This bill restricts access to Treasury payment systems (including the Bureau of the Fiscal Service) to only Treasury employees with a "fully successful" performance rating and at least one year of civil service, or contractors/outsiders with security clearances, required privacy/cybersecurity training, ethics agreements, and no conflicts of interest. It treats non-government users accessing these systems as government employees for ethics rules and defines specific actions (like stopping payments) as "personal and substantial participation" in government matters. The Treasury Inspector General must investigate any unauthorized access within 30 days and report to Congress, detailing the breach, security risks, and any halted payments. The bill directly affects Treasury staff, contractors, and any external entities accessing federal payment systems.
This bill requires the Secretary of Homeland Security to publicly release the full unclassified report titled "U.S. Telecommunications Insecurity 2022" within 30 days of the bill's enactment. The report was prepared for the Cybersecurity and Infrastructure Security Agency (CISA) under a DHS contract. This mandates transparency about the findings of that specific report, directly affecting DHS and CISA by requiring them to make the document publicly available. The bill focuses solely on the disclosure of the existing report, not on new security measures or policy changes.
This bill requires the Bureau of Industry and Security (BIS) to modernize its outdated information technology systems by 2030, focusing on streamlining export license reviews and enhancing national security monitoring. Key provisions include replacing legacy systems with a unified platform for case management, adopting advanced data analytics tools to track military-related trade patterns, and improving data sharing with industry and government partners. It directly affects BIS operations, industry stakeholders using export systems, and federal agencies collaborating on security enforcement. The bill authorizes $25 million annually (2026-2029) for this modernization, aiming to reduce manual processing, strengthen cybersecurity, and improve efficiency in reviewing entities on the Entity List.
The Federal Cyber Workforce Training Act of 2025 establishes a Federal Institute to train federal employees in cybersecurity roles and human resources staff managing cybersecurity positions. The Institute will develop role-specific training modules - including hands-on exercises and assessments - based on the NICE cybersecurity framework, offering both in-person and virtual options without requiring a cybersecurity degree. The National Cyber Director must submit a detailed implementation plan to Congress within 180 days, and the Institute will operate without new funding, leveraging existing federal resources. This training aims to enhance skills for entry-level cybersecurity roles, support mid-career transitions, and improve hiring practices for federal cybersecurity personnel.
HR 2659 creates a federal task force to address cyber threats from China's state-sponsored actors, specifically targeting groups like Volt Typhoon identified in a 2024 CISA advisory. The task force, led by CISA and FBI directors, coordinates federal agencies responsible for critical infrastructure security to detect and respond to cyberattacks. It must produce annual reports - including classified assessments of infrastructure risks and recommendations - to Congress within 540 days of formation and for five years after. These reports will guide federal efforts to protect critical infrastructure (like energy grids and transportation systems) and inform owners/operators through a public awareness campaign.
This bill requires the National Suicide Prevention Lifeline (9-8-8 hotline) program to address cybersecurity vulnerabilities and report incidents. It mandates that the program’s network administrator and participating local crisis centers must report identified security weaknesses or cyber incidents to federal officials within a reasonable time, while protecting user privacy. The law also requires a study by the Comptroller General within 180 days to evaluate cybersecurity risks specific to the 9-8-8 system. These changes directly affect the federally funded 9-8-8 hotline program and its local crisis centers.
HR 4579, the FEMA Cybersecurity Improvement Act, amends the Homeland Security Act of 2002 to require the Federal Emergency Management Agency (FEMA) to specifically address cybersecurity risks that could disrupt its operations. The bill adds a new requirement for FEMA to mitigate these risks, as defined in another section of law, and mandates that FEMA, working with the Cybersecurity and Infrastructure Security Agency (CISA), submit an annual report to Congress detailing progress on these efforts. This bill directly affects FEMA's internal operations and cybersecurity planning, with CISA providing consultation. It does not create new funding or alter FEMA's core mission but updates existing security protocols to explicitly include cybersecurity risk mitigation.
HR 2594 establishes a Water Risk and Resilience Organization (WRRO), certified by the EPA Administrator, to develop and enforce cybersecurity standards for large water systems. It directly affects community water systems serving 3,300+ people or similar treatment works, requiring them to meet WRRO-developed cybersecurity risk and resilience requirements. The WRRO proposes these standards, which the EPA must approve within 90 days if deemed reasonable, and monitors compliance through annual self-attestations and 5-year third-party assessments. The bill creates a process for penalties (up to $25,000/day) for noncompliance, with appeals to the EPA, while ensuring state authority remains intact.
HR 872 requires federal contractors with contracts above $250,000 or those handling federal information systems to implement vulnerability disclosure policies aligned with NIST guidelines and international standards (like ISO 29147). Within 180 days, the OMB and agencies must update the Federal Acquisition Regulation (FAR) and Defense FAR (DFARS) to mandate these policies, ensuring contractors disclose security vulnerabilities in systems they manage for the government. The bill allows limited waivers for national security or research, requiring congressional notification within 30 days. It directly affects major federal contractors, aiming to standardize how security flaws are reported and addressed across government contracts.
This bill amends the Small Business Act to require the Small Business Administration (SBA) to provide guidance and support to small businesses on using artificial intelligence (AI). Specifically, it adds a new provision directing the SBA to help small businesses evaluate AI for operations - including best practices, planning for disruptions, protecting data and intellectual property, improving cybersecurity, and ensuring regulatory compliance. The guidance will include training and outreach on integrating AI into business workflows. The bill does not authorize new funding for these activities.
