Securing Our Critical Infrastructure Act
- Sponsor
- Rep. Gottheimer, Josh [D-NJ-5]
- Committees
- Homeland Security Committee (primary)
- Last action
- Oct 1, 2026
Bottom line
This bill permanently establishes and expands a CISA program to provide security vulnerability warnings and cyber hygiene services to critical utilities, enhancing their cybersecurity posture while adding privacy safeguards.
What it actually does
This bill amends the Cyber Incident Reporting for Critical Infrastructure Act of 2022 to reauthorize and expand a Cybersecurity and Infrastructure Security Agency (CISA) program. It converts a pilot ransomware vulnerability warning program into a permanent "security vulnerability warning program," broadens its scope beyond ransomware, and mandates automatic enrollment of certain critical utilities (including water/wastewater and other state, local, and tribal government entities) into CISA's cyber hygiene services. It also directs CISA to utilize its incident response capabilities for affected utilities and adds new privacy protections for shared information.
Proponents argue
Supporters argue this bill strengthens national cybersecurity by making CISA's vulnerability warning and cyber hygiene services permanent and automatic for vulnerable critical infrastructure sectors, particularly smaller water and wastewater utilities, which often lack the resources to defend against sophisticated cyber threats. They emphasize that proactive warnings and incident response capabilities are crucial for protecting essential services from disruption.
Opponents contend
Opponents might raise concerns about potential overreach of federal authority into local utility operations, the administrative burden of automatic enrollment, or the effectiveness of CISA's services. Some may argue that the privacy protections, while present, might not be sufficient to prevent unintended data use or disclosure, or that mandating services could stifle private sector innovation in cybersecurity solutions.
The bill is concise and can be read quickly, allowing ample time for stakeholders to understand its provisions.
Section 2, paragraphs (1)-(5)
Establishment and Expansion of Security Vulnerability Warning Program
This provision transforms a temporary pilot program focused on ransomware vulnerabilities into a permanent, broader "security vulnerability warning program" within CISA. It expands the scope of warnings to cover general security vulnerabilities for information systems, not just those related to ransomware, and renames the entities receiving warnings from "covered entities" to "covered utilities."
Supporters argue
Supporters argue that making the program permanent and expanding its scope beyond ransomware is essential to address the evolving and diverse landscape of cyber threats, ensuring critical infrastructure receives comprehensive warnings.
Critics contend
Critics might argue that expanding the scope without clear boundaries could dilute CISA's focus or create an overly broad mandate, potentially leading to less effective warnings.
Tradeoffs
Balances the need for comprehensive security warnings against the risk of mission creep for CISA.
Section 2, paragraph (6)
Strengthened Data Privacy and Disclosure Exemptions
This provision significantly enhances privacy protections for information shared by covered entities with CISA under the program. It explicitly exempts this information from public disclosure laws (like FOIA) and restricts CISA's ability to disclose, retain, or use the information to specific, authorized cybersecurity purposes, while also mandating protection of personal and identifying information.
Section 2, paragraph (7), new subsection (g)
Mandatory Cyber Hygiene Service Enrollment for Covered Utilities
This provision requires CISA to automatically enroll all "covered utilities" into its cyber hygiene services. These services are designed to help entities improve their basic cybersecurity practices. Utilities retain the ability to opt out of these services by notifying CISA.
Section 2, paragraph (7), new subsection (h)
CISA-Led Cyber Incident Response for Covered Utilities
This provision directs CISA to actively intervene and provide incident response capabilities for covered utilities determined to be affected by a cyber incident. This means CISA would deploy its resources to help these utilities respond to and recover from attacks.
Section 2, paragraph (7), new subsection (i)
Interagency Coordination with EPA
This provision mandates that the Director of CISA coordinate with the Administrator of the Environmental Protection Agency (EPA) when implementing the security vulnerability warning program. This ensures that the specific needs and regulatory landscape of water and wastewater utilities, which fall under EPA's purview, are considered.
Section 2, paragraph (7), new subsection (j)
Program Sunset Clause
This provision establishes a sunset date for the security vulnerability warning program, mandating its termination five years after the enactment of this bill. This means the program is reauthorized for a fixed period rather than indefinitely.
Section 2, paragraph (7), new subsection (k)
Definition of "Covered Utility"
This provision precisely defines which entities qualify as "covered utilities" for the purposes of the program. It includes smaller water and wastewater utilities (serving up to 100,000 people), other entities eligible under a specific section of the Infrastructure Investment and Jobs Act, and operators of public water systems or treatment works as defined in existing federal law.
The definition of "covered utility" includes "an eligible entity (as such term is defined in section 40124 of the Infrastructure Investment and Jobs Act (42 U.S.C. 18723))" and operators of public water systems or treatment works. Section 40124 of the IIJA defines "eligible entity" as a State, local government, or Tribal government. This means the bill's automatic enrollment and incident response provisions apply not only to water/wastewater utilities but also potentially to a broader range of state, local, and tribal government entities.
Section 2, subsection (k)(2) and (k)(3)
Why it matters:This is standard legislative practice for brevity and to avoid reprinting lengthy definitions, but it can obscure the full reach of the bill for a casual reader.
Case for: Using existing definitions from other statutes promotes consistency across federal law and avoids creating redundant or conflicting definitions. It streamlines the legislative text.
Case against: Relying on external definitions can make a bill less accessible and transparent to the public and even to some policymakers, requiring additional research to understand its full implications.
Estimated impact: Significantly expands the potential universe of entities subject to automatic enrollment in cyber hygiene services and CISA incident response beyond just water/wastewater utilities to include a broad range of state, local, and tribal government entities.