H.R. 3259: Post Quantum Cybersecurity Standards Act

H.R. 3259, the Post Quantum Cybersecurity Standards Act, is a targeted federal preparation bill rather than a broad new mandate. It does not order private companies to rip out current encryption on a deadline, and it does not set fines or criminal penalties. Instead, it amends existing federal law to give the National Institute of Standards and Technology, or NIST, a clearer job: promote the voluntary adoption and deployment of post-quantum cryptography standards, working with the Department of Homeland Security and sector risk management agencies.

The bill is specific about who needs the most help. NIST must provide guidance and public resources for adoption, and it must provide technical assistance to entities at high risk of quantum cryptoanalytic attacks, specifically including critical infrastructure and digital infrastructure providers. It also writes key definitions into law. “Critical infrastructure” uses the meaning in section 1016(e) of Public Law 107-56, codified at 42 U.S.C. 5195c(e). “Sector risk management agency” uses the meaning in section 2200 of the Homeland Security Act of 2002, codified at 6 U.S.C. 650. “Post-quantum cryptography” is defined as cryptographic algorithms or methods assessed not to be specifically vulnerable to attack by either a quantum computer or a classical computer.

The bill also opens the door to money, but only under conditions. A grant program may be established only if appropriations are available and only after the NIST Director has issued post-quantum cryptography standards. If that happens, grants and technical assistance can go to high-risk entities for adopting those standards and remediating vulnerabilities. The bill does not set a dollar figure for the program, a maximum grant size, or a fixed application timeline. Instead, it says funds may cover “reasonable costs” up to a “specified amount” to be set later by the NIST Director, who may also develop and update rules on eligibility, application disclosures, grant amounts, and grant duration.

Another important piece is research. The bill amends section 4(a)(1)(A) of the Cyber Security Research and Development Act, at 15 U.S.C. 7403, so that National Science Foundation research explicitly includes post-quantum cryptography. That means the legislation is trying to do two things at once: speed near-term deployment help through NIST and support longer-term cryptography research through NSF. The Congressional Budget Office has reportedly scored the bill at minimal cost, but the bill text itself does not include a specific authorization amount.