Quantum-GUARD Act of 2026

This bill requires the Federal Energy Regulatory Commission (FERC) to consider cybersecurity risks from quantum computers when reviewing reliability standards for the bulk-power system, and directs the Department of Energy (DOE) to establish a program and conduct a study on post-quantum cryptography (PQC) for the electric grid.

Sec. 2, Definitions: Defines key terms including bulk-power system, FERC, Electric Reliability Organization, high-value IT or OT systems, information technology (IT), operational technology (OT), post-quantum cryptography (PQC), PQC sandbox, reliability standard, and the Secretary of Energy.

Sec. 3, FERC consideration of cybersecurity risks from quantum computers: Starting on enactment, when reviewing proposed reliability standards or issuing orders under the Federal Power Act, FERC must consider cybersecurity risks from quantum computers and potential uses of PQC in IT and OT systems, and take appropriate action.

Sec. 4, DOE PQC sandbox: Within one year of enactment, the Secretary of Energy must establish a PQC sandbox program to assemble stakeholders, address PQC challenges, and prioritize integration into existing and near-future systems. Within three years, the Secretary must publish a report on outcomes and recommendations to encourage PQC adoption by bulk-power system operators.

Sec. 5, PQC report: The Secretary, consulting with the Electric Reliability Organization, must study cybersecurity risks to the bulk-power system from quantum computers, including risks to IT and OT systems and obstacles to transitioning high-value systems to PQC. The study must develop recommendations for FERC actions and correlate high-value systems with reliability standard categories. Within one year, the Secretary must submit an unclassified report (with possible classified annex) to specified congressional committees and make the unclassified portion public.