Technical corrections only. The diff reflects the bill's procedural status change from being passed by the House to being received and referred in the Senate, including updated attestation information. No substantive policy changes were made to the bill's text.
Strengthening Cyber Resilience Against State-Sponsored Threats Act
- Sponsor
- Rep. Ogles, Andrew [R-TN-5]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Nov 18, 2025
Bottom line
This bill establishes a dedicated interagency task force and mandates extensive reporting to Congress to bolster the United States' defense against state-sponsored cyber threats from the People's Republic of China targeting critical infrastructure.
What it actually does
This bill mandates the establishment of a joint interagency task force, led by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), to enhance the detection, analysis, and response to cybersecurity threats posed by People's Republic of China (PRC) state-sponsored cyber actors, specifically mentioning 'Volt Typhoon,' against United States critical infrastructure. The task force is required to submit comprehensive, classified reports to Congress annually for five years, along with an unclassified executive summary and a plan for an awareness campaign for critical infrastructure owners and operators.
Proponents argue
Supporters argue that this legislation is a critical and timely measure to safeguard national security by creating a unified, coordinated federal response to sophisticated and persistent cyber threats from state-sponsored actors like China. They contend that a formalized task force and regular congressional oversight are essential to ensure that federal agencies are aligned, adequately resourced, and strategically positioned to protect vital infrastructure from potential disruption or compromise.
Opponents contend
Critics might express concerns that establishing a new interagency task force could lead to bureaucratic redundancy, potentially overlapping with existing cybersecurity coordination efforts and diverting valuable resources from active threat mitigation. They may argue that enhancing existing structures or fostering informal collaborations might be a more agile and efficient approach than creating a new formal entity with extensive reporting requirements.
The bill is concise and clearly written, making it accessible for a quick but informed review by a reader interested in its core provisions.
Section 2(a)-(e)
Establishment of Interagency Task Force on PRC State-Sponsored Cyber Actors
This provision directs the Secretary of Homeland Security, through CISA, in consultation with the Attorney General, FBI Director, and other Sector Risk Management Agencies, to establish a joint interagency task force within 120 days of the bill's enactment. The task force's primary goal is to facilitate collaboration and coordination among federal agencies to detect, analyze, and respond to cybersecurity threats from People's Republic of China state-sponsored cyber actors, including 'Volt Typhoon,' targeting U.S. critical infrastructure. The Director of CISA will chair the task force, with the FBI Director serving as vice-chair.
Supporters argue
Proponents argue that a dedicated, formalized task force is essential for a unified and effective response to complex, persistent state-sponsored cyber threats. They believe it will prevent siloed efforts, ensure comprehensive defense, and streamline information sharing among critical federal entities.
Critics contend
Opponents may contend that existing interagency structures or informal collaborations are already in place and sufficient. They might argue that creating a new task force risks bureaucratic overhead and potential duplication of efforts, possibly diverting resources from active threat response without a significant increase in operational effectiveness.
Tradeoffs
This provision balances the need for focused, coordinated action against the risk of creating new bureaucratic structures that might overlap with or complicate existing cybersecurity capabilities. The challenge lies in ensuring the task force genuinely enhances, rather that hinders, agility and efficiency.
Section 2(f)
Comprehensive Reporting to Congress and Public Awareness
This provision mandates the task force to submit an initial report to appropriate congressional committees within 540 days of its establishment, followed by annual reports for five years. These reports must include classified assessments of sector-specific risks, tactics used by PRC cyber actors, resource needs, potential destruction to critical infrastructure during conflict, U.S. counter-abilities, impact on U.S. Armed Forces mobility, and economic/social ramifications. Each report requires a classified briefing to Congress and an unclassified executive summary for public publication on a DHS website. Additionally, the task force must develop a one-time plan for an awareness campaign for critical infrastructure owners and operators.
The bill defines 'critical infrastructure' by referencing section 1016(e) of Public Law 107-56 (42 U.S.C. 5195c(e)). This external reference means the specific scope of infrastructure covered is not immediately apparent from the bill text itself.
Section 2(k)(3)
Why it matters:This is standard legislative practice to ensure consistency with existing federal definitions and avoid reprinting lengthy statutory text, streamlining the bill's language.
Case for: Proponents argue that referencing an established definition ensures consistency with existing federal law and policy regarding critical infrastructure, leveraging a widely understood legal framework.
Case against: Critics might contend that relying on external references makes the bill less accessible to a casual reader, requiring additional research to fully understand the breadth of its application and the sectors it intends to protect.
Estimated impact: Broadly impacts all sectors deemed critical under the referenced statute, which includes vital areas such as energy, water, communications, financial services, healthcare, and transportation.
The bill explicitly exempts the interagency task force from the requirements of the Federal Advisory Committee Act (FACA) and the Paperwork Reduction Act.
Section 2(i) and 2(j)
Why it matters:These are technical exemptions often included to streamline the operations of specific government bodies, particularly those involved in national security or sensitive intelligence, by reducing administrative burdens and public disclosure requirements.
Case for: Proponents argue these exemptions allow the task force to operate more efficiently and rapidly, without the administrative burdens and public meeting requirements that could hinder sensitive intelligence gathering, cybersecurity operations, and timely threat response.
Case against: Critics might argue that exemptions from FACA reduce transparency and public accountability for the task force's activities, potentially limiting public oversight of its operations and recommendations. Exemption from the Paperwork Reduction Act could also lead to less managed information collection.
Estimated impact: Affects the operational transparency, administrative overhead, and public accountability of the task force, potentially allowing for more agile but less publicly visible operations.