Last week, Sen Coons (D,DE) introduced S 5313, the Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act of 2026. The bill would require the Federal Energy Regulatory Commission (FERC) to consider cybersecurity risks from quantum computers in any future reliability-standards setting actions. It would also require DOE to establish a PQC sandbox. No new funding is authorized by this legislation.
Definitions
Section 2 provides definitions for ten key terms used in the bill, including the following technical terms:
Information technology (IT),
Operational technology (OT),
Post-quantum cryptography (PQC), and
FERC Cybersecurity Risks
Section 3 requires FERC, in any future reliability-standard setting activities to consider:
Cybersecurity risks from quantum computers, and
Potential uses of post-quantum cryptography in IT and OT systems to protect against those risks.
PQC Sandbox
Section 4 requires DOE to establish a PQC sandbox to allow innovation and development with respect to the use of post-quantum cryptography in IT and OT applications for the electric grid.
Moving Forward
Neither Coons, nor his sole cosponsor {Sen Rounds (R,SD)} are members of the Senate Energy and Natural Resources Committee to which this bill was assigned for consideration. This means that there will not likely be sufficient influence to see the bill considered by the Committee. I see nothing in the language that would engender organized opposition. I suspect that there would be some level of bipartisan support for the bill. Unfortunately, this bill is not politically significant enough to justify the time necessary to consider it under regular order, especially in the short time left in the 119th Congress.
Commentary
This bill is not normally something that would be considered in this blog. But, having said that, I am interested in the definition of the term ‘operational technology’ proposed in Section 2. While S 5313 is targeted at control of the electric grid, the crafters of this definition felt it necessary to specifically include “industrial control systems, building management systems, fire control systems, and physical access control mechanisms” in the definition. It is almost as if they were intending to use this bill to establish this definition in US Code for some reason. I do not think that that is likely to happen with this bill, but the definition is almost good enough to be a broadly applicable cybersecurity definition.
Two changes would need to be made to allow for the broadest application. First, the ‘in general’ portion of the definition does not mention the communications technologies that are used to connect the various components that go into the ‘interacting with’ and the ‘detecting’ equipment that makes up operational technology. Second, the ‘inclusions’ portion does not mention transportation control systems or medical devices.
To address these two changes, I would revise the definition to read:
“(6) OPERATIONAL TECHNOLOGY; OT.—
“(A) IN GENERAL.—The term “operational technology” or “OT” means any programmable system or device that—
“(i) interacts with the physical environment (or manages devices that interact with the physical environment); and
“(ii) detects or causes a direct change through the monitoring or control of devices, processes, or events; or
“(iii) allows for the communications between various devices that effect activities in clauses (ii) and (iii).
“(B) INCLUSIONS.—The term “operational technology” or “OT” includes, at a minimum, industrial control systems, building management systems, fire control systems, transportation control systems, medical devices, and physical access control mechanisms.
NOTE: I am not really happy with using ‘building management systems’ because I am not satisfied that most people would accept that the term would include space or extraplanetary habitat control systems. But that is probably not an important distinction with currently only two such habitats in existence.