Quantum Readiness and Innovation Act of 2025
- Sponsor
- Sen. Peters, Gary C. [D-MI]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Dec 2, 2025
Bottom line
This bill aims to proactively secure U.S. federal and critical infrastructure information systems against potential threats from advanced quantum computers by accelerating the adoption of post-quantum cryptography standards and strategies.
What it actually does
This bill mandates the National Institute of Standards and Technology (NIST) to develop guidance for upgrading information systems to post-quantum cryptography, specifically tailored for critical infrastructure sectors. It also requires the Office of Science and Technology Policy (OSTP) to create a national strategy for federal agency upgrades and establish a voluntary pilot program to assist entities in transitioning to quantum-resistant cryptographic solutions.
Proponents argue
Proponents argue that this bill is a crucial proactive measure to protect sensitive government and critical infrastructure data from future quantum computing attacks. They emphasize the urgency of transitioning to post-quantum cryptography before cryptographically relevant quantum computers become widely available, preventing a potential "quantum-apocalypse" for current encryption standards. They highlight the importance of NIST's role in setting standards and OSTP's role in coordinating a national strategy to ensure a smooth and secure transition across federal agencies and key private sectors.
Opponents contend
Opponents might argue that the timeline for developing and implementing guidance and strategies (180-360 days) is overly ambitious for such a complex and evolving technological field, potentially leading to rushed or suboptimal standards. Some might also express concerns about the cost implications for federal agencies and private sector entities, especially if commercial solutions are not yet mature or widely available, potentially imposing significant financial burdens without clear immediate benefits.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core objectives and mechanisms within a reasonable timeframe.
Section 3(a), (b), (c)
NIST Guidance for Post-Quantum Cryptography Upgrade
This provision requires the National Institute of Standards and Technology (NIST) to create guidelines within 180 days for how government and critical infrastructure systems should upgrade their encryption to be resistant to quantum computer attacks. These guidelines will also include criteria for buying and deploying commercial quantum-resistant encryption solutions, and NIST must make this information available to the private sector.
Supporters argue
Supporters argue that NIST is the appropriate body to set these technical standards, ensuring that the transition to post-quantum cryptography is based on robust, peer-reviewed science and provides consistent security across various sectors. Tailoring guidance for critical infrastructure is seen as essential for national security.
Critics contend
Some might argue that mandating specific standards too early could stifle innovation or lock in technologies that may become obsolete quickly in the rapidly evolving field of quantum computing. They might prefer a more flexible approach that allows for greater industry-led development without immediate prescriptive guidance.
Tradeoffs
This provision balances the need for immediate action and standardization with the inherent uncertainty and rapid evolution of quantum computing and cryptography. It seeks to provide a clear path forward while acknowledging the dynamic nature of the threat.
Section 4(a)
National Quantum Cybersecurity Upgrade Strategy Development
This section requires the Office of Science and Technology Policy (OSTP), in collaboration with NIST and the Quantum Economic Development Consortium, to develop a comprehensive national strategy within 360 days. This strategy will define what constitutes a "cryptographically relevant quantum computer," establish standards for identifying such computers, and provide guidelines for federal agencies to assess the urgency of their post-quantum cryptography upgrades based on their critical functions and risk exposure. It also includes performance measures for the upgrade process.
Section 4(b)
Post-Quantum Voluntary Pilot Program for Federal and Critical Entities
This provision directs the OSTP Director to establish a voluntary pilot program within 360 days to offer planning, technical, and other support to federal agencies, sector risk management agencies, and their mission partners who choose to upgrade their systems to post-quantum cryptography. The program encourages high-risk entities to participate and requires at least one high-impact system of a participating entity to be upgraded within 18 months of the program's establishment, with options for further upgrades.
Defines "post-quantum cryptography" not just as algorithms resilient to quantum attacks, but specifically includes NIST FIPS Pubs 204 (lattice-based digital signature), 203 (module-lattice-based key encapsulation), and any cryptographic algorithm implemented in accordance with FIPS Pub 140-3 operating within a zero trust architecture (NIST SP 800-207).
Section 2(5)
Why it matters:This is standard legislative practice to define terms upfront, but the specific technical references are crucial for understanding the scope and technical requirements of the bill's mandates. It's not evasive, but highly technical.
Case for: Supporters argue that precise technical definitions, referencing established NIST standards, are essential to ensure clarity, interoperability, and robust security for the new cryptographic systems. Including zero trust architecture strengthens the overall security posture.
Case against: Critics might argue that embedding such specific technical standards directly into legislation could make the bill quickly outdated as cryptographic research and NIST standards evolve. They might prefer a more general definition, allowing NIST greater flexibility to update standards without requiring new legislation.
Estimated impact: This definition sets the technical foundation for all post-quantum cryptography upgrades mandated by the bill, influencing procurement, development, and implementation across federal agencies and critical infrastructure.
The bill mandates NIST to offer collaboration with Quantum Economic Development Consortium (QEDC) industry sector representatives on assessments of guidance adoption and requires OSTP to consult with QEDC when developing the National Quantum Cybersecurity Upgrade Strategy.
Section 3(d) and Section 4(a)
Why it matters:This is standard practice for ensuring expert input from relevant industry consortia. It's not evasive, but highlights the importance of public-private partnership in this domain.
Case for: Proponents argue that involving the QEDC ensures that the guidance and strategy are informed by the latest industry developments, practical implementation challenges, and commercial capabilities, making them more effective and realistic.
Case against: Some might argue that relying heavily on an industry consortium could lead to standards or strategies that favor specific commercial interests, potentially at the expense of broader public good or open-source alternatives.
Estimated impact: Ensures industry perspective and capabilities are integrated into federal quantum cybersecurity policy and implementation, potentially accelerating adoption and fostering innovation.