This bill requires the Bureau of Industry and Security (BIS) to modernize its outdated information technology systems by 2030, focusing on streamlining export license reviews and enhancing national security monitoring. Key provisions include replacing legacy systems with a unified platform for case management, adopting advanced data analytics tools to track military-related trade patterns, and improving data sharing with industry and government partners. It directly affects BIS operations, industry stakeholders using export systems, and federal agencies collaborating on security enforcement. The bill authorizes $25 million annually (2026-2029) for this modernization, aiming to reduce manual processing, strengthen cybersecurity, and improve efficiency in reviewing entities on the Entity List.
The Federal Cyber Workforce Training Act of 2025 establishes a Federal Institute to train federal employees in cybersecurity roles and human resources staff managing cybersecurity positions. The Institute will develop role-specific training modules - including hands-on exercises and assessments - based on the NICE cybersecurity framework, offering both in-person and virtual options without requiring a cybersecurity degree. The National Cyber Director must submit a detailed implementation plan to Congress within 180 days, and the Institute will operate without new funding, leveraging existing federal resources. This training aims to enhance skills for entry-level cybersecurity roles, support mid-career transitions, and improve hiring practices for federal cybersecurity personnel.
HR 2659 creates a federal task force to address cyber threats from China's state-sponsored actors, specifically targeting groups like Volt Typhoon identified in a 2024 CISA advisory. The task force, led by CISA and FBI directors, coordinates federal agencies responsible for critical infrastructure security to detect and respond to cyberattacks. It must produce annual reports - including classified assessments of infrastructure risks and recommendations - to Congress within 540 days of formation and for five years after. These reports will guide federal efforts to protect critical infrastructure (like energy grids and transportation systems) and inform owners/operators through a public awareness campaign.
This bill requires the National Suicide Prevention Lifeline (9-8-8 hotline) program to address cybersecurity vulnerabilities and report incidents. It mandates that the program’s network administrator and participating local crisis centers must report identified security weaknesses or cyber incidents to federal officials within a reasonable time, while protecting user privacy. The law also requires a study by the Comptroller General within 180 days to evaluate cybersecurity risks specific to the 9-8-8 system. These changes directly affect the federally funded 9-8-8 hotline program and its local crisis centers.
HR 4579, the FEMA Cybersecurity Improvement Act, amends the Homeland Security Act of 2002 to require the Federal Emergency Management Agency (FEMA) to specifically address cybersecurity risks that could disrupt its operations. The bill adds a new requirement for FEMA to mitigate these risks, as defined in another section of law, and mandates that FEMA, working with the Cybersecurity and Infrastructure Security Agency (CISA), submit an annual report to Congress detailing progress on these efforts. This bill directly affects FEMA's internal operations and cybersecurity planning, with CISA providing consultation. It does not create new funding or alter FEMA's core mission but updates existing security protocols to explicitly include cybersecurity risk mitigation.
HR 2594 establishes a Water Risk and Resilience Organization (WRRO), certified by the EPA Administrator, to develop and enforce cybersecurity standards for large water systems. It directly affects community water systems serving 3,300+ people or similar treatment works, requiring them to meet WRRO-developed cybersecurity risk and resilience requirements. The WRRO proposes these standards, which the EPA must approve within 90 days if deemed reasonable, and monitors compliance through annual self-attestations and 5-year third-party assessments. The bill creates a process for penalties (up to $25,000/day) for noncompliance, with appeals to the EPA, while ensuring state authority remains intact.
HR 872 requires federal contractors with contracts above $250,000 or those handling federal information systems to implement vulnerability disclosure policies aligned with NIST guidelines and international standards (like ISO 29147). Within 180 days, the OMB and agencies must update the Federal Acquisition Regulation (FAR) and Defense FAR (DFARS) to mandate these policies, ensuring contractors disclose security vulnerabilities in systems they manage for the government. The bill allows limited waivers for national security or research, requiring congressional notification within 30 days. It directly affects major federal contractors, aiming to standardize how security flaws are reported and addressed across government contracts.
This bill amends the Small Business Act to require the Small Business Administration (SBA) to provide guidance and support to small businesses on using artificial intelligence (AI). Specifically, it adds a new provision directing the SBA to help small businesses evaluate AI for operations - including best practices, planning for disruptions, protecting data and intellectual property, improving cybersecurity, and ensuring regulatory compliance. The guidance will include training and outreach on integrating AI into business workflows. The bill does not authorize new funding for these activities.
This bill requires the National Institute of Standards and Technology (NIST) to develop guidance for upgrading federal and critical infrastructure systems to quantum-resistant encryption (post-quantum cryptography) within 180 days. It mandates a National Quantum Cybersecurity Upgrade Strategy for federal agencies within 360 days, including risk assessments and performance metrics for prioritizing upgrades. The bill also establishes a voluntary pilot program to support high-risk entities (like critical infrastructure operators and federal agencies) in testing quantum-resistant system upgrades, with annual reporting to Congress. It directly affects federal agencies, critical infrastructure sectors (such as energy and finance), and private sector entities through NIST guidance. The focus is on concrete policy actions to prepare systems for future quantum computing threats.
This bill creates a legal framework for cloud storage providers to securely store and share digital evidence of child sexual abuse material (CSAM) used in law enforcement investigations. It designates "approved vendors" (cloud companies contracted by U.S. law enforcement) and grants them limited civil/criminal liability protection when following strict cybersecurity protocols, such as using NIST standards, end-to-end encryption, and annual audits. The bill requires all CSAM evidence stored via approved vendors to remain within the U.S., mandates detailed notification procedures to the Department of Justice, and sets requirements for evidence retention and transfer. It directly affects cloud storage companies working with law enforcement agencies and ensures their services meet rigorous security and privacy standards during investigations.
