Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act
- Sponsor
- Rep. Khanna, Ro [D-CA-17]
- Committees
- Homeland Security Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
This bill formally designates biotechnology and biomanufacturing as critical infrastructure, expanding CISA's mandate to protect these vital sectors from cyber and physical threats and requiring detailed reporting on its efforts.
What it actually does
This bill amends the Homeland Security Act of 2002 to explicitly include biotechnology and biomanufacturing infrastructure within the purview of the Cybersecurity and Infrastructure Security Agency (CISA). It mandates CISA to take actions to protect these sectors, especially those without a designated Sector-Specific Agency (SSA), and requires CISA to coordinate with industry stakeholders and update strategic plans to reflect this expanded focus. The bill also imposes several reporting requirements on CISA regarding its implementation efforts.
Proponents argue
Proponents argue that the biotechnology and biomanufacturing sectors are increasingly vital for national security, economic competitiveness, and public health, making their protection from cyberattacks, intellectual property theft, and other threats a national imperative. Explicitly designating them as critical infrastructure ensures CISA dedicates necessary resources and expertise to safeguard these emerging and rapidly evolving industries, thereby enhancing national resilience.
Opponents contend
Opponents might express concerns about potential overreach of federal authority into private industry, the administrative burden of compliance for companies, or the allocation of CISA resources away from other established critical infrastructure sectors. Some may argue that existing frameworks are sufficient or that a more targeted approach might be less disruptive without formal designation.
The bill is very short and clear, making it highly accessible for any reader to understand its core purpose and provisions within a few minutes.
Section 2(a)(1)(A)
Inclusion of Biotechnology and Biomanufacturing in CISA Collaboration
This provision updates the Homeland Security Act to explicitly require the Cybersecurity and Infrastructure Security Agency (CISA) to collaborate with biotechnology and biomanufacturing infrastructure owners and operators. This expanded mandate ensures that CISA's existing duties, such as sharing threat information and coordinating protective measures, now formally include these critical sectors. The aim is to integrate biotechnology and biomanufacturing into the national framework for critical infrastructure protection, fostering a more secure and resilient environment for these vital industries.
Supporters argue
Supporters argue that formalizing this collaboration is essential for proactive threat intelligence sharing and developing robust cybersecurity defenses tailored to the unique risks faced by these industries, which are critical to national security and public health.
Critics contend
No specific opposition is typically raised against this provision, as collaboration between government agencies and private industry on security matters is generally seen as beneficial for national resilience.
Tradeoffs
The primary tension is ensuring that CISA has adequate resources to effectively engage with an expanded set of stakeholders without diluting its focus on existing critical sectors, requiring careful resource management.
Section 2(a)(1)(B) & (C)
CISA Staff Designation for Biotechnology and Other Undesignated Critical Infrastructure
This provision directs the Cybersecurity and Infrastructure Security Agency (CISA) to designate dedicated staff members. These staff will be responsible for providing specialized analyses, expert guidance, and technical assistance to critical infrastructure sectors, particularly biotechnology and biomanufacturing, that do not currently have a designated Sector-Specific Agency (SSA). Furthermore, these designated staff will conduct outreach and engagement activities, including convening relevant SSAs, to ensure comprehensive support and coordination for these emerging and vital industries, preventing them from being overlooked in national security efforts.
Section 2(a)(1)(F)
Direct Mandate for CISA Protection of Undesignated Biotechnology Infrastructure
This new paragraph explicitly requires the Cybersecurity and Infrastructure Security Agency (CISA) to undertake all necessary actions to ensure the robust protection of biotechnology and biomanufacturing infrastructure. This mandate specifically applies to those parts of the sector that currently lack a designated Sector-Specific Agency (SSA), thereby solidifying CISA's direct responsibility for their security. It aims to provide a clear directive for CISA to proactively safeguard these critical assets against a range of threats, recognizing their growing importance to national security, public health, and economic stability.
Section 2(a)(2)(A)
Coordination with Industry for Critical Infrastructure Assessments
This provision mandates that the Cybersecurity and Infrastructure Security Agency (CISA) must conduct its critical infrastructure assessments in close coordination with relevant industry stakeholders. Specifically, for sectors without a designated Sector-Specific Agency (SSA), such as biotechnology and biomanufacturing, these assessments must involve Information Sharing and Analysis Organizations (ISAOs) like BIO-ISAC and H-ISAC, as well as other industry member associations. This collaborative approach ensures that CISA's understanding of sector-specific risks and vulnerabilities is informed by real-world industry expertise, leading to more accurate and effective protection strategies.
Section 2(a)(2)(B)
Inclusion of Biotechnology in National Critical Infrastructure Plans
This provision requires the Cybersecurity and Infrastructure Security Agency (CISA) to formally incorporate biotechnology and biomanufacturing infrastructure into its comprehensive national plans for critical infrastructure protection. This ensures that these vital sectors are explicitly addressed in the nation's overarching security strategies. Furthermore, it specifies that these updated national plans must be directly informed by the detailed assessments conducted in coordination with industry stakeholders, as mandated elsewhere in the bill. This integration aims to create a cohesive and well-informed national approach to safeguarding these critical assets.
Section 2(b)
CISA Work Plan and Implementation Reports to Congress
This section establishes several mandatory reporting requirements for the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to Congress. Within 45 days of enactment, CISA must submit a detailed work plan outlining its strategy for protecting biotechnology and biomanufacturing infrastructure, including stakeholder identification and outreach. One year later, an implementation report on this work plan is due. Finally, within two years or after a specific evaluation, CISA must report on any critical biotechnology areas that remain unprotected, ensuring ongoing congressional oversight and accountability for these critical sectors.