To require the Federal Energy Regulatory Commission to consider cybersecurity risks from quantum computers, and for other purposes.

To require the Federal Energy Regulatory Commission to consider cybersecurity risks from quantum computers, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. Short title.

SEC. 2. Definitions.

(1) BULK-POWER SYSTEM.—The term “bulk-power system” has the meaning given the term in section 215(a) of the Federal Power Act (16 U.S.C. 824o(a)).

(2) COMMISSION.—The term “Commission” means the Federal Energy Regulatory Commission.

(3) ELECTRIC RELIABILITY ORGANIZATION.—The term “Electric Reliability Organization” has the meaning given the term in section 215(a) of the Federal Power Act (16 U.S.C. 824o(a)).

(4) HIGH-VALUE.—The term “high-value”, with respect to an IT or OT system, means that the system is so critical to an organization that the loss or corruption of information within the system or loss of access to the system would have serious impacts on the ability of the organization to perform its mission or conduct business.

(5) INFORMATION TECHNOLOGY; IT.—

(A) IN GENERAL.—The term “information technology” or “IT” means any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information.

(B) INCLUSIONS.—The term “information technology” or “IT” includes, at a minimum, computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

(6) OPERATIONAL TECHNOLOGY; OT.—

(A) IN GENERAL.—The term “operational technology” or “OT” means any programmable system or device that—

(i) interacts with the physical environment (or manages devices that interact with the physical environment); and

(ii) detects or causes a direct change through the monitoring or control of devices, processes, or events.

(B) INCLUSIONS.—The term “operational technology” or “OT” includes, at a minimum, industrial control systems, building management systems, fire control systems, and physical access control mechanisms.

(7) POST-QUANTUM CRYPTOGRAPHY; PQC.—The term “post-quantum cryptography” or “PQC” means cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by any of—

(A) a quantum computer (as defined in section 3 of the Quantum Computing Cybersecurity Preparedness Act (6 U.S.C. 1526 note; Public Law 117–260)); or

(B) a classical computer (as defined in that section).

(8) PQC SANDBOX.—The term “PQC sandbox” means a program for innovation and development with respect to the use of post-quantum cryptography in IT and OT applications for the electric grid that—

(A) assembles relevant stakeholders, which may include operators of the bulk-power system, IT and OT vendors, relevant Federal agencies, relevant State and local organizations, and distribution utilities (as defined in section 217(a) of the Federal Power Act (16 U.S.C. 824q(a)));

(B) addresses challenges in PQC cybersecurity development and adoption;

(C) prioritizes activities that support, encourage, or enable PQC integration into—

(i) existing systems; and

(ii) during the 5-year period beginning on the date of enactment of this Act, systems that are expected to be deployed within that 5-year period;

(D) may include briefings, workshops, software challenges, hardware modeling, grid simulations, or red-teaming exercises; and

(E) may be used to develop and test demonstrations, proofs of concept, interoperability between IT and OT systems, and pilot applications.

(9) RELIABILITY STANDARD.—The term “reliability standard” has the meaning given the term in section 215(a) of the Federal Power Act (16 U.S.C. 824o(a)).

(10) SECRETARY.—The term “Secretary” means the Secretary of Energy, acting through the Office of Cybersecurity, Energy Security, and Emergency Response.

SEC. 3. FERC consideration of cybersecurity risks from quantum computers.

(1) consider—

(A) cybersecurity risks from quantum computers; and

(B) potential uses of post-quantum cryptography in IT and OT systems to protect against those risks; and

(2) take such action the Commission determines to be appropriate based on that consideration.

SEC. 4. DOE PQC sandbox.

(a) In general.—Not later than 1 year after the date of enactment of this Act, the Secretary shall establish a PQC sandbox.

(b) Collaboration.—In establishing and maintaining the PQC sandbox under subsection (a), the Secretary may collaborate, as appropriate, with appropriate officials at other Federal agencies.

(c) Outreach.—Not later than 3 years after the date of enactment of this Act, the Secretary shall publish a report describing the outcomes of, and recommendations arising from, PQC sandbox activities, to encourage PQC adoption by operators of the bulk-power system.

SEC. 5. PQC report.

(a) Study.—The Secretary, in consultation with the Electric Reliability Organization and other appropriate organizations, shall conduct a study of cybersecurity risks to the bulk-power system from quantum computers, including, at minimum—

(1) risks to IT and OT systems; and

(2) obstacles to transitioning high-value IT and OT systems to PQC.

(b) Requirements.—In conducting the study under subsection (a), the Secretary shall—

(1) develop recommendations for actions that the Commission could take to ensure reliable operations of the bulk-power system; and

(2) to the extent practicable, correlate the high-value IT and OT systems considered in the study with appropriate categories based on reliability standards, such as impact categories relating to the Bulk Electric System (as defined by the Electric Reliability Organization), so the results of the study may be readily applied by the Electric Reliability Organization.

(c) Report.—

(1) IN GENERAL.—Not later than 1 year after the date of enactment of this Act, the Secretary shall submit to the Committee on Energy and Natural Resources of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on the study required under subsection (a).

(2) FORM.—The report required under paragraph (1) shall be in unclassified form, but may include a classified annex.

(3) PUBLIC AVAILABILITY.—The Secretary shall make available to the public the unclassified portion of the report required under paragraph (1).