US Quantum Computing Cybersecurity Preparedness Act requires federal inventories
21 DECEMBER 2022, WASHINGTON
The Quantum Computing Cybersecurity Preparedness Act, signed on 21 December 2022, requires federal agencies to inventory their quantum-vulnerable systems and plan migration to post-quantum cryptography. By placing these duties in legislation, Congress made them a matter of law rather than guidance, so agencies must carry them out rather than treat them as optional.
The Act works alongside NSM-10. The national security memorandum sets executive-branch policy, while the Act gives the inventory and migration duties statutory backing from Congress. The two reinforce each other, pushing federal agencies toward the same inventory-first approach from both the executive and legislative directions.
Requiring inventory first reflects the logic of migration. An agency cannot migrate systems it has not identified, so finding its quantum-vulnerable systems is the necessary starting point. By mandating that step, the Act lays the groundwork for the migration planning that follows and that later instruments, such as the 2026 OMB memorandum, build on.
Why it matters. The Act turned federal post-quantum preparation into a legal requirement in 2022, well before the standards were final, by mandating inventory and migration planning. It gave the executive branch's policy goals statutory weight and set the inventory-first pattern that later federal rules continue. Agencies and their suppliers can trace today's deadlines back to the duties this Act established.