[Page S5374]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 3609. Mrs. BLACKBURN (for herself and Mr. Peters) submitted an 
amendment intended to be proposed by her to the bill S. 2296, to 
authorize appropriations for fiscal year 2026 for military activities 
of the Department of Defense, for military construction, and for 
defense activities of the Department of Energy, to prescribe military 
personnel strengths for such fiscal year, and for other purposes; which 
was ordered to lie on the table; as follows:

        At the end of subtitle F of title X, add the following:

     SEC. 1085. ASSESSMENT FOR FEDERAL AGENCY MIGRATION TO POST-
                   QUANTUM CRYPTOGRAPHY.

       (a) Definitions.--In this section:
       (1) Cryptography.--The term ``cryptography'' has the 
     meaning given such term in the National Institute of 
     Standards and Technology Special Publication 1800-21B 
     (relating to mobile device security) and the National 
     Institute of Standards and Technology Special Publication 
     800-59 (relating to guidelines for identifying an information 
     system as a national security system).
       (2) Classical computer.--The term ``classical computer'' 
     means a device that accepts digital data and manipulates the 
     data based on a program or sequence of instructions for how 
     such data is to be processed, and that encodes information in 
     binary.
       (3) Quantum computer.--The term ``quantum computer'' means 
     a computer that uses the collective properties of quantum 
     states, such as superposition, interference, and 
     entanglement, to perform calculations.
       (4) Post-quantum cryptography.--The term ``post-quantum 
     cryptography'' means cryptographic algorithms or methods that 
     are not specifically vulnerable to attacks by either a 
     quantum computer or classical computer.
       (5) Critical infrastructure.--The term ``critical 
     infrastructure'' has the meaning given that term in section 
     1016(e) of the Critical Infrastructures Protection Act of 
     2001 (42 U.S.C. 5195c(e)).
       (b) Assessment for Federal Agency Migration to Post-quantum 
     Cryptography.--
       (1) Duties of subcommittee on the economic and security 
     implications of quantum information science.--Not later than 
     180 days after the date of the enactment of this Act, the 
     Subcommittee on the Economic and Security Implications of 
     Quantum Information Science, as established by section 105 of 
     the National Quantum Initiative Act (15 U.S.C. 8814a), 
     shall--
       (A) develop a National Quantum Cybersecurity Migration 
     Strategy;
       (B) provide a definition of a cryptographically relevant 
     quantum computer;
       (C) develop standards for Federal agencies to apply to 
     determine whether a quantum computer meets such definition, 
     including--
       (i) the characteristics of such computers; and
       (ii) the particular point at which such computers are 
     capable of attacking real world cryptographic systems that 
     classical computers are unable to attack;
       (D) assess the urgency for migration to post-quantum 
     cryptography for each Federal agency relative to--
       (i) the critical functions of each agency; and
       (ii) the risk each agency faces should a cryptographically 
     relevant quantum computer attack a system operated by the 
     agency;
       (E) identify performance measures for migration to post-
     quantum cryptography at each Federal agency for each of the 
     following 4 stages of migration:
       (i) Preparation for migration to post-quantum cryptography.
       (ii) Establishment of a baseline understanding of the data 
     inventory of each agency.
       (iii) Planning and execution of post-quantum cryptographic 
     solutions.
       (iv) Monitoring and evaluation of migration success and 
     assessment of cryptographic security; and
       (F) evaluate and monitor entities that are at high risk of 
     quantum cryptographic attacks, including entities determined 
     to be providers of critical infrastructure.
       (2) Post-quantum pilot program.--Not later than 180 days 
     after the date of the enactment of this Act, the Subcommittee 
     on the Economic and Security Implications of Quantum 
     Information Science shall establish a post-quantum pilot 
     program that requires each Federal agency to upgrade not less 
     than one high-impact system to post-quantum cryptography not 
     later than January 1, 2027.
       (3) Duties of the office of electronic government.--Not 
     later than 180 days after the date of the enactment of this 
     Act, the Administrator of the Office of Electronic 
     Government, in coordination with the Chairpersons of the 
     Subcommittee on the Economic and Security Implications of 
     Quantum Information Science, shall--
       (A) survey the heads of Federal agencies for information 
     relating to the cost of migration to post-quantum 
     cryptography by the Federal agencies, including estimates for 
     the personnel, equipment, and time needed to fully implement 
     post-quantum cryptography, in alignment with the National 
     Quantum Cybersecurity Migration Strategy developed pursuant 
     to paragraph (1)(A);
       (B) verify that the information provided under subparagraph 
     (A) is realistic and fiscally sound;
       (C) identify the funding and resources necessary for 
     Federal agencies to carry out the migration to post-quantum 
     cryptography; and
       (D) describe how Federal agencies should encourage the 
     adoption of post-quantum cryptography by the private sector.
       (4) Report.--Not later than 1 year after the date of the 
     enactment of this Act, the Director of the Office of 
     Management and Budget and the Chairpersons of the 
     Subcommittee on the Economic and Security Implications of 
     Quantum Information Science shall jointly submit to Congress 
     a report detailing their findings with respect to the post-
     quantum migration assessments required by paragraph (1)(D), 
     the pilot program established pursuant to paragraph (2), and 
     the survey on associated costs of executing the migration 
     required under paragraph (3)(A).
                                 ______