Sponsors (5)
The bill meaningfully boosts federal and private-sector preparedness against quantum cyber threats through plans and technical assistance, but does so at the cost of new spending and compliance burdens, potential operational strain for critical sectors, and less public transparency.
Federal agencies, utilities, financial institutions, and small businesses will receive a coordinated mitigation plan, technical assistance, pilots, and cyber‑hygiene guidance that accelerates adoption of post‑quantum cryptography and strengthens national cybersecurity readiness.
Congress (and therefore taxpayers) will receive classified and unclassified assessments and policy recommendations to inform legislative and funding decisions on quantum threats.
Taxpayers, small businesses, and financial firms may face increased costs from new federal spending, compliance, or implementation expenses to prepare for and implement the mitigation plan.
Financial institutions and utilities may be pressured by sector vulnerability designations and timelines to hastily adopt new cryptography, risking operational disruption or interoperability problems.
Small businesses and the public may have reduced visibility into risks and progress because classified reporting to Congress can limit public transparency.
Based on analysis of 2 sections of legislative text.
Directs a federal Subcommittee to assess cryptographic risks from quantum computers, produce an initial mitigation plan within 1 year, and submit annual progress reports for four years.
Official title: To direct the Subcommittee on the Economic and Security Implications of Quantum Information Science to submit reports on mitigating the cybersecurity and national security risks posed by certain quantum computers, and for other purposes.
Introduced August 8, 2025 by Suhas Subramanyam · Last progress August 8, 2025
Requires a federal Subcommittee on the Economic and Security Implications of Quantum Information Science to assess U.S. readiness for so-called “cryptographically-relevant quantum computers,” identify vulnerable sectors, and produce a mitigation plan and annual progress reports. The Subcommittee must deliver an initial assessment and mitigation plan within one year and then submit annual classified or unclassified progress reports for four years.