S. 2558 — The National Quantum Cybersecurity Migration Strategy Act of 2025.

This section defines, for purposes of the Act, the following terms: (1) cryptography, as given in specified NIST Special Publications 1800–21B (mobile device security) and 800–59 (national security systems); (2) classical computer, as a binary-encoded device that processes digital data per instructions; (3) quantum computer, as a device using quantum states such as superposition, interference, and entanglement; (4) post-quantum cryptography, as algorithms not vulnerable to quantum or classical computer attacks; (5) critical infrastructure, as defined in 42 U.S.C. 5195c(e); (6) high-impact system, as a federal information system with high-impact loss potential per Federal Information Processing Standards Publication 199; and (7) sector risk management agency, as defined in 6 U.S.C. 650.

This section directs the Subcommittee on the Economic and Security Implications of Quantum Information Science—established under the National Quantum Initiative Act (15 U.S.C. 8814a) to coordinate federal tracking, assessment, and recommendations on the economic, security, and foreign threat implications of quantum information science investments—to develop, within 180 days of enactment and in coordination with the Director of the National Institute of Standards and Technology and in consultation with the Quantum Economic Development Consortium, a National Quantum Cybersecurity Migration Strategy. The strategy includes (1) a definition of a cryptographically relevant quantum computer; (2) recommended standards, including characteristics and attack capability thresholds against real-world cryptographic systems, to determine if a quantum computer meets that definition; (3) an urgency assessment for each federal agency's migration to post-quantum cryptography based on critical functions and risks from such a quantum computer; (4) performance measures for four migration stages—preparation, data inventory baseline, planning and execution of solutions for data at rest and in motion, and monitoring and evaluation; and (5) a plan to evaluate and monitor high-risk entities, including critical infrastructure providers. This section further requires the Subcommittee to establish, within 180 days of enactment, a post-quantum cryptography pilot program under which each sector risk management agency must upgrade at least one high-impact system by January 1, 2027. This section additionally directs the Administrator of the Office of Electronic Government, within 180 days of enactment and in coordination with the Subcommittee, to (1) survey federal agency heads on migration costs (personnel, equipment, time) aligned with the strategy; (2) verify the information's realism and fiscal soundness; (3) identify required funding and resources; and (4) advise on promoting private sector adoption of post-quantum cryptography. Finally, this section requires (1) the Director of the Office of Management and Budget and the Subcommittee to jointly report to Congress within one year of enactment on agency migration urgency assessments, the pilot program, and survey costs; and (2) the Comptroller General to assess, and report to Congress on, each federal agency's migration progress using the strategy's performance measures within one year of strategy development and annually thereafter.