S. 3312 — Quantum Readiness and Innovation Act of 2025

This section defines terms used in the Act, including (1) “appropriate congressional committees” (i.e., the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce); (2) “classical computer” and “quantum computer” (as defined in the Quantum Computing Cybersecurity Preparedness Act); (3) “critical infrastructure sectors” (as defined in National Security Memorandum–22, dated April 30, 2024); (4) “high-impact system” (i.e., a federal information system holding sensitive information categorized as high impact under Federal Information Processing Standards Publication 199); (5) “post-quantum cryptography” (i.e., cryptographic algorithms or methods not vulnerable to attack by quantum or classical computers, including specified NIST standards such as FIPS Publications 203, 204, and 140–3 operating within a zero trust architecture per NIST Special Publication 800–207); and (6) “sector risk management agency” (as defined in section 2200 of the Homeland Security Act of 2002).

This section directs the Director of the National Institute of Standards and Technology (NIST), in consultation with the Director of the Office of Science and Technology Policy, to establish within 180 days of enactment guidance for upgrading information systems to post-quantum cryptography (i.e., encryption resistant to quantum computer attacks), including guidance tailored for critical infrastructure sectors and standards and selection criteria for procuring and deploying commercial solutions. NIST must disseminate the guidance to private sector entities, including via Special Publications. This section further requires NIST to offer collaboration with Quantum Economic Development Consortium representatives on any industry-led assessments of guidance adoption, including by providing technical and administrative support, test beds, interoperability frameworks, and stakeholder coordination if requested.

This section directs the Director of the Office of Science and Technology Policy (OSTP), in coordination with the Director of the National Institute of Standards and Technology (NIST) and in consultation with the Quantum Economic Development Consortium, to develop a National Quantum Cybersecurity Upgrade Strategy within 360 days of enactment. The strategy must define a cryptographically relevant quantum computer and recommended standards to identify such computers (including characteristics and the point at which they can attack real-world systems beyond classical computers' capabilities); provide guidelines for assessing federal agencies' urgency to upgrade to post-quantum cryptography based on critical functions and quantum-attack risks; recommend performance measures for upgrade tasks, including preparation (e.g., adopting quantum-resistant hardware and software overlays meeting NIST Federal Information Processing Standards), establishing data inventories via automated tools, planning and executing protections for data at rest and in motion, and monitoring success; and outline a plan to implement those measures for high-risk entities, including sector risk management agencies. This section further directs OSTP to establish a voluntary pilot program within 360 days of enactment to provide planning, technical, and other support to covered entities (i.e., sector risk management agencies, federal agencies, or federal agency mission partners) upgrading to post-quantum cryptography, with encouragement for high-risk entities to participate. Under the pilot, each participating covered entity must upgrade at least one high-impact system within 18 months of program establishment using the strategy's performance measures and may then upgrade one additional system or more (with prior OSTP notice for two or more); OSTP, in coordination with each entity's head, must submit to congressional committees an initial report 180 days after the initial upgrade and annual updates thereafter describing entity actions and OSTP support provided. This section requires OSTP to submit the strategy and pilot program description to congressional committees within 360 days of enactment.