The Quantum Computing Cybersecurity Preparedness Act became law this week in the United States, establishing a series of new priorities and requirements for the Office of Management and Budget (OMB) to guide federal cybersecurity to post-quantum cryptography.
Specifically, the legislation– authored by U.S. Sens. Rob Portman (R-OH) and Maggie Hassan (D-NH) – requires OMB to now hasten the acquisition and migration of other federal agencies’ information technology to post-quantum cryptography. This is seen as a means to increase the government’s overall security by boosting its defenses against quantum-computing-enabled data breaches. While no known incident of this has occurred so far, the rate of development of quantum computers in terms of raw power and availability led the lawmakers’ to call for preemptive action.
“Quantum computing will provide for huge advances in computing power, but it will also create new cybersecurity challenges,” Portman said. “I’m proud our bipartisan legislation to require the government to inventory its cryptographic systems, determine which are most at risk from quantum computing, and upgrade those systems accordingly is now law of the land.”
As alluded to by Portman, in addition to the new prioritization requirement, OMB will also have to create guidance for federal agencies to use when assessing critical systems. This will be needed one year after the National Institute of Standards and Technology (NIST) releases post-quantum cryptography standards, which have been planned for some time. OMB will then have to report to Congress annually with a strategy on how to address risks posed by post-quantum cryptography, funding needs, and an assessment of whole-of-government coordination and migration to the new standards.
“To strengthen our national security, it is essential that we address potential vulnerabilities in our cybersecurity systems, including new threats presented by quantum computing,” Hassan said. “This law will help ensure that our federal government is ready to defend our country against data breaches that could be exploited by quantum computing.”