by subsection (c)(1). Not later than 1 year after the development of the National Quantum Cybersecurity Migration Strategy under subsection (a), and annually thereafter, the Comptroller General of the United States shall submit to Congress an assessment, using the performance measures described in subsection (a)(4), of the progress made by each Federal agency in migrating to post-quantum cryptography.