All Roll Calls
Yes: 420 • No: 3
117-hr-7535117th Congress
Quantum Computing Cybersecurity Preparedness Act
Sponsored By: Representative Khanna, Ro [D-CA-17]
Became Law
Summary
This law creates a government-wide program to move federal computer systems to post-quantum cryptography. It sets roles, deadlines, and standards so agencies identify systems at risk from quantum decryption and plan upgrades to new cryptography.
Show full summary
- Federal agencies must produce mandatory inventories of information technology vulnerable to quantum attacks and report that inventory within 1 year. National security systems are explicitly excluded from the law.
- The Office of Management and Budget, working with the National Cyber Director and consulting the Cybersecurity and Infrastructure Security Agency, must issue guidance within 180 days that sets inventory rules, prioritization criteria, reporting items, and processes for automated progress checks.
- After the National Institute of Standards and Technology issues post-quantum cryptography standards, OMB must require agencies to prioritize migration and develop interoperable migration plans. OMB must also report to congressional oversight committees within 15 months with a risk strategy and a funding estimate, and agencies must provide progress reports for up to 5 years after standards are issued.
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
3 provisions identified: 2 benefits, 0 costs, 1 mixed.
Find and report quantum-risk systems
Within 180 days, OMB issues guidance to list federal IT that is vulnerable to quantum decryption. The guidance sets how to prioritize the inventory, what to report, what to migrate first, and how to track progress automatically. OMB updates the guidance and coordinates agency priorities so systems work together. Within 1 year of enactment, and then ongoing, each covered agency sends its inventory and required info to OMB, CISA, and the National Cyber Director. Within 15 months of enactment, OMB gives Congress a strategy, a funding estimate to secure the listed IT, and timelines for NIST-led standards work.
Plan and track post-quantum upgrades
Within 1 year after NIST issues post-quantum standards, OMB requires each agency to prioritize systems for migration and make a plan to switch. OMB coordinates agency plans to keep systems interoperable. Not later than 1 year after that guidance, and then until 5 years after NIST issues the standards, OMB reports agency progress to Congress with its annual federal cybersecurity report.
Which federal IT must upgrade encryption
The law sets which federal entities must follow these rules. It includes executive and military departments, government corporations, the Executive Office of the President, and independent agencies. It excludes the Government Accountability Office and the governments of D.C. and U.S. territories. It uses the existing federal definition of “information technology.” National security systems are excluded. The rules apply on enactment and focus on civilian federal IT.
Sponsors & CoSponsors
Sponsor
Khanna, Ro [D-CA-17]
CA • D
Cosponsors
Rep. Mace, Nancy [R-SC-1]
SC • R
Sponsored 4/18/2022
Rep. Connolly, Gerald E. [D-VA-11]
VA • D
Sponsored 4/18/2022
Rep. Raskin, Jamie [D-MD-8]
MD • D
Sponsored 5/13/2022
Rep. Emmer, Tom [R-MN-6]
MN • R
Sponsored 6/7/2022
Roll Call Votes
house vote • 12/13/2022
On Motion to Suspend the Rules and Concur in the Senate Amendment
Yes: 420 • No: 3