Public Law 117–260: To encourage the migration of Federal Government information technology systems to quantum-resistant cryptography, and for other purposes.

Cryptography is essential for the national security of the United States and the functioning of the economy of the United States.

The most widespread encryption protocols today rely on computational limits of classical computers to provide cybersecurity.

Quantum computers might one day have the ability to push computational boundaries, allowing us to solve problems that have been intractable thus far, such as integer factorization, which is important for encryption.

The rapid progress of quantum computing suggests the potential for adversaries of the United States to steal sensitive encrypted data today using classical computers, and wait until sufficiently powerful quantum systems are available to decrypt it.

a strategy for the migration of information technology of the Federal Government to post-quantum cryptography is needed; and

the governmentwide and industrywide approach to post-quantum cryptography should prioritize developing applications, hardware intellectual property, and software that can be easily updated to support cryptographic agility.

agency

means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; and

does not include—136 STAT. 2390

classical computer

Director of CISA

Director of NIST

Director of OMB

information technology

national security system

post-quantum cryptography

quantum computer

Not later than 180 days after the date of enactment of this Act, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall issue guidance on the migration of information technology to post-quantum cryptography, which shall include at a minimum—

In the guidance established by paragraph (1), the Director of OMB shall include, in addition to the requirements described in that paragraph—

The Director of OMB shall update the guidance required under paragraph (1) as the Director of OMB determines necessary, in coordination with the National Cyber Director and in consultation with the Director of CISA.

the inventory described in subsection (a)(1); and

any other information required to be reported under subsection (a)(1)(C).

prioritize information technology described under subsection (a)(2)(A) for migration to post-quantum cryptography; and

develop a plan to migrate information technology of the agency to post-quantum cryptography consistent with the prioritization under paragraph (1).

Not later than 15 months after the date of enactment of this Act, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report on the following:

Not later than 1 year after the date on which the Director of OMB issues guidance under 136 STAT. 2392 subsection (c)(2), and thereafter until the date that is 5 years after the date on which post-quantum cryptographic standards are issued, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives, with the report submitted pursuant to section 3553(c) of title 44, United States Code, a report on the progress of agencies in adopting post-quantum cryptography standards.