In the Senate of the United States, 
December 8, 2022. 
Resolved, That the bill from the House of Representa-
tives (H.R. 7535) entitled ‘‘An Act to encourage the migra-
tion of Federal Government information technology systems 
to quantum-resistant cryptography, and for other purposes.’’, 
do pass with the following 
AMENDMENT: 
Strike all after the enacting clause and insert the 
following: 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Quantum Computing 
Cybersecurity Preparedness Act’’. 
SEC. 2. FINDINGS; SENSE OF CONGRESS. 
(a) FINDINGS.—Congress finds the following: 
(1) Cryptography is essential for the national se-
curity of the United States and the functioning of the 
economy of the United States.
† HR 7535 EAS 
(2) The most widespread encryption protocols 
today rely on computational limits of classical com-
puters to provide cybersecurity. 
(3) Quantum computers might one day have the 
ability to push computational boundaries, allowing us 
to solve problems that have been intractable thus far, 
such as integer factorization, which is important for 
encryption. 
(4) The rapid progress of quantum computing 
suggests the potential for adversaries of the United 
States to steal sensitive encrypted data today using 
classical computers, and wait until sufficiently pow-
erful quantum systems are available to decrypt it. 
(b) SENSE OF CONGRESS.—It is the sense of Congress 
that— 
(1) a strategy for the migration of information 
technology of the Federal Government to post-quan-
tum cryptography is needed; and 
(2) the governmentwide and industrywide ap-
proach 
to 
post-quantum 
cryptography 
should 
prioritize developing applications, hardware intellec-
tual property, and software that can be easily up-
dated to support cryptographic agility. 
SEC. 3. DEFINITIONS. 
In this Act:
† HR 7535 EAS 
(1) AGENCY .—The term ‘‘agency’’— 
(A) means any executive department, mili-
tary department, Government corporation, Gov-
ernment controlled corporation, or other estab-
lishment in the executive branch of the Govern-
ment (including the Executive Office of the 
President), or any independent regulatory agen-
cy; and 
(B) does not include— 
(i) the Government Accountability Of-
fice; or 
(ii) the governments of the District of 
Columbia and of the territories and posses-
sions of the United States, and their various 
subdivisions. 
(2) CLASSICAL COMPUTER.—The term ‘‘classical 
computer’’ means a device that accepts digital data 
and manipulates the information based on a program 
or sequence of instructions for how data is to be proc-
essed and encodes information in binary bits that can 
either be 0s or 1s. 
(3) DIRECTOR OF CISA.—The term ‘‘Director of 
CISA’’ means the Director of the Cybersecurity and 
Infrastructure Security Agency.
† HR 7535 EAS 
(4) DIRECTOR OF NIST.—The term ‘‘Director of 
NIST’’ means the Director of the National Institute 
of Standards and Technology. 
(5) DIRECTOR OF OMB.—The term ‘‘Director of 
OMB’’ means the Director of the Office of Manage-
ment and Budget. 
(6) INFORMATION TECHNOLOGY.—The term ‘‘in-
formation technology’’ has the meaning given the term 
in section 3502 of title 44, United States Code. 
(7) NATIONAL
SECURITY
SYSTEM.—The term 
‘‘national security system’’ has the meaning given the 
term in section 3552 of title 44, United States Code. 
(8) POST-QUANTUM CRYPTOGRAPHY.—The term 
‘‘post-quantum cryptography’’ means those cryp-
tographic algorithms or methods that are assessed not 
to be specifically vulnerable to attack by either a 
quantum computer or classical computer. 
(9) QUANTUM COMPUTER.—The term ‘‘quantum 
computer’’ means a computer that uses the collective 
properties of quantum states, such as superposition, 
interference, and entanglement, to perform calcula-
tions. 
SEC. 4. INVENTORY OF CRYPTOGRAPHIC SYSTEMS; MIGRA-
TION TO POST-QUANTUM CRYPTOGRAPHY. 
(a) INVENTORY.—
† HR 7535 EAS 
(1) ESTABLISHMENT.—Not later than 180 days 
after the date of enactment of this Act, the Director 
of OMB, in coordination with the National Cyber Di-
rector and in consultation with the Director of CISA, 
shall issue guidance on the migration of information 
technology to post-quantum cryptography, which shall 
include at a minimum— 
(A) a requirement for each agency to estab-
lish and maintain a current inventory of infor-
mation technology in use by the agency that is 
vulnerable to decryption by quantum computers, 
prioritized using the criteria described in sub-
paragraph (B); 
(B) criteria to allow agencies to prioritize 
their inventory efforts; and 
(C) a description of the information re-
quired to be reported pursuant to subsection (b). 
(2) ADDITIONAL CONTENT IN GUIDANCE.—In the 
guidance established by paragraph (1), the Director of 
OMB shall include, in addition to the requirements 
described in that paragraph— 
(A) a description of information technology 
to be prioritized for migration to post-quantum 
cryptography; and
† HR 7535 EAS 
(2) develop a plan to migrate information tech-
nology of the agency to post-quantum cryptography 
consistent with the prioritization under paragraph 
(1). 
(d) INTEROPERABILITY.—The Director of OMB shall 
ensure that the prioritizations made under subsection (c)(1) 
are assessed and coordinated to ensure interoperability. 
(e) OFFICE
OF MANAGEMENT
AND BUDGET RE-
PORTS.— 
(1) 
REPORT
ON
POST-QUANTUM
CRYPTOG-
RAPHY.—Not later than 15 months after the date of 
enactment of this Act, the Director of OMB, in coordi-
nation with the National Cyber Director and in con-
sultation with the Director of CISA, shall submit to 
the Committee on Homeland Security and Govern-
mental Affairs of the Senate and the Committee on 
Oversight and Reform of the House of Representatives 
a report on the following: 
(A) A strategy to address the risk posed by 
the vulnerabilities of information technology of 
agencies to weakened encryption due to the po-
tential and possible capability of a quantum 
computer to breach that encryption. 
(B) An estimate of the amount of funding 
needed by agencies to secure the information
† HR 7535 EAS 
technology described in subsection (a)(1)(A) from 
the risk posed by an adversary of the United 
States using a quantum computer to breach the 
encryption of the information technology. 
(C) A description of Federal civilian execu-
tive branch coordination efforts led by the Na-
tional Institute of Standards and Technology, 
including timelines, to develop standards for 
post-quantum cryptography, including any Fed-
eral Information Processing Standards developed 
under chapter 35 of title 44, United States Code, 
as well as standards developed through vol-
untary, consensus standards bodies such as the 
International Organization for Standardization. 
(2) REPORT ON MIGRATION TO POST-QUANTUM 
CRYPTOGRAPHY IN INFORMATION TECHNOLOGY.—Not 
later than 1 year after the date on which the Director 
of OMB issues guidance under subsection (c)(2), and 
thereafter until the date that is 5 years after the date 
on which post-quantum cryptographic standards are 
issued, the Director of OMB, in coordination with the 
National Cyber Director and in consultation with the 
Director of CISA, shall submit to the Committee on 
Homeland Security and Governmental Affairs of the 
Senate and the Committee on Oversight and Reform
† HR 7535 EAS 
of the House of Representatives, with the report sub-
mitted pursuant to section 3553(c) of title 44, United 
States Code, a report on the progress of agencies in 
adopting post-quantum cryptography standards. 
SEC. 5. EXEMPTION OF NATIONAL SECURITY SYSTEMS. 
This Act shall not apply to any national security sys-
tem. 
SEC. 6. DETERMINATION OF BUDGETARY EFFECTS. 
The budgetary effects of this Act, for the purpose of 
complying with the Statutory Pay-As-You-Go Act of 2010, 
shall be determined by reference to the latest statement titled 
‘‘Budgetary Effects of PAYGO Legislation’’ for this Act, 
submitted for printing in the Congressional Record by the 
Chairman of the House Budget Committee, provided that 
such statement has been submitted prior to the vote on pas-
sage. 
Attest: 
Secretary.