6 U.S.C. § 1526 — Inventory of cryptographic systems; migration to post-quantum cryptography

(a) Inventory. (1) Within 180 days after December 21, 2022, the OMB Director, coordinating with the National Cyber Director and consulting the CISA Director, must issue guidance on moving information technology to post-quantum cryptography. At minimum it must require each agency to keep a current inventory of technology vulnerable to decryption by quantum computers, prioritized under (B); provide criteria for prioritizing inventory work; and describe information required under (b). (2) The guidance must also describe technology to prioritize for migration and an evaluation process for migration progress, automated as much as practicable. (3) The OMB Director must update the guidance as necessary, coordinating with the National Cyber Director and consulting the CISA Director. (b) Agency reports. Within 1 year after December 21, 2022, and continually afterward, each agency head must give the OMB Director, CISA Director, and National Cyber Director the inventory in (a)(1) and other information required under (a)(1)(C). (c) Migration and assessment. Within 1 year after the NIST Director issues post-quantum cryptography standards, the OMB Director must issue guidance requiring each agency to (1) prioritize the technology described in (a)(2)(A) for migration and (2) create a migration plan consistent with that priority. (d) Interoperability. The OMB Director must ensure the priorities under (c)(1) are assessed and coordinated to ensure interoperability. (e) OMB reports. (1) Within 15 months after December 21, 2022, the OMB Director, coordinating with the National Cyber Director and consulting the CISA Director, must report to the Senate Homeland Security and Governmental Affairs Committee and the House Oversight and Reform Committee on (A) a strategy for the risk that quantum computers could weaken or break agency encryption; (B) an estimate of agency funding needed to protect the technology in (a)(1)(A) from that risk; and (C) Federal civilian executive-branch coordination led by NIST, including timelines, to develop post-quantum standards, including Federal Information Processing Standards and voluntary consensus standards such as ISO standards. (2) Within 1 year after issuing guidance under (c)(2), and each year until 5 years after the standards are issued, the OMB Director, coordinating with the National Cyber Director and consulting the CISA Director, must report with the section 3553(c) report to those committees on agency progress in adopting post-quantum standards.