Quantum Readiness and Innovation Act of 2025

This bill requires the Director of the National Institute of Standards and Technology (NIST) to develop guidance for upgrading information systems to post-quantum cryptography, and directs the Office of Science and Technology Policy to create a national strategy and pilot program for federal agency upgrades.

Sec. 2, Definitions: Defines key terms used in the bill, including 'appropriate congressional committees' (Senate Commerce and House Energy and Commerce committees), 'classical computer' and 'quantum computer' (referencing the Quantum Computing Cybersecurity Preparedness Act), 'critical infrastructure sectors' (as defined in National Security Memorandum NSM-22), 'high-impact system' (a federal system whose loss would be high impact under FIPS 199), 'post-quantum cryptography' (algorithms not vulnerable to quantum or classical attack, including specific NIST standards), and 'sector risk management agency' (as defined in the Homeland Security Act).

Sec. 3, Guidance on upgrading to post-quantum cryptography: Within 180 days, the NIST Director, consulting the Office of Science and Technology Policy, must establish guidance for upgrading information systems to post-quantum cryptography, including tailored guidance for critical infrastructure sectors. The guidance must include standards and selection criteria for procuring commercial solutions. NIST must make this guidance available to private sector entities, possibly through Special Publications. If an industry sector representative from the Quantum Economic Development Consortium decides to assess adoption of the guidance, NIST must offer to collaborate, and may provide technical support, test beds, and interoperability frameworks.

Sec. 4, Strategy for federal agency upgrade to post-quantum cryptography: Within 360 days, the Office of Science and Technology Policy, coordinating with NIST and consulting the Quantum Economic Development Consortium, must develop a National Quantum Cybersecurity Upgrade Strategy. This strategy must define a cryptographically relevant quantum computer, recommend standards to determine when a quantum computer meets that definition, provide guidelines for assessing upgrade urgency for each federal agency, recommend performance measures for upgrading (including preparation, data inventory, planning, and monitoring), and include a plan for implementing these measures. The Office must also establish a voluntary pilot program within 360 days to provide planning and technical support to covered entities (sector risk management agencies, federal agencies, or their mission partners) for upgrading to post-quantum cryptography. The program requires at least one high-impact system of a participating entity to be upgraded within 18 months, with options for additional upgrades. The Office must submit initial and annual reports to Congress on the program, and a report including the strategy and pilot program description within 360 days.