II 

117TH CONGRESS 

2D SESSION S. 4592 

To encourage the migration of Federal Government information technology 

systems to quantum-resistant cryptography, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 21, 2022 

Ms. HASSAN (for herself and Mr. PORTMAN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To encourage the migration of Federal Government information technology systems to quantum-resistant cryptography, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Quantum Computing 

5 Cybersecurity Preparedness Act’’. 

6 SEC. 2. FINDINGS; SENSE OF CONGRESS. 

7 (a) FINDINGS.—Congress finds the following: 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 4592 IS

1 (1) Cryptography is essential for the national 

2 security of the United States and the functioning of 

3 the economy of the United States. 

4 (2) The most widespread encryption protocols 

5 today rely on computational limits of classical com6 puters to provide cybersecurity. 

7 (3) Quantum computers might one day have the 

8 ability to push computational boundaries, allowing 

9 us to solve problems that have been intractable thus 

10 far, such as integer factorization, which is important 

11 for encryption. 

12 (4) The rapid progress of quantum computing 

13 suggests the potential for adversaries of the United 

14 States to steal sensitive encrypted data today using 

15 classical computers, and wait until sufficiently pow16 erful quantum systems are available to decrypt it. 

17 (b) SENSE OF CONGRESS.—It is the sense of Con18 gress that— 

19 (1) a strategy for the migration of information 

20 technology systems of the Federal Government to 

21 post-quantum cryptography is needed; and 

22 (2) the governmentwide and industrywide ap23 proach to post-quantum cryptography should 

24 prioritize developing applications, hardware intellecVerDate Sep 11 2014 02:30 Jul 29, 2022 Jkt 029200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4592.IS S4592

kjohnson on DSK79L0C42PROD with BILLS
3 

•S 4592 IS

1 tual property, and software that can be easily up2 dated to support cryptographic agility. 

3 SEC. 3. DEFINITIONS. 

4 In this Act: 

5 (1) CLASSICAL COMPUTER.—The term ‘‘clas6 sical computer’’ means a device that accepts digital 

7 data and manipulates the information based on a 

8 program or sequence of instructions for how data is 

9 to be processed and encodes information in binary 

10 bits that can either be 0s or 1s. 

11 (2) DIRECTOR OF CISA.—The term ‘‘Director of 

12 CISA’’ means the Director of the Cybersecurity and 

13 Infrastructure Security Agency. 

14 (3) DIRECTOR OF NIST.—The term ‘‘Director 

15 of NIST’’ means the Director of the National Insti16 tute of Standards and Technology. 

17 (4) DIRECTOR OF OMB.—The term ‘‘Director of 

18 OMB’’ means the Director of the Office of Manage19 ment and Budget. 

20 (5) EXECUTIVE AGENCY.—The term ‘‘executive 

21 agency’’ has the meaning given the term ‘‘Executive 

22 agency’’ in section 105 of title 5, United States 

23 Code. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 4592 IS

1 (6) INFORMATION TECHNOLOGY.—The term 

2 ‘‘information technology’’ has the meaning given the 

3 term in section 3502 of title 44, United States Code. 

4 (7) POST-QUANTUM CRYPTOGRAPHY.—The 

5 term ‘‘post-quantum cryptography’’ means a cryp6 tographic system that— 

7 (A) is secure against decryption attempts 

8 using a quantum computer or classical com9 puter; and 

10 (B) can interoperate with existing commu11 nications protocols and networks. 

12 (8) QUANTUM COMPUTER.—The term ‘‘quan13 tum computer’’ means a computer that uses the col14 lective properties of quantum states to perform cal15 culations. 

16 SEC. 4. INVENTORY OF CRYPTOGRAPHIC SYSTEMS; MIGRA17 TION TO POST-QUANTUM CRYPTOGRAPHY. 

18 (a) INVENTORY.— 

19 (1) ESTABLISHMENT.—Not later than 180 days 

20 after the date of enactment of this Act, the Director 

21 of OMB shall establish, by rule or binding guidance, 

22 a requirement for each executive agency to establish 

23 and maintain an inventory of each cryptographic 

24 system in use by the agency. 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 4592 IS

1 (2) ADDITIONAL CONTENT IN RULE OR BIND2 ING GUIDANCE.—In the rule or binding guidance es3 tablished by paragraph (1), the Director of OMB 

4 shall include, in addition to the requirement de5 scribed under that paragraph— 

6 (A) a description of information technology 

7 to be prioritized for migration to post-quantum 

8 cryptography; 

9 (B) a description of the information re10 quired to be reported pursuant to subsection 

11 (b); and 

12 (C) a process for evaluating progress on 

13 migrating information technology to post-quan14 tum cryptography, which shall be automated to 

15 the greatest extent practicable. 

16 (3) PERIODIC UPDATES.—The Director of OMB 

17 shall update the rule or binding guidance established 

18 by paragraph (1) as the Director determines nec19 essary. 

20 (b) AGENCY REPORTS.—Not later than 1 year after 

21 the date of enactment of this Act, and on an ongoing basis 

22 thereafter, the head of each executive agency shall provide 

23 to the Director of OMB, the Director of CISA, and the 

24 National Cyber Director an inventory of all information 

25 technology in use by the executive agency that is vulnerVerDate Sep 11 2014 03:47 Jul 26, 2022 Jkt 029200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S4592.IS S4592

kjohnson on DSK79L0C42PROD with BILLS
6 

•S 4592 IS

1 able to decryption by quantum computers, prioritized pur2 suant to the guidance issued under subsection (a)(2). 

3 (c) MIGRATION AND ASSESSMENT.— 

4 (1) MIGRATION TO POST-QUANTUM CRYPTOG5 RAPHY.—Not later than 1 year after the date on 

6 which the Director of NIST has issued post-quan7 tum cryptography standards, the Director of OMB 

8 shall issue guidance requiring each executive agency 

9 to develop a plan to migrate information technology 

10 of the agency to post-quantum cryptography. 

11 (2) DESIGNATION OF SYSTEMS FOR MIGRA12 TION.—Not later than 90 days after the date on 

13 which the guidance required by paragraph (1) has 

14 been issued, the Director of OMB shall issue guid15 ance for agencies to— 

16 (A) designate information technology to be 

17 migrated to post-quantum cryptography; and 

18 (B) prioritize information technology des19 ignated under subparagraph (A), on the basis 

20 of the amount of risk posed by decryption by 

21 quantum computers to that technology, for mi22 gration to post-quantum cryptography. 

23 (d) INTEROPERABILITY.—The Director of OMB shall 

24 ensure that the designations and prioritizations made 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 4592 IS

1 under subsection (c)(2) are assessed and coordinated to 

2 ensure interoperability. 

3 (e) REPORT ON POST-QUANTUM CRYPTOGRAPHY.— 

4 Not later than 15 months after the date of enactment of 

5 this Act, the Director of OMB shall submit to Congress 

6 a report on the following: 

7 (1) A strategy to address the risk posed by the 

8 vulnerabilities of information technology systems of 

9 executive agencies to weakened encryption due to the 

10 potential and possible capability of a quantum com11 puter to breach that encryption. 

12 (2) The amount of funding needed by executive 

13 agencies to secure the information technology sys14 tems described in paragraph (1) from the risk posed 

15 by an adversary of the United States using a quan16 tum computer to breach the encryption of informa17 tion technology systems. 

18 (3) A description of Federal civilian executive 

19 branch coordination efforts led by the National In20 stitute of Standards and Technology, including 

21 timelines, to develop standards for post-quantum 

22 cryptography, including any Federal Information 

23 Processing Standards developed under chapter 35 of 

24 title 44, United States Code, as well as standards 

25 developed through voluntary, consensus standards 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 4592 IS

1 bodies such as the International Organization for 

2 Standardization. 

3 (f) REPORT ON MIGRATION TO POST-QUANTUM

4 CRYPTOGRAPHY IN INFORMATION TECHNOLOGY SYS5 TEMS.—Not later than 1 year after the date on which the 

6 Director of OMB issues guidance under subsection (c)(2), 

7 and annually thereafter until the date that is 5 years after 

8 the date on which post-quantum cryptographic standards 

9 are issued, the Director of OMB shall submit to Congress, 

10 with the report submitted pursuant to section 3553(c) of 

11 title 44, United States Code, a report on the progress of 

12 executive agencies in adopting post-quantum cryptography 

13 standards. 

14 SEC. 5. DETERMINATION OF BUDGETARY EFFECTS. 

15 The budgetary effects of this Act, for the purpose of 

16 complying with the Statutory Pay-As-You-Go Act of 2010, 

17 shall be determined by reference to the latest statement 

18 titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 

19 Act, submitted for printing in the Congressional Record 

20 by the Chairman of the House Budget Committee, pro21 vided that such statement has been submitted prior to the 

22 vote on passage. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS