FISMA scope for quantum workloads at national laboratories
Quantum computation at a national lab does not automatically create a new authorization boundary — but cloud routing to external QPUs does introduce interconnection considerations your ISSO needs to document.
Three deployment paths
Simulator (Evaluate): Runs local. Inherits host ATO. Nuqasm ledger is a subsystem — no new CSP required for initial technical assessment.
Cloud routing (Standard): Nuqasm capture layer sits between submitter and IBM Quantum, IonQ, Amazon Braket, Rigetti, or Quantinuum. AU-3 audit content includes backend identity and calibration snapshot. Document as interconnection (SA-9).
Air-gapped appliance (Sovereign): Standalone boundary. Zero cloud dependencies. 7-year append-only retention. DISA STIG path for classified-adjacent programs.
What auditors ask
"Show me the audit record for experiment X — who submitted it, what hardware ran it, what calibration state applied, and prove the results weren't modified." Account-level API logs cannot answer this.
Control mapping: control-mapping-summary.md · Schema: audit-record-schema.json