Protecting Biological Data as Critical Infrastructure Act
- Sponsor
- Sen. Young, Todd [R-IN]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
The bill expands CISA's mandate to include the cybersecurity of genetic and sensitive biometric data, recognizing biological data systems as critical infrastructure and fostering collaboration with the biotechnology sector.
What it actually does
This bill amends the Homeland Security Act of 2002 to explicitly mandate the Cybersecurity and Infrastructure Security Agency (CISA) to protect genetic data systems and other sensitive biometric data. It directs CISA to oversee security management, provide training, and take necessary actions to protect biological data and critical biotechnology infrastructure, formally treating these as critical infrastructure.
Proponents argue
Proponents argue that this bill is crucial for national security, as genetic and biometric data are increasingly valuable targets for foreign adversaries and cybercriminals. By designating these systems as critical infrastructure and empowering CISA, the bill proactively protects sensitive biological information, safeguards the biotechnology sector, and ensures the integrity of the nation's biological data against emerging threats.
Opponents contend
Opponents might express concerns about potential overreach of federal authority into the private biotechnology sector, arguing that existing cybersecurity frameworks or industry-led initiatives might be sufficient. They could also raise questions about the cost implications for CISA and the private sector, or potential impacts on innovation if regulations become too burdensome.
The bill is very short and can be read quickly, allowing ample time for detailed consideration of its implications.
Section 2(1)(A)(iii), inserting new paragraphs (14), (15), (16) into 6 U.S.C. 652(c)
Expanding CISA's Duties to Include Genetic Data System Security Management
This provision adds three new responsibilities to CISA's core duties. It requires CISA to oversee the planning, management, and coordination of security for genetic data systems and other sensitive biometric data, ensuring adequate staffing. It also mandates CISA to provide training for federal personnel on protecting these systems, including unique security and ethical challenges. Finally, it requires CISA to take necessary actions to protect biological data and critical biotechnology infrastructure.
Supporters argue
Supporters argue these new duties are essential to address the growing cyber threats to sensitive biological data, ensuring CISA has the explicit mandate and resources to protect a vital national asset, thereby safeguarding public health and national security.
Critics contend
Critics might argue that CISA's existing broad authority already covers critical infrastructure, and this explicit expansion could lead to duplication of efforts or an over-specialization that strains resources without clear added benefit, potentially creating bureaucratic inefficiencies.
Tradeoffs
Balancing the need for robust federal oversight and protection of sensitive data with potential concerns about bureaucratic expansion or overlapping agency responsibilities, and ensuring efficient resource allocation.
Section 2(1)(B), adding new subparagraphs (S), (T), (U) to 6 U.S.C. 652(e)(1)
Designating Genetic Data Systems as Critical Infrastructure and Mandating Stakeholder Consultation
This provision explicitly directs CISA to treat genetic data systems, including genomic sequences and other sensitive biometric data, as critical infrastructure. It also requires CISA to consult with U.S. biotechnology sector stakeholders to develop security protocols for these systems and to collaborate with these stakeholders and others engaged in biosecurity policy. This collaboration includes facilitating engagements and providing a secure line of communication for reporting incidents and requesting technical assistance.
Section 2(2), adding new subparagraph (E) to 6 U.S.C. 661(b)(2)
Including Genetic and Biometric Data Security in CISA's Strategic Plan
This provision adds 'Genetic and biometric data security' as a specific element that CISA must include in its strategic plan. This ensures that CISA's long-term planning and resource allocation explicitly address this area of cybersecurity, integrating it into the agency's foundational strategy.