Introduced in Senate

[Congressional Bills 119th Congress] [From the U.S. Government Publishing Office] [S. 5502 Introduced in Senate (IS)] 119th CONGRESS 2d Session S. 5502 To amend the Homeland Security Act of 2002 to provide for the protection of biotechnology and biomanufacturing infrastructure by the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes. _______________________________________________________________________ IN THE SENATE OF THE UNITED STATES September 24, 2026 Ms. Hassan (for herself and Mr. Young) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs _______________________________________________________________________ A BILL To amend the Homeland Security Act of 2002 to provide for the protection of biotechnology and biomanufacturing infrastructure by the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes. Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

SECTION 1. SHORT TITLE. This Act may be cited as the ``Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act''.

SEC. 2. BIOTECHNOLOGY AND BIOMANUFACTURING INFRASTRUCTURE.

SEC. 2. BIOTECHNOLOGY AND BIOMANUFACTURING INFRASTRUCTURE. (a) In General.--Section 2202 of the Homeland Security Act of 2002 (6 U.S.C. 652) is amended-- (1) in subsection (c)-- (A) in paragraph (2), by inserting ``and biotechnology and biomanufacturing infrastructure owners and operators'' after ``international entities''; (B) in paragraph (5), by inserting before the semicolon the following: ``, and with respect to critical infrastructure, including biotechnology and biomanufacturing infrastructure, with no designated Sector-Specific Agency, designate staff of the Agency to provide those analyses, expertise, and other technical assistance''; (C) in paragraph (10), by inserting before the semicolon the following: ``, and for critical infrastructure, including biotechnology and biomanufacturing infrastructure, with no designated Sector-Specific Agency, direct staff designated in accordance with paragraph (5) to carry out that outreach and engagement, including, as appropriate, convening relevant Sector-Specific Agencies''; (D) in paragraph (13), by striking ``and'' after the semicolon; (E) by redesignating paragraph (14) as paragraph (15); and (F) by inserting after paragraph (13) the following new paragraph: ``(14) take such actions as may be necessary to ensure the protection of biotechnology and biomanufacturing infrastructure with no designated Sector-Specific Agency; and''; and (2) in subsection (e)(1)-- (A) in subparagraph (B), by adding at the end the following new sentence: ``With respect to critical infrastructure, including biotechnology and biomanufacturing infrastructure, with no designated Sector-Specific Agency, such assessments shall be carried out in coordination with existing relevant Information Sharing and Analysis Organizations, such as BIO-ISAC and H-ISAC, and industry member associations.''; and (B) in subparagraph (E)-- (i) by inserting ``biotechnology and biomanufacturing infrastructure,'' after ``emergency communications systems,''; and (ii) by adding at the end the following new sentence: ``Such comprehensive national plan shall be informed by the assessments required under subparagraph (B).''. (b) Reporting.-- (1) In general.--Not later than 45 days after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a work plan to protect biotechnology and biomanufacturing infrastructure. Such work plan shall include the following: (A) An identification of biotechnology and biomanufacturing infrastructure stakeholders, including Information Sharing and Analysis Organizations. (B) An outreach plan to ensure such stakeholders are aware, if applicable, of their protection under existing critical infrastructure sectors. (C) An action plan to ensure such stakeholders are represented at appropriate consortia and sector coordinating councils. (D) An action plan to update, by September 30, 2027, strategic plans under section 2202(e)(1)(E) of the Homeland Security Act of 2002 (6 U.S.C. 652(e)(1)(E)) with input from such stakeholders. (2) Implementation report.--Not later than 1 year after the submission of the work plan under paragraph (1), the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on the implementation of such work plan. (3) Report on the protection of emerging biotechnology as critical infrastructure.--Not later than the earlier of 2 years

after the submission of the work plan under paragraph (1), or the first evaluation and recommendation carried out pursuant to subsection (b)(2) of section 9002 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (6 U.S.C. 652a) that occurs after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report addressing whether there are any critical biotechnology areas that remain unprotected.