Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act
- Sponsor
- Sen. Hassan, Margaret Wood [D-NH]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
This bill formally designates biotechnology and biomanufacturing as critical infrastructure, expanding CISA's mandate to enhance their cybersecurity and physical security through coordination, assessments, and strategic planning.
What it actually does
This bill amends the Homeland Security Act of 2002 to explicitly include biotechnology and biomanufacturing infrastructure within the scope of the Cybersecurity and Infrastructure Security Agency's (CISA) critical infrastructure protection responsibilities. It mandates CISA to coordinate with stakeholders, conduct assessments, develop strategic plans, and report to Congress on efforts to secure these vital sectors, particularly for infrastructure without a designated Sector-Specific Agency.
Proponents argue
Proponents argue this bill is crucial for national security, public health, and economic resilience, as it ensures dedicated federal protection for biotechnology and biomanufacturing against cyber threats and other vulnerabilities. They contend that formalizing CISA's role will lead to a more coordinated and effective approach to safeguarding these strategically important and rapidly evolving sectors.
Opponents contend
Opponents might express concerns about potential federal overreach into private industry, increased administrative burdens on CISA or the private sector, or the allocation of CISA resources away from other established critical infrastructure sectors. Some may argue that existing frameworks are sufficient or that a more targeted approach to specific threats is preferable.
The bill is very short and clearly written, making it accessible for an informed reader to understand its provisions and implications quickly.
Section 2(a)(1) of the bill, amending 6 U.S.C. 652(c)
Inclusion of Biotechnology and Biomanufacturing in CISA's Duties
This provision explicitly adds biotechnology and biomanufacturing infrastructure owners and operators to the list of entities CISA must coordinate with for critical infrastructure protection. It also directs CISA to designate staff to provide analyses, expertise, and technical assistance for critical infrastructure, including biotechnology and biomanufacturing, that does not have a designated Sector-Specific Agency (SSA). Furthermore, CISA is mandated to conduct outreach and engagement for these sectors.
Supporters argue
Supporters argue this ensures vital sectors receive necessary federal protection and guidance, closing potential security gaps and fostering resilience against threats to national security and public health.
Critics contend
Critics might argue this could lead to unnecessary federal intervention in private sector operations or duplicate efforts if some entities are already covered by other sector-specific agencies, potentially creating bureaucratic inefficiencies.
Tradeoffs
The provision navigates the tradeoff between providing comprehensive federal protection for a critical sector and avoiding potential overreach or duplication of efforts with existing regulatory bodies or industry self-governance.
Section 2(a)(2) of the bill, amending 6 U.S.C. 652(e)(1)
Assessments and National Plan for Biotechnology Infrastructure
This provision requires CISA to carry out critical infrastructure assessments specifically for biotechnology and biomanufacturing infrastructure. These assessments must be conducted in coordination with existing Information Sharing and Analysis Organizations (ISAOs), such as BIO-ISAC and H-ISAC, and relevant industry associations. Additionally, it mandates the inclusion of biotechnology and biomanufacturing infrastructure in CISA's comprehensive national plan for securing critical infrastructure, with this plan being informed by the new assessments.
Section 2(b) of the bill
CISA Work Plan and Implementation Reports
This section mandates CISA to submit a work plan within 45 days of the bill's enactment, detailing how it will protect biotechnology and biomanufacturing infrastructure. This plan must identify stakeholders, outline outreach strategies, ensure stakeholder representation in coordinating councils, and detail updates to strategic plans by September 30, 2027. CISA is then required to submit an implementation report one year after the work plan, and a final report within two years (or after the first relevant evaluation under the Thornberry NDAA) addressing any critical biotechnology areas that remain unprotected.