Definitions

In this Act: (1) Appropriate congressional committees The term appropriate congressional committees means— (A) the Committee on Commerce, Science, and Transportation of the Senate; and (B) the Committee on Energy and Commerce of the House of Representatives. (2) Classical computer; quantum computer The terms classical computer and quantum computer have the meanings given such terms in section 3 of the Quantum Computing Cybersecurity Preparedness Act (Public Law 117–260; 6 U.S.C. 1526 note). (3) Critical infrastructure sectors The term critical infrastructure sectors means the critical infrastructure sectors defined in the National Security Memorandum on Critical Infrastructure Security and Resilience (NSM–22), dated April 30, 2024. (4) High-impact system The term high-impact system means a Federal information system that holds sensitive information, the loss of which would be categorized as high impact under Federal Information Processing Standards Publication 199 (relating to standards for security categorization of Federal information and information systems), as in effect on the day before the date of the enactment of this Act. (5) Post-quantum cryptography The term post-quantum cryptography — (A) means those cryptographic algorithms or methods that are assessed not to be specifically vulnerable to attack by either a quantum computer or classical computer; and (B) includes— (i) the lattice-based digital signature algorithm specified in National Institute of Standards and Technology Federal Information Processing Standards Publication 204 (dated August 13, 2024; relating to Module-Lattice-Based Digital Signature Standard), or any successor standard; (ii) the module-lattice-based key encapsulation mechanism specified in National Institute of Standards and Technology Federal Information Processing Standards Publication 203 (dated August 13, 2024; relating to Module-Lattice-Based Key-Encapsulation Mechanism Standard), or any successor standard; and (iii) any cryptographic algorithm or method implemented in accordance with National Institute of Standards and Technology Federal Information Processing Standard Publication 140–3 (dated March 22, 2019; relating to Security Requirements for Cryptographic Modules), or any successor standard, operating within a zero trust architecture as described in National Institute of Standards and Technology Special Publication 800–207 (dated August 2020; relating to Zero Trust Architecture), or any successor standard. (6) Sector risk management agency The term sector risk management agency has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).