Browse Arkansas Code titles and sections
6 U.S.C. § 1526 — Inventory of cryptographic systems; migration to post-quantum cryptography
Federal law — U.S. Code and appendices · legal_authorities
**(a) Inventory**
(1) **Establishment** — Not later than 180 days after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall issue guidance on the migration of information technology to post-quantum cryptography, which shall include at a minimum—
(A) a requirement for each agency to establish and maintain a current inventory of information technology in use by the agency that is vulnerable to decryption by quantum computers, prioritized using the criteria described in subparagraph (B);
(B) criteria to allow agencies to prioritize their inventory efforts; and
(C) a description of the information required to be reported pursuant to subsection (b).
(2) **Additional content in guidance** — In the guidance established by paragraph (1), the Director of OMB shall include, in addition to the requirements described in that paragraph—
(A) a description of information technology to be prioritized for migration to post-quantum cryptography; and
(B) a process for evaluating progress on migrating information technology to post-quantum cryptography, which shall be automated to the greatest extent practicable.
(3) **Periodic updates** — The Director of OMB shall update the guidance required under paragraph (1) as the Director of OMB determines necessary, in coordination with the National Cyber Director and in consultation with the Director of CISA.
**(b) Agency reports** Not later than 1 year after December 21, 2022, and on an ongoing basis thereafter, the head of each agency shall provide to the Director of OMB, the Director of CISA, and the National Cyber Director—
(1) the inventory described in subsection (a)(1); and
(2) any other information required to be reported under su
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 1526
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 19086e932ea0d51eb119a7f4c684c72fbb3ebf610e43c56193090169dde16f4f. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_2ec17df1e77262fb6000bc70
Source file: Laws/federal/codes/united-states-code/title-6/section-1526-inventory-of-cryptographic-systems-migration-to-post-quantum-cryptograph--b74581a3d7.md
Pages: Not recorded – Not recorded
Passage SHA-256: 2361bd03a70f1d2f1783b83c0249b52061e7e6a8bb9860c358c5ef2b410d4c63
Source location: Title 6, Chapter 6, § 1526; chapter-006-cybersecurity.md
Stored source content
**(a) Inventory**
(1) **Establishment** — Not later than 180 days after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall issue guidance on the migration of information technology to post-quantum cryptography, which shall include at a minimum—
(A) a requirement for each agency to establish and maintain a current inventory of information technology in use by the agency that is vulnerable to decryption by quantum computers, prioritized using the criteria described in subparagraph (B);
(B) criteria to allow agencies to prioritize their inventory efforts; and
(C) a description of the information required to be reported pursuant to subsection (b).
(2) **Additional content in guidance** — In the guidance established by paragraph (1), the Director of OMB shall include, in addition to the requirements described in that paragraph—
(A) a description of information technology to be prioritized for migration to post-quantum cryptography; and
(B) a process for evaluating progress on migrating information technology to post-quantum cryptography, which shall be automated to the greatest extent practicable.
(3) **Periodic updates** — The Director of OMB shall update the guidance required under paragraph (1) as the Director of OMB determines necessary, in coordination with the National Cyber Director and in consultation with the Director of CISA.
**(b) Agency reports** Not later than 1 year after December 21, 2022, and on an ongoing basis thereafter, the head of each agency shall provide to the Director of OMB, the Director of CISA, and the National Cyber Director—
(1) the inventory described in subsection (a)(1); and
(2) any other information required to be reported under subsection (a)(1)(C).
**(c) Migration and assessment** Not later than 1 year after the date on which the Director of NIST has issued post-quantum cryptography standards, the Director of OMB shall issue guidance requiring each agency to—
(1) prioritize information technology described under subsection (a)(2)(A) for migration to post-quantum cryptography; and
(2) develop a plan to migrate information technology of the agency to post-quantum cryptography consistent with the prioritization under paragraph (1).
**(d) Interoperability** The Director of OMB shall ensure that the prioritizations made under subsection (c)(1) are assessed and coordinated to ensure interoperability.
**(e) Office of Management and Budget reports**
(1) **Report on post-quantum cryptography** — Not later than 15 months after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report on the following:
(A) A strategy to address the risk posed by the vulnerabilities of information technology of agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach that encryption.
(B) An estimate of the amount of funding needed by agencies to secure the information technology described in subsection (a)(1)(A) from the risk posed by an adversary of the United States using a quantum computer to breach the encryption of the information technology.
(C) A description of Federal civilian executive branch coordination efforts led by the National Institute of Standards and Technology, including timelines, to develop standards for post-quantum cryptography, including any Federal Information Processing Standards developed under chapter 35 of title 44, as well as standards developed through voluntary, consensus standards bodies such as the International Organization for Standardization.
(2) **Report on migration to post-quantum cryptography in information technology** — Not later than 1 year after the date on which the Director of OMB issues guidance under subsection (c)(2), and thereafter until the date that is 5 years after the date on which post-quantum cryptographic standards are issued, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives, with the report submitted pursuant to [section 3553(c) of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3553/c&num=0&edition=prelim), a report on the progress of agencies in adopting post-quantum cryptography standards.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
As used in this subchapter—
(1) the term “agency” means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—
(A) the Government Accountability Office;
(B) Federal Election Commission;
(C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or
(D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities;
(2) the term “burden” means time, effort, or financial resources expended by persons to generate, maintain, or provide information to or for a Federal agency, including the resources expended for—
(A) reviewing instructions;
(B) acquiring, installing, and utilizing technology and systems;
(C) adjusting the existing ways to comply with any previously applicable instructions and requirements;
(D) searching data sources;
(E) completing and reviewing the collection of information; and
(F) transmitting, or otherwise disclosing the information;
(3) the term “collection of information”—
(A) means the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public, of facts or opinions by or for an agency, regardless of form or format, calling for either—
(i) answers to identical questions posed to, or identical reporting or recordkeeping requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the United States; or
(ii) answers to questions posed to agencies, ins
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3502
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Establishment** There is established, within the Executive Office of the President, the Office of the National Cyber Director (in this section referred to as the “Office”).
**(b) National Cyber Director**
(1) **In general** — The Office shall be headed by the National Cyber Director (in this section referred to as the “Director”) who shall be appointed by the President, by and with the advice and consent of the Senate.
(2) **Position** — The Director shall hold office at the pleasure of the President.
(3) **Pay and allowances** — The Director shall be entitled to receive the same pay and allowances as are provided for level II of the Executive Schedule under [section 5313 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section5313&num=0&edition=prelim).
**(c) Duties of the National Cyber Director**
(1) **In general** — Subject to the authority, direction, and control of the President, the Director shall—
(A) serve as the principal advisor to the President on cybersecurity policy and strategy relating to the coordination of—
(i) information security and data protection;
(ii) programs and policies intended to improve the cybersecurity posture of the United States;
(iii) efforts to understand and deter malicious cyber activity;
(iv) efforts to increase the security of information and communications technology and services and to promote national supply chain risk management and vendor security;
(v) diplomatic and other efforts to develop norms and international consensus around responsible state behavior in cyberspace;
(vi) awareness and adoption of emerging technology that may enhance, augment, or degrade the cybersecurity posture of the United States; and
(vii) such other cybersecurity matt
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 1500
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter.
**(b) Additional Definitions.—** As used in this subchapter:
(1) The term “binding operational directive” means a compulsory direction to an agency that—
(A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk;
(B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and
(C) may be revised or repealed by the Director if the direction issued on behalf of the Director is not in accordance with policies and principles developed by the Director.
(2) The term “incident” means an occurrence that—
(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or
(B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
(3) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—
(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;
(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
(C) availability, which means ensuring timely and reliable access to and use of information.
(4) The term “information technology” has the meaning given that term
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3552
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 514
TITLE 6—DOMESTIC SECURITY
§ 1525
1 So in original. Probably should be ‘‘663(c)(2)’’.
(iv) a list by agency of compliance with
the requirements of section 1523(b) of this
title; and
(C) not later than 1 year after December
18, 2015, submit to the appropriate congres-
sional committees—
(i) a copy of the plan developed pursuant
to section 1522(a)(2) of this title; and
(ii) the improved metrics developed pur-
suant to section 1522(c) of this title.
(d) Form
Each report required under this section shall
be submitted in unclassified form, but may in-
clude a classified annex.
(Pub. L. 114–113, div. N, title II, § 226, Dec. 18,
2015, 129 Stat. 2969; Pub. L. 115–278, § 2(h)(1)(F),
Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div.
G, title LXXI, § 7143(d)(1)(B), Dec. 23, 2022, 136
Stat. 3663.)
Editorial Notes
REFERENCES IN TEXT
Subtitle D of title II of the Homeland Security Act of
2002, referred to in subsec. (c)(1)(C)(ii), is subtitle D
(§§ 231–237) of title II of Pub. L. 107–296, Nov. 25, 2002, 116
Stat. 2159, which enacted part D (§ 161 et seq.) of sub-
chapter II of chapter 1 of this title and amended sec-
tions 10102 and 10122 of Title 34, Crime Control and Law
Enforcement. Subtitle D was redesignated subtitle C of
title II of the Homeland Security Act of 2002 by Pub. L.
115–278, § 2(g)(2)(K), Nov. 16, 2018, 132 Stat. 4178, and is
classified principally to part C (§ 161 et seq.) of sub-
chapter II of chapter 1 of this title. For complete clas-
sification of subtitle C to the Code, see Tables.
AMENDMENTS
2022—Subsec. (a)(2). Pub. L. 117–263 substituted ‘‘sec-
tion 650 of this title’’ for ‘‘section 1501 of this title’’.
2018—Subsec. (a)(1). Pub. L. 115–278, § 2(h)(1)(F)(i)(I),
substituted ‘‘section 2213’’ for ‘‘section 230’’ and struck
Source: Supplied 2024 U.S. Code historical extraction · 6 U.S.C. § 1526
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.