IC Oversight & Policy — 2026-09-27

Congress Proposes Legislation for CISA to Defend Biotechnology as Critical Infrastructure

BLUFPassage before Congress adjourns in January 2027 is very unlikely, leaving biotech firms without mandatory cyber disclosure obligations and CISA without new authority over genomic and biometric data systems.

A bipartisan, bicameral group of lawmakers introduced two bills on September 24 to direct CISA to protect biotechnology, biomanufacturing and biological data as critical infrastructure, according to the National Security Commission on Emerging Biotechnology 1. Senate sponsors are Todd Young (R-IN) and Maggie Hassan (D-NH), with House sponsors Stephanie Bice (R-OK), Ro Khanna (D-CA) and Scott Peters (D-CA) 1. The Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act would direct DHS to develop protection plans without creating a new standalone sector, while the Protecting Biological Data Act would designate systems holding genomic sequences and biometric data as critical infrastructure and add CISA personnel for biometric-data security 2. CyberScoop reported the bills follow recent disclosed cyberattacks on biotech firms Boston Scientific and Amgen 2, and Digital Watch Observatory noted the measures draw on recommendations from the Commission's April 2025 report to Congress 3.

Analysis
Enactment would hand CISA statutory authority over a sector now split across health, agriculture and industrial designations, compelling biotech and biomanufacturing operators into mandatory outreach, planning and biometric-data security requirements they can currently decline. Passage before the current Congress adjourns by January 3, 2027 is very unlikely, given introduction without a scheduled committee markup and a crowded legislative calendar. That judgment carries moderate confidence, reflecting consistent sponsor messaging across chambers but no observable indicator of committee scheduling or leadership prioritization. Sourcing rests on the sponsoring commission's own release, with CyberScoop and Digital Watch Observatory converging on the same details without independent corroboration. The dual-bill rollout may instead function primarily as a marker advancing the Commission's April 2025 recommendations rather than a genuine near-term push. Absent floor action, biotech firms retain discretion over cyber incident disclosure, and DHS gains no grounds to budget or staff a dedicated biotech liaison function this cycle.

3 sources

New Bills Designate Biotechnology, Biomanufacturing, and Biological Data as Critical Infrastructure - National Security Commission on Emerging Biotechnology (Senate)
House and Senate members propose legislation for CISA to step up cyber defenses for biotech - CyberScoop
Biotech: US House and Senate propose 2 bills for CISA to step up the protection of biotechnology infrastructure - Digital Watch Observatory