FEMA Cybersecurity Improvement Act
- Sponsor
- Rep. Thompson, Bennie G. [D-MS-2]
- Committees
- Homeland Security Committee (primary)
- Last action
- Jul 22, 2025
Bottom line
The bill formally expands FEMA's mission to include cybersecurity risk mitigation and requires a progress report, aiming to bolster the agency's resilience against cyber threats.
What it actually does
This bill amends the Homeland Security Act of 2002 to explicitly add "mitigating cybersecurity risks that could impede Agency operations" to the Federal Emergency Management Agency's (FEMA) enumerated responsibilities. It also mandates that the FEMA Administrator, in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), submit a report to Congress within one year detailing progress on these cybersecurity mitigation efforts.
Proponents argue
Supporters argue that explicitly tasking FEMA with cybersecurity risk mitigation is crucial for national security, ensuring the agency's ability to respond effectively to disasters without disruption from cyberattacks. They contend that a resilient FEMA is vital for protecting critical infrastructure and maintaining public safety, and that formalizing this responsibility will lead to more robust defenses and inter-agency coordination with CISA.
Opponents contend
Critics might express concern that this bill could potentially divert resources and focus from FEMA's primary mission of disaster response and recovery, especially without new dedicated funding. They may also argue that FEMA already addresses cybersecurity risks under existing general authorities, making this amendment potentially redundant or leading to unnecessary bureaucratic expansion.
The bill is very short and clear, making it highly accessible for a reader to understand its core provisions quickly.
Section 2(a)
Explicitly Adding Cybersecurity Risk Mitigation to FEMA's Responsibilities
This provision amends Section 523(a) of the Homeland Security Act of 2002 to include "mitigating cybersecurity risks that could impede Agency operations" as a specific duty of the Federal Emergency Management Agency. This formalizes and highlights FEMA's role in protecting its own systems and operations from cyber threats, ensuring its ability to function during emergencies.
Supporters argue
Proponents argue that explicitly assigning cybersecurity risk mitigation to FEMA is essential in the modern threat landscape. They believe it will ensure FEMA's operational continuity during disasters, as cyberattacks could severely hamper response efforts. This formalization provides a clear directive and prioritization for cybersecurity within the agency.
Critics contend
Opponents might contend that while cybersecurity is important, explicitly adding it to FEMA's core mission could dilute its focus on immediate disaster response and recovery. They may argue that FEMA already has an implicit responsibility to secure its systems, and this amendment might lead to unnecessary administrative burdens without significant new operational capabilities.
Tradeoffs
The primary tension lies between focusing FEMA's resources on immediate physical disaster response versus investing in preventative cybersecurity measures. While both are critical, resource allocation and potential mission creep are key considerations. The bill aims to balance these by integrating cybersecurity into existing responsibilities.
Section 2(b)
Mandatory Report on FEMA Cybersecurity Progress
This section requires the Administrator of FEMA, in collaboration with the Director of the Cybersecurity and Infrastructure Security Agency (CISA), to submit a report to specific Congressional committees within one year. The report must detail the progress FEMA has made in mitigating cybersecurity risks within the agency, as mandated by the new statutory provision.
The bill defines "cybersecurity risks" by reference to "section 2200" of the Homeland Security Act of 2002. Section 2200 defines "cybersecurity risk" as "threat to an information system or information that is transmitted, processed, or stored on an information system that could result in the loss of confidentiality, integrity, or availability of information or information systems."
Section 2(a)(3) (new paragraph (3) of section 523(a) of the Homeland Security Act of 2002)
Why it matters:This is standard legislative practice to avoid repeating lengthy definitions already established in existing law. It ensures consistency across the U.S. Code.
Case for: Using established definitions by reference promotes legal consistency and avoids redundancy in legislative text. It ensures that the term "cybersecurity risks" has a clear, agreed-upon meaning within the broader framework of homeland security law.
Case against: While standard, relying on external references can make a bill less immediately comprehensible to a reader without access to the full U.S. Code. It requires additional research to fully grasp the scope of the mandate.
Estimated impact: Clarifies the scope of FEMA's new cybersecurity mandate, ensuring it covers threats to the confidentiality, integrity, and availability of information and systems.