Protecting Biological Data as Critical Infrastructure Act
- Sponsor
- Rep. Khanna, Ro [D-CA-17]
- Committees
- Homeland Security Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
This bill expands CISA's mandate to explicitly include the cybersecurity of genetic and sensitive biometric data, aiming to bolster national security against emerging biological threats and ensure the integrity of the biotechnology sector.
What it actually does
This bill amends the Homeland Security Act of 2002 to expand the duties of the Cybersecurity and Infrastructure Security Agency (CISA) to include the protection of genetic data systems and other sensitive biometric data. It formally designates these systems as critical infrastructure and mandates CISA to develop security protocols, provide training for federal personnel, and collaborate extensively with the biotechnology sector and other federal agencies on biosecurity.
Proponents argue
Proponents argue this bill is crucial for national security, proactively addressing a growing vulnerability by protecting highly sensitive personal and national assets from cyber threats and foreign adversaries. They contend it ensures the integrity and resilience of the biotechnology sector, which is vital for the nation's economic and strategic interests.
Opponents contend
Potential opponents might raise concerns about mission creep for CISA, arguing that this broad expansion could dilute its focus on existing critical infrastructure sectors or that other agencies are better suited to lead on biological data security. They might also express apprehension about potential overreach into private sector data or the cost and complexity of implementing such a broad mandate without clear boundaries.
The bill is very short and easy to read, allowing ample time for public and congressional review to understand its provisions and implications.
Section 2(1)(A)(iii), inserting new paragraphs (14), (15), (16) into 6 U.S.C. 652(c)
CISA Oversight and Training for Genetic Data Systems
This provision requires CISA to oversee the security management of genetic data systems, including genomic sequences and other sensitive biometric data. It also mandates CISA to provide training for federal personnel on protecting these systems, addressing unique security challenges and ethical considerations. Furthermore, it directs CISA to take necessary actions to protect biological data and critical biotechnology infrastructure.
Supporters argue
Supporters argue this is a necessary update to CISA's mandate, ensuring that the agency responsible for critical infrastructure cybersecurity is equipped to handle the unique and sensitive nature of biological data, which is increasingly a target for adversaries.
Critics contend
Critics might contend that this expands CISA's mission too broadly, potentially diluting its focus on existing critical infrastructure sectors, or that other agencies are better suited to lead on biological data security due to their specialized expertise.
Tradeoffs
This provision balances the urgent need for enhanced security of highly sensitive biological data against potential concerns about federal overreach into a rapidly evolving sector and the allocation of CISA's finite resources.
Section 2(1)(B), inserting new subparagraph (S) into 6 U.S.C. 652(e)(1)
Critical Infrastructure Designation for Genetic Data Systems
This provision explicitly designates genetic data systems that involve genomic sequences and other sensitive biometric data as critical infrastructure. This formal classification brings these systems under the purview of CISA's existing authorities and responsibilities for protecting critical infrastructure, ensuring a coordinated national defense against threats.
Section 2(1)(B), inserting new subparagraphs (T) and (U) into 6 U.S.C. 652(e)(1)
Stakeholder Engagement for Biosecurity Protocols
This provision requires CISA to consult with U.S. biotechnology sector stakeholders and relevant federal agencies (like the Office of Biometric Identity Management) to develop security protocols for genetic data systems. It also mandates collaboration, including facilitating engagements to coordinate on emerging security concerns (such as the digital-physical boundary of genetic data) and providing a secure communication channel for reporting incidents and requesting technical assistance.
Section 2(2), inserting new subparagraph (E) into 6 U.S.C. 661(b)(2)
Inclusion in CISA Strategic Plan
This provision amends the Homeland Security Act of 2002 to explicitly include "Genetic and biometric data security" as an element of CISA's strategic plan for enhancing the security of the Nation's critical infrastructure. This ensures that the protection of biological data is formally integrated into CISA's long-term strategic objectives and resource allocation.