IIB 
117TH CONGRESS 
2D SESSION 
H. R. 7535 
IN THE SENATE OF THE UNITED STATES 
JULY 13, 2022 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To encourage the migration of Federal Government informa-
tion technology systems to quantum-resistant cryptog-
raphy, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Quantum Computing 
Cybersecurity Preparedness Act’’. 
SEC. 2. FINDINGS; SENSE OF CONGRESS. 
(a) FINDINGS.—The Congress finds the following: 
(1) Cryptography is essential for the national 
security of the United States and the functioning of 
the economy of the United States. 
(2) The most widespread encryption protocols 
today rely on computational limits of classical com-
puters to provide cybersecurity. 
(3) Quantum computers might one day have the 
ability to push computational boundaries, allowing 
us to solve problems that have been intractable thus 
far, such as integer factorization, which is important 
for encryption. 
(4) The rapid progress of quantum computing 
suggests the potential for adversaries of the United 
States to steal sensitive encrypted data today using 
classical computers, and wait until sufficiently pow-
erful quantum systems are available to decrypt it. 
(b) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) a strategy for the migration of information 
technology systems of the Federal Government to 
post-quantum cryptography is needed; and 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
(2) the Governmentwide and industrywide ap-
proach 
to 
post-quantum 
cryptography 
should 
prioritize developing applications, hardware intellec-
tual property, and software that can be easily up-
dated to support cryptographic agility. 
SEC. 3. INVENTORY OF CRYPTOGRAPHIC SYSTEMS; MIGRA-
TION TO POST-QUANTUM CRYPTOGRAPHY. 
(a) INVENTORY.— 
(1) ESTABLISHMENT.—Not later than 180 days 
after the date of the enactment of this Act, the Di-
rector of OMB shall establish, by rule or binding 
guidance, a requirement for each executive agency to 
establish and maintain an inventory of each cryp-
tographic system in use by the agency. 
(2) ADDITIONAL CONTENT IN RULE OR BIND-
ING GUIDANCE.—In the rule or binding guidance es-
tablished by paragraph (1), the Director of OMB 
shall include, in addition to the requirement de-
scribed under such paragraph— 
(A) a description of information technology 
to be prioritized for migration to post-quantum 
cryptography; 
(B) a description of the information re-
quired to be reported pursuant to subsection 
(b); and 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
(C) a process for evaluating progress on 
migrating information technology to post-quan-
tum cryptography, which shall be automated to 
the greatest extent practicable. 
(3) PERIODIC UPDATES.—The Director of OMB 
shall update the rule or binding guidance established 
by paragraph (1) as the Director determines nec-
essary. 
(b) AGENCY REPORTS.—Not later than 1 year after 
the date of the enactment of this Act, and on an ongoing 
basis thereafter, the head of each executive agency shall 
provide to the Director of OMB, the Director of CISA, 
and the National Cyber Director an inventory of all infor-
mation technology in use by the executive agency that is 
vulnerable to decryption by quantum computers. 
(c) MIGRATION AND ASSESSMENT.— 
(1) MIGRATION TO POST-QUANTUM CRYPTOG-
RAPHY.—Not later than 1 year after the date on 
which the Director of NIST has issued post-quan-
tum cryptography standards, the Director of OMB 
shall issue guidance requiring each executive agency 
to develop a plan, including interim benchmarks, to 
migrate information technology of the agency to 
post-quantum cryptography. 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
(2) DESIGNATION
OF
SYSTEMS
FOR
MIGRA-
TION.—Not later than 90 days after the date on 
which the guidance required by paragraph (1) has 
been issued, the Director of OMB shall issue guid-
ance for agencies to— 
(A) designate information technology to be 
migrated to post-quantum cryptography; and 
(B) prioritize information technology des-
ignated under subparagraph (A), on the basis 
of the amount of risk posed by decryption by 
quantum computers to such technology, for mi-
gration to post-quantum cryptography. 
(d) INTEROPERABILITY.—The Director of OMB shall 
ensure that the designations and prioritizations made 
under subsection (c)(2) are assessed and coordinated to 
ensure interoperability. 
(e) REPORT ON POST-QUANTUM CRYPTOGRAPHY.— 
Not later than 15 months after the date of the enactment 
of this Act, the Director of OMB shall submit to Congress 
a report on the following: 
(1) A strategy to address the risk posed by the 
vulnerabilities of information technology systems of 
executive agencies to weakened encryption due to the 
potential and possible capability of a quantum com-
puter to breach such encryption. 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
(2) The amount of funding needed by executive 
agencies to secure such information technology sys-
tems from the risk posed by an adversary of the 
United States using a quantum computer to breach 
the encryption of information technology systems. 
(3) A description of Federal civilian executive 
branch coordination efforts led by the National In-
stitute of Standards and Technology, including 
timelines, to develop standards for post-quantum 
cryptography, including any Federal Information 
Processing Standards developed under chapter 35 of 
title 44, United States Code, as well as standards 
developed through voluntary, consensus standards 
bodies such as the International Organization for 
Standardization. 
(f) REPORT
ON MIGRATION
TO POST-QUANTUM 
CRYPTOGRAPHY
IN INFORMATION TECHNOLOGY SYS-
TEMS.—Not later than 1 year after the date on which the 
Director of OMB issues guidance under subsection (c)(2), 
and annually thereafter until the date that is 5 years after 
the date on which post-quantum cryptographic standards 
are issued, the Director of OMB shall submit to Congress, 
with the report submitted pursuant to section 3553(c) of 
title 44, United States Code, a report on the progress of 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS
HR 7535 RFS
executive agencies in adopting post-quantum cryptography 
standards. 
(g) DEFINITIONS.—In this Act: 
(1) CLASSICAL
COMPUTER.—The term ‘‘clas-
sical computer’’ means a device that accepts digital 
data and manipulates the information based on a 
program or sequence of instructions for how data is 
to be processed and encodes information in binary 
bits that can either be 0s or 1s. 
(2) DIRECTOR OF NIST.—The term ‘‘Director 
of NIST’’ means the Director of the National Insti-
tute of Standards and Technology. 
(3) DIRECTOR OF OMB.—The term ‘‘Director of 
OMB’’ means the Director of the Office of Manage-
ment and Budget. 
(5) EXECUTIVE AGENCY.—The term ‘‘executive 
agency’’ has the meaning given the term ‘‘Executive 
agency’’ in section 105 of title 5, United States 
Code. 
(6) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given 
that term in section 3502 of title 44, United States 
Code. 
VerDate Sep 11 2014 
03:22 Jul 14, 2022
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7535.RFS
H7535
kjohnson on DSK79L0C42PROD with BILLS