---
kind: "section"
citation: "6 U.S.C. § 1526"
title: "6"
title_heading: "Domestic Security"
number: "1526"
heading: "Inventory of cryptographic systems; migration to post-quantum cryptography"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/1526"
units:
  - "Chapter 6 — Cybersecurity"
  - "Subchapter II — Federal Cybersecurity Enhancement"
---

# §1526. Inventory of cryptographic systems; migration to post-quantum cryptography

- (a) **Inventory—**
  - (1) **Establishment—** Not later than 180 days after December 21, 2022, the [Director](/usc/6/1521.md?p=5) of OMB, in coordination with the National Cyber [Director](/usc/6/1521.md?p=5) and in consultation with the [Director](/usc/6/1521.md?p=5) of CISA, shall issue guidance on the migration of information technology to post-quantum cryptography, which shall include at a minimum—
    - (A) a requirement for each [agency](/usc/6/1501.md?p=1) to establish and maintain a current inventory of information technology in use by the [agency](/usc/6/1501.md?p=1) that is vulnerable to decryption by quantum computers, prioritized using the criteria described in [subparagraph (B)](#a-1-B);
    - (B) criteria to allow [agencies](/usc/6/1501.md?p=1) to prioritize their inventory efforts; and
    - (C) a description of the information required to be reported pursuant to [subsection (b)](#b).
  - (2) **Additional content in guidance—** In the guidance established by [paragraph (1)](#a-1), the [Director](/usc/6/1521.md?p=5) of OMB shall include, in addition to the requirements described in that paragraph—
    - (A) a description of information technology to be prioritized for migration to post-quantum cryptography; and
    - (B) a process for evaluating progress on migrating information technology to post-quantum cryptography, which shall be automated to the greatest extent practicable.
  - (3) **Periodic updates—** The [Director](/usc/6/1521.md?p=5) of OMB shall update the guidance required under [paragraph (1)](#a-1) as the [Director](/usc/6/1521.md?p=5) of OMB determines necessary, in coordination with the National Cyber [Director](/usc/6/1521.md?p=5) and in consultation with the [Director](/usc/6/1521.md?p=5) of CISA.
- (b) **Agency reports—** Not later than 1 year after December 21, 2022, and on an ongoing basis thereafter, the head of each [agency](/usc/6/1501.md?p=1) shall provide to the [Director](/usc/6/1521.md?p=5) of OMB, the [Director](/usc/6/1521.md?p=5) of CISA, and the National Cyber [Director](/usc/6/1521.md?p=5)—
  - (1) the inventory described in [subsection (a)(1)](#a-1); and
  - (2) any other information required to be reported under [subsection (a)(1)(C)](#a-1-C).
- (c) **Migration and assessment—** Not later than 1 year after the date on which the [Director](/usc/6/1521.md?p=5) of NIST has issued post-quantum cryptography standards, the [Director](/usc/6/1521.md?p=5) of OMB shall issue guidance requiring each [agency](/usc/6/1501.md?p=1) to—
  - (1) prioritize information technology described under [subsection (a)(2)(A)](#a-2-A) for migration to post-quantum cryptography; and
  - (2) develop a plan to migrate information technology of the [agency](/usc/6/1501.md?p=1) to post-quantum cryptography consistent with the prioritization under [paragraph (1)](#c-1).
- (d) **Interoperability—** The [Director](/usc/6/1521.md?p=5) of OMB shall ensure that the prioritizations made under [subsection (c)(1)](#c-1) are assessed and coordinated to ensure interoperability.
- (e) **Office of Management and Budget reports—**
  - (1) **Report on post-quantum cryptography—** Not later than 15 months after December 21, 2022, the [Director](/usc/6/1521.md?p=5) of OMB, in coordination with the National Cyber [Director](/usc/6/1521.md?p=5) and in consultation with the [Director](/usc/6/1521.md?p=5) of CISA, shall submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report on the following:
    - (A) A strategy to address the risk posed by the vulnerabilities of information technology of [agencies](/usc/6/1501.md?p=1) to weakened encryption due to the potential and possible capability of a quantum computer to breach that encryption.
    - (B) An estimate of the amount of funding needed by [agencies](/usc/6/1501.md?p=1) to secure the information technology described in [subsection (a)(1)(A)](#a-1-A) from the risk posed by an adversary of the [United States](/usc/6/101.md?p=19-A) using a quantum computer to breach the encryption of the information technology.
    - (C) A description of Federal civilian executive branch coordination efforts led by the National Institute of Standards and Technology, including timelines, to develop standards for post-quantum cryptography, including any Federal Information Processing Standards developed under [chapter 35](/usc/44/chch35.md) of title 44, as well as standards developed through [voluntary](/usc/6/671.md?p=6-A), consensus standards bodies such as the International Organization for Standardization.
  - (2) **Report on migration to post-quantum cryptography in information technology—** Not later than 1 year after the date on which the [Director](/usc/6/1521.md?p=5) of OMB issues guidance under [subsection (c)(2)](#c-2), and thereafter until the date that is 5 years after the date on which post-quantum cryptographic standards are issued, the [Director](/usc/6/1521.md?p=5) of OMB, in coordination with the National Cyber [Director](/usc/6/1521.md?p=5) and in consultation with the [Director](/usc/6/1521.md?p=5) of CISA, shall submit to the Committee on [Homeland](/usc/6/101.md?p=1) Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives, with the report submitted pursuant to [section 3553(c) of title 44](/usc/44/3553.md?p=c), a report on the progress of [agencies](/usc/6/1501.md?p=1) in adopting post-quantum cryptography standards.

## Source credit

(Pub. L. 117–260, § 4, Dec. 21, 2022, 136 Stat. 2390.)

## Notes

### Editorial Notes

### Codification

Section was enacted as part of the Quantum Computing Cybersecurity Preparedness Act, and not as part of the Cybersecurity Act of 2015 which comprises this chapter.

### Statutory Notes and Related Subsidiaries

### Change of Name

Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023.

### Findings; Sense of Congress

Pub. L. 117–260, § 2, Dec. 21, 2022, 136 Stat. 2389, provided that: Findings.—Congress finds the following: Cryptography is essential for the national security of the United States and the functioning of the economy of the United States. The most widespread encryption protocols today rely on computational limits of classical computers to provide cybersecurity. Quantum computers might one day have the ability to push computational boundaries, allowing us to solve problems that have been intractable thus far, such as integer factorization, which is important for encryption. The rapid progress of quantum computing suggests the potential for adversaries of the United States to steal sensitive encrypted data today using classical computers, and wait until sufficiently powerful quantum systems are available to decrypt it. Sense of Congress.—It is the sense of Congress that— a strategy for the migration of information technology of the Federal Government to post-quantum cryptography is needed; and the governmentwide and industrywide approach to post-quantum cryptography should prioritize developing applications, hardware intellectual property, and software that can be easily updated to support cryptographic agility.”

### Exemption of National Security Systems

Pub. L. 117–260, § 5, Dec. 21, 2022, 136 Stat. 2392, provided that: “This Act [see Short Title of 2022 Amendment note set out under section 1500 of this title] shall not apply to any national security system.”

### Definitions

Pub. L. 117–260, § 3, Dec. 21, 2022, 136 Stat. 2389, provided that: “In this Act [see Short Title of 2022 Amendment note set out under section 1500 of this title]: Agency .—The term ‘agency’— means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; and does not include— the Government Accountability Office; or the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions. Classical computer.—The term ‘classical computer’ means a device that accepts digital data and manipulates the information based on a program or sequence of instructions for how data is to be processed and encodes information in binary bits that can either be 0s or 1s. Director of cisa.—The term ‘Director of CISA’ means the Director of the Cybersecurity and Infrastructure Security Agency. Director of nist.—The term ‘Director of NIST’ means the Director of the National Institute of Standards and Technology. Director of omb.—The term ‘Director of OMB’ means the Director of the Office of Management and Budget. Information technology.—The term ‘information technology’ has the meaning given the term in section 3502 of title 44, United States Code. National security system.—The term ‘national security system’ has the meaning given the term in section 3552 of title 44, United States Code. Post-quantum cryptography.—The term ‘post-quantum cryptography’ means those cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by either a quantum computer or classical computer. Quantum computer.—The term ‘quantum computer’ means a computer that uses the collective properties of quantum states, such as superposition, interference, and entanglement, to perform calculations.”