Post Quantum Cybersecurity Standards Act

This Act may be cited as the Post Quantum Cybersecurity Standards Act.
The National Quantum Initiative Act is amended—
in section 2 (15 U.S.C. 8801)—
by redesignating paragraphs (4), (5), (6), (7), the first paragraph (8) (relating to the definition of Subcommittee on Economic and Security Implications), and the second paragraph (8) (relating to the definition of Subcommittee on Quantum Information Science) as paragraphs (5), (7), (8), (9), (11), and (12), respectively;
by inserting after paragraph (3) the following new paragraph:
The term critical infrastructure has the meaning given such term in section 1016(e) of Public Law 107–56 (42 U.S.C. 5195c(e))
by inserting after paragraph (5), as so redesignated, the following new paragraph:
The term post-quantum cryptography means those cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by either a quantum computer or classical computer.
by inserting after paragraph (9), as so redesignated, the following new paragraph:
The term sector risk management agency has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
in section 201 (15 U.S.C. 8831), by—
redesignating subsection (c) as subsection (d); and
inserting after subsection (b) the following new subsection:
The Director of the National Institute of Standards and Technology, in consultation with the Secretary of Homeland Security and the heads of sector risk management agencies, as appropriate, shall promote the voluntary adoption and deployment of post-quantum cryptography standards, including by—
disseminating and making publicly available guidance and resources to help organizations adopt and deploy post-quantum cryptography standards;
providing technical assistance, as practicable, to entities that are high risk of quantum cryptoanalytic attacks, such as entities determined to be critical infrastructure or digital infrastructure providers; and
conducting such other activities as determined necessary by the Director to promote the adoption and deployment of post-quantum cryptography standards across the United States.
Subject to the availability of appropriations and after the date on which the Director of National Institute of Standards and Technology has issued post-quantum cryptography standards under paragraph (1), the Director may establish a program to identify and provide technical assistance through the award of grants to entities that are at high risk of quantum cryptoanalytic attacks, including by granting funds, in adopting such post-quantum cryptographic standards and remediating quantum-related vulnerabilities.
Grants awarded to entities under this subsection may be used to cover reasonable costs, up to a specified amount established by the Director of the National Institute of Standards and Technology, of activities to adopt post-quantum cryptographic standards and remediate quantum-related vulnerabilities.
The Director of the National Institute of Standards and Technology may develop, and periodically update, guidance, including eligibility, application disclosure requirements, grant amount and duration, and any additional requirements regarding the award of grants under this paragraph.
If the program described in this paragraph is established, the Director of the National Institute of Standards and Technology shall consult with the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, the heads of other Sector Specific Agencies and risk management agencies, and appropriate representatives of private sector entities, including nonprofit organizations, to share information regarding the program and guidance developed under subparagraph (C).
Subsection (a)(1)(A) of section 4 of the Cyber Security Research and Development Act (15 U.S.C. 7403) is amended by inserting , including post-quantum cryptography before the semicolon.