Combat Emerging Threats to Critical Infrastructure Act of 2026
- Sponsor
- Sen. Warner, Mark R. [D-VA]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Jun 10, 2026
Bottom line
The bill aims to modernize critical infrastructure cybersecurity plans to account for rapidly evolving technological threats, particularly those posed by artificial intelligence and quantum computing, by mandating CISA and Sector Risk Management Agencies to update their strategies.
What it actually does
This bill mandates the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to update sector-specific plans for 16 critical infrastructure sectors within one year. These updates must incorporate risk management practices to address threats exacerbated by disruptive technologies like artificial intelligence, cloud computing, robotics, and advanced social engineering. It also requires a biennial reassessment and revision of these plans.
Proponents argue
Supporters argue that this bill is crucial for national security, as critical infrastructure faces increasingly sophisticated cyber threats, especially from state-sponsored actors leveraging advanced technologies like AI. Modernizing these plans is essential to protect vital services, prevent economic disruption, and ensure the resilience of the nation's infrastructure against emerging digital dangers. They contend that proactive measures are necessary to stay ahead of adversaries.
Opponents contend
Critics might argue that while the intent is sound, the bill could impose significant administrative burdens on CISA and various Sector Risk Management Agencies (SRMAs) without providing explicit new funding, potentially diverting resources from ongoing operational cybersecurity efforts. There could also be concerns about the pace of technological change making biennial updates insufficient, or that overly prescriptive requirements could stifle innovation or create compliance challenges for critical infrastructure owners and operators.
The bill is short and clearly written, making it accessible for a quick read and understanding of its core directives.
Section 3(a)
Update of Sector-Specific Plans
This provision requires the Director of CISA to update the sector-specific plans for 16 designated critical infrastructure sectors within one year of the bill's enactment. These sectors include chemical, commercial facilities, communications, energy, financial services, healthcare, and transportation, among others. The updates are intended to ensure that these plans reflect current threats and best practices.
Supporters argue
Supporters argue that regularly updating these foundational plans is essential to maintain the relevance and effectiveness of national critical infrastructure protection strategies in the face of evolving threats. This ensures that all sectors are operating with the most current guidance.
Critics contend
No specific opposition is typically raised against the general principle of updating security plans, though concerns might arise regarding the resources required for such a comprehensive update across numerous agencies.
Tradeoffs
The primary tension is balancing the need for comprehensive, up-to-date plans with the administrative burden and resource allocation required for such a large-scale update across many federal agencies.
Section 3(b)
Addressing Technology-Facilitated Threats
This section mandates that the updated sector-specific plans must incorporate risk management practices specifically designed to address threats exacerbated by disruptive technologies. This includes malicious activity targeting artificial intelligence (AI) systems or their supply chains, AI-leveraged cyber exploitation campaigns, risks from cloud-based architecture, robotics, zero trust principles, and evolving social engineering techniques using digitally manipulated media. For the Financial Services Sector, it specifically requires coordination with the Secretary of the Treasury to address digital asset vulnerabilities related to quantum computing cryptographic risks.
Section 3(d)
Reports to Congress
This section requires the Director of CISA to inform and provide copies of the updated sector-specific plans to various relevant committees in both the Senate and the House of Representatives within 30 days of completing the updates. Specific committees are designated based on their oversight responsibilities for each critical infrastructure sector (e.g., Armed Services for Defense Industrial Base, Energy and Natural Resources for Energy Sector).
Section 4
Biennial Reassessment
This section mandates that CISA must conduct a reassessment of each sector-specific plan and issue revised plans not later than two years after the initial update, and then at least once every two years thereafter. This ensures that the plans remain current and responsive to evolving threats and technological changes.
Defines 'artificial intelligence' by referencing section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).
Section 2(1)
Why it matters:Referencing existing definitions is standard legislative practice to ensure consistency across federal law and avoid redundancy, rather than being evasive.
Case for: Using established definitions promotes legal clarity and avoids creating conflicting interpretations of key terms across different acts.
Case against: Requires external research for a complete understanding, potentially making the bill less immediately accessible to a general reader.
Estimated impact: Ensures a consistent and broad understanding of AI technologies that must be considered in critical infrastructure risk management.
Defines 'digital asset' by referencing section 2 of the GENIUS Act (12 U.S.C. 5901).
Section 2(2)
Why it matters:Standard legislative practice to maintain consistency and avoid re-litigating definitions.
Case for: Provides a clear, consistent legal framework for understanding what constitutes a 'digital asset' in the context of financial sector vulnerabilities.
Case against: Requires additional research to fully grasp the scope of the term and its implications for the financial sector.
Estimated impact: Clarifies the types of assets whose cryptographic vulnerabilities related to quantum computing must be addressed by CISA and the Treasury.
Requires sector-specific plans to address risks and mitigations associated with 'zero trust principles (as defined in NIST Special Publication 800-207 or any successor publication)'.
Section 3(b)(1)(C)
Why it matters:This is standard practice for technical legislation to defer to expert agency guidance, ensuring that the implementation aligns with recognized industry standards without making the bill text overly technical.
Case for: Referencing NIST standards ensures that the implementation of zero trust principles is based on widely accepted and updated cybersecurity best practices, providing clarity and consistency for critical infrastructure operators.
Case against: Requires specialized knowledge or external lookup to understand the full implications of 'zero trust principles' as defined by NIST, potentially making the provision less accessible to non-technical readers.
Estimated impact: Directs critical infrastructure sectors to adopt a specific, robust cybersecurity architectural model, enhancing overall resilience against network intrusions.