What This Bill Does
This bill requires the establishment of a public online clearinghouse focused on cybersecurity resources for the food and agriculture industry. The clearinghouse will be created in the National Telecommunications and Information Administration, which is part of the Department of Commerce. The bill also requires an independent study to examine how the federal government can improve cybersecurity protections for farms, food processors, and related businesses.
##
Who It Affects
- The National Telecommunications and Information Administration (the agency that creates and maintains the clearinghouse)
- Food and agriculture businesses, including farms, ranchers, growers, food processors and distributors
- Small business owners in agriculture and food production
- Equipment and software developers who create products for the agriculture industry
- Multiple federal agencies including the Department of Agriculture, Department of Homeland Security, and the Small Business Administration
- The Comptroller General of the United States (responsible for conducting the study)
##
Key Provisions
- The Assistant Secretary of Commerce for Communications and Information must establish the clearinghouse no later than 180 days after the law passes and make it available online to the public (Sec. 2(a)(1)(A))
- The clearinghouse must contain current and publicly available cybersecurity resources, recommendations for the food and agriculture industry, and a way for individuals and businesses to request in-person or virtual cybersecurity support from federal agencies (Sec. 2(a)(1)(B))
- The clearinghouse must include a Frequently Asked Questions section updated at least annually with the top 20 most commonly asked cybersecurity questions for the food and agriculture industry (Sec. 2(a)(1)(B)(iv))
- The clearinghouse must include materials specifically designed to help small businesses and non-technical users understand critical cybersecurity protections, including guidance on responding to ransomware attacks (Sec. 2(a)(1)(B)(v))
- The Assistant Secretary, working with the Farm Service Agency and other federal agencies, must consolidate cybersecurity best practices from both public and private sectors into voluntary recommendations addressing risk-based engineering, system recovery planning, protection against unauthorized access, and ransomware response procedures (Sec. 2(a)(2))
- The Comptroller General must conduct a study and submit a report to Congress within 90 days examining federal government efforts to improve food and agriculture cybersecurity, available resources, federal agency coordination, plans to prevent coordinated attacks, and the advantages and disadvantages of creating a food and agriculture-specific Information Sharing and Analysis Center (Sec. 2(b)(2))
##
What Changes
If this bill becomes law, the federal government will establish and maintain a publicly accessible online resource center dedicated to cybersecurity guidance for farmers, food producers, and related businesses. Small agricultural businesses will have access to federal cybersecurity support and simplified guidance materials designed for non-technical users. The federal government will also complete a comprehensive study evaluating its current cybersecurity efforts for the agriculture industry and analyzing whether new structures like a dedicated Information Sharing and Analysis Center should be created.
##
Important Definitions
- **Food and Agriculture Industry**: Equipment and systems used in food and agriculture supply chains (such as computer vision algorithms for precision agriculture and grain silos), food and agriculture goods processors, growers, and distributors, and information technology systems of businesses engaged in farming, ranching, planting, harvesting, food storage, genetic modification, or the design or production of agrochemicals and agriculture tools (Sec. 2(c)(4))
- **Assistant Secretary**: The Assistant Secretary of Commerce for Communications and Information (Sec. 2(c)(1))
- **NTIA**: The National Telecommunications and Information Administration (Sec. 2(c)(6))
- **Small Business Concern**: A small business as described in the Small Business Act (Sec. 2(c)(9))
- **Software Bill of Materials**: The definition given in Executive Order 14028 relating to improving the nation's cybersecurity (Sec. 2(c)(10))
- **Cybersecurity Risk, Cybersecurity Threat, Incident, Sector Risk Management Agency, and Security Vulnerability**: These terms have the meanings given in section 2200 of the Homeland Security Act of 2002 (Sec. 2(c)(2), (3), (5), (7), (8))
##
Effective Date
Not specified in bill text. However, the clearinghouse must be established no later than 180 days after the law is enacted, and the Comptroller General's report must be submitted within 90 days of enactment. The law expires 7 years after the date of enactment (Sec. 2(d)).
I
118TH CONGRESS
1ST SESSION H. R. 1219
To establish a food and agriculture cybersecurity clearinghouse in the National
Telecommunications and Information Administration, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
FEBRUARY 27, 2023
Mr. PFLUGER (for himself, Mr. VEASEY, Mr. CURTIS, and Ms. MATSUI) intro-
duced the following bill; which was referred to the Committee on Energy
and Commerce, and in addition to the Committee on Agriculture, for a
period to be subsequently determined by the Speaker, in each case for
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned
A BILL
To establish a food and agriculture cybersecurity clearing-
house in the National Telecommunications and Informa-
tion Administration, and for other purposes.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Food and Agriculture
4
Industry Cybersecurity Support Act’’.
5
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
2
•HR 1219 IH
SEC. 2. NTIA FOOD AND AGRICULTURE CYBERSECURITY
1
CLEARINGHOUSE.
2
(a) NTIA FOOD AND AGRICULTURE CYBERSECURITY
3
CLEARINGHOUSE.—
4
(1) ESTABLISHMENT.—
5
(A) IN
GENERAL.—Not later than 180
6
days after the date of the enactment of this
7
Act, the Assistant Secretary shall establish in
8
the NTIA a food and agriculture cybersecurity
9
clearinghouse (in this section referred to as the
10
‘‘clearinghouse’’).
11
(B) REQUIREMENTS.—The clearinghouse
12
shall—
13
(i) be publicly available online;
14
(ii) contain current, relevant, and
15
publicly available food and agriculture in-
16
dustry focused cybersecurity resources, in-
17
cluding the recommendations described in
18
paragraph (2), and any other appropriate
19
materials for reference by entities that de-
20
velop products with potential security
21
vulnerabilities for the food and agriculture
22
industry;
23
(iii) contain a mechanism for individ-
24
uals or entities in the food and agriculture
25
industry to request in-person or virtual
26
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
3
•HR 1219 IH
support from the NTIA or, if appropriate,
1
a cooperating agency for cybersecurity re-
2
lated issues;
3
(iv) contain a Frequently Asked Ques-
4
tions (FAQ) section, updated at least an-
5
nually, with answers to the top 20 most
6
frequently asked questions relevant to the
7
cybersecurity of the food and agriculture
8
industry; and
9
(v)
include
materials
specifically
10
aimed at assisting small business concerns
11
and non-technical users in the food and ag-
12
riculture industry with critical cybersecu-
13
rity protections related to the food and ag-
14
riculture industry, including recommenda-
15
tions on how to respond to a ransomware
16
attack and resources for additional infor-
17
mation, including the ‘‘Stop Ransomware’’
18
site hosted by the Cybersecurity and Infra-
19
structure Security Agency of the Depart-
20
ment of Homeland Security.
21
(C) EXISTING PLATFORM OR WEBSITE.—
22
The Assistant Secretary may establish the
23
clearinghouse on an online platform or a
24
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
4
•HR 1219 IH
website that is in existence as of the date of the
1
enactment of this Act.
2
(2) CONSOLIDATION
OF
FOOD
AND
AGRI-
3
CULTURE INDUSTRY CYBERSECURITY RECOMMENDA-
4
TIONS.—
5
(A) IN
GENERAL.—The Assistant Sec-
6
retary, in consultation with the Administrator
7
of the Farm Service Agency of the Department
8
of Agriculture and relevant Sector Risk Man-
9
agement Agencies, shall consolidate public and
10
private sector best practices to produce a set of
11
voluntary cybersecurity recommendations relat-
12
ing to the development, maintenance, and oper-
13
ation of the food and agriculture industry.
14
(B) REQUIREMENTS.—The recommenda-
15
tions consolidated under subparagraph (A) shall
16
include, to the greatest extent practicable, ma-
17
terials addressing the following:
18
(i) Risk-based, cybersecurity-informed
19
engineering, including continuous moni-
20
toring and resiliency.
21
(ii) Planning for retention or recovery
22
of positive control of systems in the food
23
and agriculture industry in the event of a
24
cybersecurity incident.
25
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
5
•HR 1219 IH
(iii) Protection against unauthorized
1
access to critical functions of the food and
2
agriculture industry.
3
(iv) Cybersecurity against threats to
4
products of the food and agriculture indus-
5
try throughout the lifetimes of such prod-
6
ucts.
7
(v) How businesses in the food and
8
agriculture industry should respond to
9
ransomware attacks, including details on
10
the legal obligations of such businesses in
11
the event of such an attack, including re-
12
porting requirements and Federal re-
13
sources for support.
14
(vi) Any other recommendations to
15
ensure the confidentiality, availability, and
16
integrity of data residing on or in transit
17
through systems in the food and agri-
18
culture industry.
19
(3) IMPLEMENTATION.—In implementing this
20
subsection, the Assistant Secretary shall—
21
(A) to the extent practicable, consult with
22
the private sector;
23
(B) consult with non-Federal entities de-
24
veloping equipment and systems utilized in the
25
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
6
•HR 1219 IH
food and agriculture industry, including private,
1
consensus organizations that develop relevant
2
standards;
3
(C) consult with the Director of the Cyber-
4
security and Infrastructure Security Agency of
5
the Department of Homeland Security;
6
(D) consult with food and agriculture in-
7
dustry trade groups;
8
(E) consult with relevant Sector Risk Man-
9
agement Agencies;
10
(F) consult with civil society organizations;
11
(G) consult with the Administrator of the
12
Small Business Administration; and
13
(H) consider the development of an advi-
14
sory board to advise the Assistant Secretary on
15
implementing this subsection, including the col-
16
lection of data through the clearinghouse and
17
the disclosure of such data.
18
(b) STUDY.—
19
(1) IN GENERAL.—The Comptroller General of
20
the United States shall conduct a study on the ac-
21
tions the Federal Government has taken or may
22
take to improve the cybersecurity of the food and
23
agriculture industry.
24
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
7
•HR 1219 IH
(2) REPORT.—Not later than 90 days after the
1
date of the enactment of this Act, the Comptroller
2
General of the United States shall submit to Con-
3
gress a report on the study conducted under para-
4
graph (1), which shall include information on the
5
following:
6
(A) The effectiveness of efforts of the Fed-
7
eral Government to improve the cybersecurity of
8
the food and agriculture industry.
9
(B) The resources made available to the
10
public, as of the date of such submission, by
11
Federal agencies to improve the cybersecurity
12
of the food and agriculture industry, including
13
to address cybersecurity risks and cybersecurity
14
threats to the food and agriculture industry.
15
(C) The extent to which Federal agencies
16
coordinate or duplicate authorities and take
17
other actions for the improvement of the cyber-
18
security of the food and agriculture industry.
19
(D) Whether there is an appropriate plan
20
in place to prevent or adequately mitigate the
21
risks of a coordinated attack on the food and
22
agriculture industry.
23
(E) The advantages and disadvantages of
24
creating a food and agriculture industry specific
25
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
8
•HR 1219 IH
Information Sharing and Analysis Center
1
(ISAC), including required actions by the Fed-
2
eral Government and expected costs to the Fed-
3
eral Government to create such an organization
4
and potential industry and civil society partners
5
who could operate such an organization.
6
(F) The advantages and disadvantages of
7
the creation by the Assistant Secretary of a
8
database containing a software bill of materials
9
(SBOM) for the most common internet-con-
10
nected hardware and software applications used
11
in the food and agriculture industry and rec-
12
ommendations for how the Assistant Secretary
13
can maintain and update such database.
14
(3) COORDINATION.—In carrying out para-
15
graphs (1) and (2), the Comptroller General of the
16
United States shall coordinate with appropriate Fed-
17
eral agencies, including the following:
18
(A) The Department of Health and
19
Human Services.
20
(B) The Department of Commerce.
21
(C) The Department of Agriculture.
22
(D) The Federal Communications Commis-
23
sion.
24
(E) The Department of Energy.
25
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
9
•HR 1219 IH
(F) The Small Business Administration.
1
(4) PROCESS
FOR
STUDYING
CREATION
OF
2
ISAC.—In studying the advantages and disadvan-
3
tages of creating a food and agriculture industry
4
specific Information Sharing and Analysis Center for
5
purposes of including in the report required by para-
6
graph (2) the information required by subparagraph
7
(E) of such paragraph, the Comptroller General
8
shall convene stakeholders that include civil society
9
organizations, individual food and agriculture pro-
10
ducers, and the Federal agencies described in para-
11
graph (3).
12
(5) BRIEFING.—Not later than 90 days after
13
the date on which the Comptroller General of the
14
United States submits the report under paragraph
15
(2), the Comptroller General shall provide to Con-
16
gress a briefing regarding such report.
17
(6) CLASSIFICATION.—The report under para-
18
graph (2) shall be unclassified but may include a
19
classified annex.
20
(c) DEFINITIONS.—In this section:
21
(1) ASSISTANT SECRETARY.—The term ‘‘Assist-
22
ant Secretary’’ means the Assistant Secretary of
23
Commerce for Communications and Information.
24
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
10
•HR 1219 IH
(2) CYBERSECURITY RISK.—The term ‘‘cyberse-
1
curity risk’’ has the meaning given such term in sec-
2
tion 2200 of the Homeland Security Act of 2002 (6
3
U.S.C. 650).
4
(3) CYBERSECURITY THREAT.—The term ‘‘cy-
5
bersecurity threat’’ has the meaning given such term
6
in section 2200 of the Homeland Security Act of
7
2002 (6 U.S.C. 650).
8
(4) FOOD AND AGRICULTURE INDUSTRY.—The
9
term ‘‘food and agriculture industry’’ means—
10
(A) equipment and systems utilized in the
11
food and agriculture supply chain, such as com-
12
puter vision algorithms for precision agri-
13
culture, grain silos, and related food and agri-
14
culture storage infrastructure;
15
(B) food and agriculture goods processors,
16
growers, and distributors; and
17
(C) information technology systems of
18
businesses engaged in farming, ranching, plant-
19
ing, harvesting, food and agriculture product
20
storage, food or animal genetic modification,
21
the design or production of agrochemicals, or
22
the design or production of food and agriculture
23
tools.
24
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
11
•HR 1219 IH
(5) INCIDENT.—The term ‘‘incident’’ has the
1
meaning given such term in section 2200 of the
2
Homeland Security Act of 2002 (6 U.S.C. 650).
3
(6) NTIA.—The term ‘‘NTIA’’ means the Na-
4
tional Telecommunications and Information Admin-
5
istration.
6
(7) SECTOR RISK MANAGEMENT AGENCY.—The
7
term ‘‘Sector Risk Management Agency’’ has the
8
meaning given such term in section 2200 of the
9
Homeland Security Act of 2002 (6 U.S.C. 650).
10
(8) SECURITY VULNERABILITY.—The term ‘‘se-
11
curity vulnerability’’ has the meaning given such
12
term in section 2200 of the Homeland Security Act
13
of 2002 (6 U.S.C. 650).
14
(9) SMALL
BUSINESS
CONCERN.—The term
15
‘‘small business concern’’ means a small business
16
concern described in section 3 of the Small Business
17
Act (15 U.S.C. 632).
18
(10) SOFTWARE
BILL
OF
MATERIALS.—The
19
term ‘‘software bill of materials’’ has the meaning
20
given such term in section 10 of Executive Order
21
14028 (86 Fed. Reg. 26633; relating to improving
22
the Nation’s cybersecurity).
23
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
12
•HR 1219 IH
(d) SUNSET.—This section shall have no force or ef-
1
fect after the date that is 7 years after the date of the
2
enactment of this Act.
3
Æ
VerDate Sep 11 2014
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6301
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS