[Congressional Record Volume 171, Number 133 (Friday, August 1, 2025)]
[Senate]
[Page S5464]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 3665. Mrs. BLACKBURN (for herself and Mr. Peters) submitted an
amendment intended to be proposed by her to the bill S. 2296, to
authorize appropriations for fiscal year 2026 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:
At the end of subtitle F of title X, add the following:
SEC. 1067. STRATEGY FOR FEDERAL AGENCY MIGRATION TO POST-
QUANTUM CRYPTOGRAPHY.
(a) Definitions.--In this section:
(1) Classical computer.--The term ``classical computer''
means a device that accepts digital data and manipulates the
data based on a program or sequence of instructions for how
such data is to be processed, and that encodes information in
binary.
(2) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given that term in section
1016(e) of the Critical Infrastructures Protection Act of
2001 (42 U.S.C. 5195c(e)).
(3) Cryptography.--The term ``cryptography'' has the
meaning given such term in the National Institute of
Standards and Technology Special Publication 1800-21B
(relating to mobile device security) and the National
Institute of Standards and Technology Special Publication
800-59 (relating to guidelines for identifying an information
system as a national security system).
(4) High-impact system.--The term ``high-impact system''
means a Federal information system that holds sensitive
information, the loss of which would be categorized as high
impact under Federal Information Processing Standards
Publication 199 (relating to standards for security
categorization of Federal information and information
systems), as in effect on the day before the date of the
enactment of this Act.
(5) Post-quantum cryptography.--The term ``post-quantum
cryptography'' means cryptographic algorithms or methods that
are not specifically vulnerable to attacks by either a
quantum computer or classical computer.
(6) Quantum computer.--The term ``quantum computer'' means
a computer that uses the collective properties of quantum
states, such as superposition, interference, and
entanglement, to perform calculations.
(7) Sector risk management agency.--The term ``sector risk
management agency'' has the meaning given the term in section
2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
(b) Assessment for Federal Agency Migration to Post-quantum
Cryptography.--
(1) Duties of subcommittee on the economic and security
implications of quantum information science.--Not later than
180 days after the date of the enactment of this Act, the
Subcommittee on the Economic and Security Implications of
Quantum Information Science, as established by section 105 of
the National Quantum Initiative Act (15 U.S.C. 8814a),
shall--
(A) develop a National Quantum Cybersecurity Migration
Strategy;
(B) provide a definition of a cryptographically relevant
quantum computer;
(C) develop standards for Federal agencies to apply to
determine whether a quantum computer meets such definition,
including--
(i) the characteristics of such computers; and
(ii) the particular point at which such computers are
capable of attacking real world cryptographic systems that
classical computers are unable to attack;
(D) assess the urgency for migration to post-quantum
cryptography for each Federal agency relative to--
(i) the critical functions of each agency; and
(ii) the risk each agency faces should a cryptographically
relevant quantum computer attack a system operated by the
agency;
(E) identify performance measures for migration to post-
quantum cryptography at each Federal agency for each of the
following 4 stages of migration:
(i) Preparation for migration to post-quantum cryptography.
(ii) Establishment of a baseline understanding of the data
inventory of each agency.
(iii) Planning and execution of post-quantum cryptographic
solutions.
(iv) Monitoring and evaluation of migration success and
assessment of cryptographic security; and
(F) evaluate and monitor entities that are at high risk of
quantum cryptographic attacks, including entities determined
to be providers of critical infrastructure.
(2) Post-quantum pilot program.--Not later than 180 days
after the date of the enactment of this Act, the Subcommittee
on the Economic and Security Implications of Quantum
Information Science shall establish a post-quantum pilot
program that requires each sector risk management agency to
upgrade not less than one high-impact system to post-quantum
cryptography not later than January 1, 2027.
(3) Duties of the office of electronic government.--Not
later than 180 days after the date of the enactment of this
Act, the Administrator of the Office of Electronic
Government, in coordination with the Chairpersons of the
Subcommittee on the Economic and Security Implications of
Quantum Information Science, shall--
(A) survey the heads of Federal agencies for information
relating to the cost of migration to post-quantum
cryptography by the Federal agencies, including estimates for
the personnel, equipment, and time needed to fully implement
post-quantum cryptography, in alignment with the National
Quantum Cybersecurity Migration Strategy developed pursuant
to paragraph (1)(A);
(B) verify that the information provided under subparagraph
(A) is realistic and fiscally sound;
(C) identify the funding and resources necessary for
Federal agencies to carry out the migration to post-quantum
cryptography; and
(D) describe how Federal agencies should encourage the
adoption of post-quantum cryptography by the private sector.
(4) Report.--Not later than 1 year after the date of the
enactment of this Act, the Director of the Office of
Management and Budget and the Chairpersons of the
Subcommittee on the Economic and Security Implications of
Quantum Information Science shall jointly submit to Congress
a report detailing their findings with respect to the post-
quantum migration assessments required by paragraph (1)(D),
the pilot program established pursuant to paragraph (2), and
the survey on associated costs of executing the migration
required under paragraph (3)(A).
(5) Assessment by comptroller general.--Not later than one
year after the development of the National Quantum
Cybersecurity Migration Strategy under paragraph (1), and
annually thereafter, the Comptroller General of the United
States shall submit to Congress an assessment, using the
performance measures described in paragraph (1)(E), of the
progress made by each Federal agency in migrating to post-
quantum cryptography.
______