S.Amdt. 3609

SA 3609. Mrs. BLACKBURN (for herself and Mr. Peters) submitted an
amendment intended to be proposed by her to the bill S. 2296, to
authorize appropriations for fiscal year 2026 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:

At the end of subtitle F of title X, add the following:

SEC. 1085. ASSESSMENT FOR FEDERAL AGENCY MIGRATION TO POST-
QUANTUM CRYPTOGRAPHY.

(a) Definitions.--In this section:
(1) Cryptography.--The term ``cryptography'' has the
meaning given such term in the National Institute of
Standards and Technology Special Publication 1800-21B
(relating to mobile device security) and the National
Institute of Standards and Technology Special Publication
800-59 (relating to guidelines for identifying an information
system as a national security system).
(2) Classical computer.--The term ``classical computer''
means a device that accepts digital data and manipulates the
data based on a program or sequence of instructions for how
such data is to be processed, and that encodes information in
binary.
(3) Quantum computer.--The term ``quantum computer'' means
a computer that uses the collective properties of quantum
states, such as superposition, interference, and
entanglement, to perform calculations.
(4) Post-quantum cryptography.--The term ``post-quantum
cryptography'' means cryptographic algorithms or methods that
are not specifically vulnerable to attacks by either a
quantum computer or classical computer.
(5) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given that term in section
1016(e) of the Critical Infrastructures Protection Act of
2001 (42 U.S.C. 5195c(e)).
(b) Assessment for Federal Agency Migration to Post-quantum
Cryptography.--
(1) Duties of subcommittee on the economic and security
implications of quantum information science.--Not later than
180 days after the date of the enactment of this Act, the
Subcommittee on the Economic and Security Implications of
Quantum Information Science, as established by section 105 of
the National Quantum Initiative Act (15 U.S.C. 8814a),
shall--
(A) develop a National Quantum Cybersecurity Migration
Strategy;
(B) provide a definition of a cryptographically relevant
quantum computer;
(C) develop standards for Federal agencies to apply to
determine whether a quantum computer meets such definition,
including--
(i) the characteristics of such computers; and
(ii) the particular point at which such computers are
capable of attacking real world cryptographic systems that
classical computers are unable to attack;
(D) assess the urgency for migration to post-quantum
cryptography for each Federal agency relative to--
(i) the critical functions of each agency; and
(ii) the risk each agency faces should a cryptographically
relevant quantum computer attack a system operated by the
agency;
(E) identify performance measures for migration to post-
quantum cryptography at each Federal agency for each of the
following 4 stages of migration:
(i) Preparation for migration to post-quantum cryptography.
(ii) Establishment of a baseline understanding of the data
inventory of each agency.
(iii) Planning and execution of post-quantum cryptographic
solutions.
(iv) Monitoring and evaluation of migration success and
assessment of cryptographic security; and
(F) evaluate and monitor entities that are at high risk of
quantum cryptographic attacks, including entities determined
to be providers of critical infrastructure.
(2) Post-quantum pilot program.--Not later than 180 days
after the date of the enactment of this Act, the Subcommittee
on the Economic and Security Implications of Quantum
Information Science shall establish a post-quantum pilot
program that requires each Federal agency to upgrade not less
than one high-impact system to post-quantum cryptography not
later than January 1, 2027.
(3) Duties of the office of electronic government.--Not
later than 180 days after the date of the enactment of this
Act, the Administrator of the Office of Electronic
Government, in coordination with the Chairpersons of the
Subcommittee on the Economic and Security Implications of
Quantum Information Science, shall--
(A) survey the heads of Federal agencies for information
relating to the cost of migration to post-quantum
cryptography by the Federal agencies, including estimates for
the personnel, equipment, and time needed to fully implement
post-quantum cryptography, in alignment with the National
Quantum Cybersecurity Migration Strategy developed pursuant
to paragraph (1)(A);
(B) verify that the information provided under subparagraph
(A) is realistic and fiscally sound;
(C) identify the funding and resources necessary for
Federal agencies to carry out the migration to post-quantum
cryptography; and
(D) describe how Federal agencies should encourage the
adoption of post-quantum cryptography by the private sector.
(4) Report.--Not later than 1 year after the date of the
enactment of this Act, the Director of the Office of
Management and Budget and the Chairpersons of the
Subcommittee on the Economic and Security Implications of
Quantum Information Science shall jointly submit to Congress
a report detailing their findings with respect to the post-
quantum migration assessments required by paragraph (1)(D),
the pilot program established pursuant to paragraph (2), and
the survey on associated costs of executing the migration
required under paragraph (3)(A).
______