H.R. 10569: Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act

This bill would direct the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) to give more formal attention to biotechnology and biomanufacturing facilities and related operations as part of the nation’s critical infrastructure protection efforts.

What changes it makes

• It amends the Homeland Security Act so CISA can more clearly work on protecting biotechnology and biomanufacturing infrastructure, especially where there is no other federal agency specifically assigned to oversee that sector.
• It directs CISA staff to provide analysis, expertise, technical assistance, outreach, and engagement related to these facilities and businesses.
• It adds a new requirement for CISA to take necessary actions to help protect biotechnology and biomanufacturing infrastructure that does not already have a designated sector-specific federal agency.
• It says CISA should coordinate certain risk assessments with relevant information-sharing groups, including organizations such as BIO-ISAC and H-ISAC, as well as industry associations.
• It adds biotechnology and biomanufacturing infrastructure into the national critical infrastructure planning process, so it is included when the government develops broader protection strategies.

Required work plan and reports

The bill would require CISA’s Director to submit a work plan to Congress within 45 days after enactment. That work plan would need to include:

• Identification of the stakeholders involved in biotechnology and biomanufacturing infrastructure, including information-sharing organizations;
• An outreach plan so stakeholders know whether they are already covered under existing critical infrastructure sectors;
• A plan to make sure these stakeholders are represented in relevant industry groups and coordinating councils;
• A plan to update strategic plans by September 30, 2027, using input from these stakeholders.

The bill would also require:

• A follow-up report to Congress within one year after the work plan is submitted, describing how the plan is being carried out;
• A later report, due within two years of the work plan or at the next related federal review, addressing whether any critical biotechnology areas are still not protected.

Practical effect

In plain terms, the bill would push the federal government to treat biotechnology and biomanufacturing more like other critical infrastructure sectors, with more coordination, planning, and cybersecurity and resilience support from CISA.

Relevant Companies

• AMGN — Amgen could be affected because it operates major biotechnology research and manufacturing facilities that may fall within the infrastructure focus of the bill.
• GILD — Gilead Sciences could be affected through increased federal attention to biotech manufacturing and supply-chain security.
• REGN — Regeneron could be affected because its biologics production and related infrastructure may receive greater cybersecurity and continuity planning attention.
• BIIB — Biogen could be affected if federal critical-infrastructure planning expands protections and reporting expectations for biotechnology operations.
• VRTX — Vertex Pharmaceuticals could be affected through sector-wide security and resilience requirements for biotech facilities and operations.
• LLY — Eli Lilly could be affected because of its biologics and biomanufacturing footprint, which may be included in broader critical infrastructure planning.
• MRK — Merck could be affected through increased infrastructure protection efforts for biologics and vaccine-related manufacturing.