Quantum-GUARD Act of 2026
- Sponsor
- Sen. Coons, Christopher A. [D-DE]
- Committees
- Energy and Natural Resources Committee (primary)
- Last action
- Aug 6, 2026
Bottom line
The Quantum-GUARD Act of 2026 aims to proactively secure the nation's electric grid against future cyber threats from quantum computing by integrating PQC considerations into regulatory processes and fostering research and development.
What it actually does
This bill mandates that the Federal Energy Regulatory Commission (FERC) consider cybersecurity risks posed by quantum computers and the potential use of post-quantum cryptography (PQC) when reviewing electric reliability standards. It also requires the Department of Energy (DOE) to establish a PQC sandbox for innovation and development in electric grid cybersecurity and to conduct a comprehensive study on quantum risks to the bulk-power system, including obstacles to PQC transition.
Proponents argue
Supporters argue that this bill is a crucial proactive measure to protect critical national infrastructure from an emerging and potentially devastating cyber threat. They contend that waiting until quantum computers are fully capable of breaking current encryption would be too late, risking widespread disruption to the bulk-power system. By mandating FERC consideration and establishing a DOE sandbox, the bill ensures a coordinated federal effort to research, develop, and integrate resilient cryptographic solutions before a crisis occurs.
Opponents contend
Critics might argue that while the threat of quantum computing is real, the timeline for its widespread impact on current encryption is uncertain, and this bill may impose premature or overly prescriptive requirements. They could contend that diverting resources to PQC development and integration now, without a clearer understanding of the technology's maturity and specific vulnerabilities, might be inefficient or lead to investments in solutions that quickly become obsolete. Some might also express concern about potential regulatory burdens on grid operators for an evolving threat.
The bill is short and clearly written, making it highly accessible for a reader to understand its core provisions within a short timeframe.
Section 3
FERC Consideration of Quantum Cybersecurity Risks
This section requires the Federal Energy Regulatory Commission (FERC) to explicitly consider cybersecurity risks stemming from quantum computers and the potential benefits of post-quantum cryptography (PQC) when it reviews or modifies electric reliability standards. FERC is then directed to take appropriate action based on these considerations. This integrates future-looking cybersecurity threats into the regulatory framework for the nation's bulk-power system.
Supporters argue
Supporters argue that this provision is essential for proactively safeguarding the electric grid. By requiring FERC to consider quantum risks now, it ensures that future reliability standards will incorporate defenses against an anticipated, severe threat, thereby preventing potential catastrophic failures of critical infrastructure.
Critics contend
Some might argue that mandating FERC to consider a nascent threat like quantum computing could lead to premature or overly broad regulations, potentially imposing unnecessary costs or diverting resources from more immediate cybersecurity concerns. Critics might suggest that the technology is still too uncertain for definitive regulatory action.
Tradeoffs
This provision balances the need for proactive security against the risk of regulating an evolving technological threat. It aims to prevent future vulnerabilities but could potentially lead to compliance challenges if PQC solutions are not mature or widely available.
Section 4
Department of Energy Post-Quantum Cryptography Sandbox
This section directs the Secretary of Energy to establish a 'PQC sandbox' within one year. This program is designed to foster innovation and development in applying post-quantum cryptography to the electric grid's information technology (IT) and operational technology (OT) systems. It will bring together various stakeholders, including grid operators and vendors, to address development challenges, prioritize PQC integration into existing and new systems, and conduct activities like workshops and simulations. The Secretary must report on the sandbox's outcomes and recommendations within three years.
Section 5
Study and Report on Quantum Cybersecurity Risks
This section requires the Secretary of Energy, in consultation with the Electric Reliability Organization, to conduct a study on cybersecurity risks to the bulk-power system from quantum computers. The study must cover risks to both IT and OT systems and identify obstacles to transitioning high-value systems to PQC. It also mandates the development of recommendations for FERC and correlation of high-value systems with existing reliability standard categories. A report summarizing the study's findings is due to Congress within one year, with an unclassified public version and a classified annex.