Farm and Food Cybersecurity Act of 2025
- Sponsor
- Rep. Finstad, Brad [R-MN-1]
- Committees
- Agriculture Committee (primary)
- Last action
- Mar 28, 2025
Bottom line
This bill establishes a framework for proactive cybersecurity risk assessment and emergency preparedness exercises specifically for the U.S. agriculture and food supply chain to enhance its security and resilience.
What it actually does
This bill directs the Secretary of Agriculture to conduct biennial cybersecurity risk assessments for the agriculture and food critical infrastructure sector, identifying threats, vulnerabilities, and recommending enhancements. It also mandates an annual cross-sector crisis simulation exercise over a five-year period to test preparedness for food-related emergencies or disruptions, with an authorization of appropriations for these exercises.
Proponents argue
Proponents argue that the bill is a crucial and timely step to safeguard the nation's food supply from increasing cyber threats and other disruptions, ensuring food security, public health, and economic stability by systematically identifying vulnerabilities and improving response capabilities across the entire sector.
Opponents contend
Opponents might argue that existing federal agencies already possess sufficient authority and programs to address these issues, or that the mandates could create unnecessary bureaucratic burdens and costs for the private sector without clear evidence of significantly improved security outcomes beyond current efforts.
The bill is concise and clearly written, allowing for a quick and straightforward understanding of its core directives and implications.
Section 3(a)
Biennial Cybersecurity Risk Assessment for Agriculture and Food Sector
This provision requires the Secretary of Agriculture to conduct a comprehensive risk assessment every two years. This assessment will identify cybersecurity threats and security vulnerabilities within the agriculture and food critical infrastructure sector, analyze the potential impacts of cyberattacks on food safety, the economy, public health, and national security, and evaluate current capabilities to prevent, detect, and respond to such incidents. It also aims to identify gaps and recommend legislative or administrative actions to improve defensive measures.
Supporters argue
Supporters argue this biennial assessment is vital for understanding the evolving cyber threat landscape to the nation's food supply, enabling targeted interventions and policy development to protect a critical sector from potentially devastating attacks.
Critics contend
Critics might argue that such assessments could be redundant with existing efforts by DHS or other agencies, potentially creating additional reporting burdens for the USDA without clear evidence of leading to significantly more actionable improvements than current practices.
Tradeoffs
This provision balances the critical need for comprehensive threat intelligence and vulnerability identification with the potential for increased administrative overhead for both government and private sector participants.
Section 4(a)
Annual Food Security and Cyber Resilience Simulation Exercise
This provision directs the Secretary of Agriculture, in coordination with the Secretaries of Homeland Security and Health and Human Services, and the Director of National Intelligence, to conduct an annual cross-sector crisis simulation exercise over a five-year period. These exercises are designed to assess preparedness for food-related emergencies or disruptions, identify vulnerabilities in the food supply chain, enhance coordination among stakeholders, and evaluate the effectiveness of existing policies and resources related to food security and resilience.
Section 4(f)
Funding for Simulation Exercises
This provision authorizes the appropriation of $1,000,000 for each of fiscal years 2026 through 2030 to specifically carry out the annual cross-sector crisis simulation exercises. This dedicated funding is intended to provide the necessary financial resources for the Department of Agriculture and its coordinating agencies to design, execute, and evaluate these mandated preparedness activities over the specified five-year period.
Defines the "agriculture and food critical infrastructure sector" broadly to include any activity relating to the production, processing, distribution, storage, transportation, consumption, or disposal of agricultural or food products, and any entity involved in such activities (including farmers, ranchers, processors, manufacturers, distributors, retailers, consumers, and regulators).
Section 2(1)
Why it matters:This is standard legislative practice to define terms upfront, but the breadth of this particular definition has significant implications for the bill's reach.
Case for: Proponents would argue that a broad definition ensures comprehensive coverage of the entire food supply chain, preventing gaps in cybersecurity assessments and emergency preparedness that could be exploited by adversaries.
Case against: Critics might suggest that such an expansive definition could lead to an overly broad scope for federal oversight and participation requirements, potentially burdening small entities or those with minimal cyber risk within the vast sector.
Estimated impact: Ensures that the cybersecurity assessments and simulation exercises mandated by the bill cover the full spectrum of the U.S. food system, from primary production to final consumption, impacting a wide array of businesses and governmental functions.