S.Amdt. 3684

SA 3684. Mr. PETERS (for himself and Mrs. Blackburn) submitted an
amendment intended to be proposed by him to the bill S. 2296, to
authorize appropriations for fiscal year 2026 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:

At the end of subtitle F of title X, add the following:

SEC. 1067. STRATEGY FOR FEDERAL AGENCY MIGRATION TO POST-
QUANTUM CRYPTOGRAPHY.

(a) Definitions.--In this section:
(1) Cryptography.--The term ``cryptography'' has the
meaning given such term in the National Institute of
Standards and Technology Special Publication 1800-21B
(relating to mobile device security) and the National
Institute of Standards and Technology Special Publication
800-59 (relating to guidelines for identifying an information
system as a national security system).
(2) Classical computer.--The term ``classical computer''
means a device that accepts digital data and manipulates the
data based on a program or sequence of instructions for how
such data is to be processed, and that encodes information in
binary.
(3) Quantum computer.--The term ``quantum computer'' means
a computer that uses the collective properties of quantum
states, such as superposition, interference, and
entanglement, to perform calculations.
(4) Post-quantum cryptography.--The term ``post-quantum
cryptography'' means cryptographic algorithms or methods that
are not specifically vulnerable to attacks by either a
quantum computer or classical computer.
(5) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given that term in section
1016(e) of the Critical Infrastructures Protection Act of
2001 (42 U.S.C. 5195c(e)).
(6) High-impact system.--The term ``high-impact system''
means a Federal information system that holds sensitive
information, the loss of which would be categorized as high
impact under Federal Information Processing Standards
Publication 199 (relating to standards for security
categorization of Federal information and information
systems), as in effect on the day before the date of the
enactment of this Act.
(7) Sector risk management agency.--The term ``sector risk
management agency'' has the meaning given the term in section
2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).

[[Page S5520]]

(b) Strategy for Federal Agency Migration to Post-quantum
Cryptography.--
(1) Duties of subcommittee on the economic and security
implications of quantum information science.--Not later than
180 days after the date of the enactment of this Act, the
Subcommittee on the Economic and Security Implications of
Quantum Information Science, as established by section 105 of
the National Quantum Initiative Act (15 U.S.C. 8814a), in
coordination with the Director of the National Institute of
Standards and Technology and in consultation with the Quantum
Economic Development Consortium, shall develop a National
Quantum Cybersecurity Migration Strategy that includes the
following:
(A) A definition of a cryptographically relevant quantum
computer.
(B) Recommended standards for Federal agencies to apply to
determine whether a quantum computer meets such definition,
including--
(i) the characteristics of such computers; and
(ii) the particular point at which such computers are
capable of attacking real world cryptographic systems that
classical computers are unable to attack.
(C) An assessment of the urgency for migration to post-
quantum cryptography for each Federal agency relative to--
(i) the critical functions of each agency; and
(ii) the risk each agency faces should a cryptographically
relevant quantum computer attack a system operated by the
agency.
(D) Performance measures for migration to post-quantum
cryptography to be used by each Federal agency for each of
the following 4 stages of migration:
(i) Preparation for migration to post-quantum cryptography.
(ii) Establishment of a baseline understanding of the data
inventory.
(iii) Planning and execution of post-quantum cryptographic
solutions, including ensuring that data at rest and in motion
is subject to appropriate protections.
(iv) Monitoring and evaluation of migration success and
assessment of cryptographic security.
(E) A plan for evaluating and monitoring entities that are
at high risk of quantum cryptographic attacks, including
entities determined to be providers of critical
infrastructure.
(2) Post-quantum pilot program.--Not later than 180 days
after the date of the enactment of this Act, the Subcommittee
on the Economic and Security Implications of Quantum
Information Science shall establish a post-quantum pilot
program that requires each sector risk management agency to
upgrade not less than one high-impact system to post-quantum
cryptography not later than January 1, 2027.
(3) Duties of the office of electronic government.--Not
later than 180 days after the date of the enactment of this
Act, the Administrator of the Office of Electronic
Government, in coordination with the Subcommittee on the
Economic and Security Implications of Quantum Information
Science, shall--
(A) survey the heads of Federal agencies for information
relating to the cost of migration to post-quantum
cryptography by the Federal agencies, including estimates for
the personnel, equipment, and time needed to fully implement
post-quantum cryptography, in alignment with the National
Quantum Cybersecurity Migration Strategy developed pursuant
to paragraph (1);
(B) verify that the information provided under subparagraph
(A) is realistic and fiscally sound;
(C) identify the funding and resources necessary for
Federal agencies to carry out the migration to post-quantum
cryptography; and
(D) advise on how Federal agencies should encourage the
adoption of post-quantum cryptography by the private sector.
(4) Report to congress.--Not later than 1 year after the
date of the enactment of this Act, the Director of the Office
of Management and Budget and the Subcommittee on the Economic
and Security Implications of Quantum Information Science
shall jointly submit to Congress a report detailing their
findings with respect to the post-quantum migration
assessments required by paragraph (1), the pilot program
established pursuant to paragraph (2), and the survey on
associated costs of executing the migration required by
paragraph (3)(A).
(5) Assessment by comptroller general.--Not later than 1
year after the development of the National Quantum
Cybersecurity Migration Strategy under paragraph (1), and
annually thereafter, the Comptroller General of the United
States shall submit to Congress an assessment, using the
performance measures described in paragraph (1)(D), of the
progress made by each Federal agency in migrating to post-
quantum cryptography.
______