H.R. 10671: Securing Our Critical Infrastructure Act

This bill would expand and rename an existing Cybersecurity and Infrastructure Security Agency (CISA) program that provides warning and assistance related to cybersecurity vulnerabilities.

What changes the bill makes

• It turns a former ransomware vulnerability warning pilot program into a permanent security vulnerability warning program.
• It broadens the program beyond ransomware-related issues to cover security vulnerabilities in information systems more generally.
• It narrows the focus of the program to certain covered utilities, mainly smaller water and wastewater utilities and related public water systems and treatment works.

What CISA would do under the program

• Automatically enroll covered utilities in CISA cyber hygiene services, unless a utility chooses to opt out.
• Provide incident response help if CISA determines a covered utility has been affected by a cyber incident.
• Coordinate with the Environmental Protection Agency while carrying out the program.

Information sharing and privacy rules

• Information shared with CISA under this program would be exempt from disclosure under federal, state, local, tribal, and similar public records laws.
• CISA would be restricted from disclosing, retaining, or using the information except for specific purposes already allowed under related cybersecurity law.
• CISA would have to retain any shared information in a way that protects personal information and information identifying specific individuals.

Who counts as a covered utility

• A water or wastewater utility serving no more than 100,000 people.
• Certain “eligible entities” defined elsewhere in federal law.
• Operators of public water systems and treatment works.

Duration

• The program would end five years after the bill’s new provisions take effect.

Relevant Companies

None found