SenateS. 4728119th Congress
Combat Emerging Threats to Critical Infrastructure Act of 2026
Full Text
Official text as published. Use Ctrl+F / Cmd+F to search within the document.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4728 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 4728
To require the Director of the Cybersecurity and Infrastructure
Security Agency to work with Sector Risk Management Agencies to update
sector-specific plans, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
June 10, 2026
Mr. Warner introduced the following bill; which was read twice and
referred to the Committee on Homeland Security and Governmental Affairs
_______________________________________________________________________
A BILL
To require the Director of the Cybersecurity and Infrastructure
Security Agency to work with Sector Risk Management Agencies to update
sector-specific plans, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Combat Emerging Threats to Critical
Infrastructure Act of 2026''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given that term in section 5002
of the National Artificial Intelligence Initiative Act of 2020
(15 U.S.C. 9401).
(2) Digital asset.--The term ``digital asset'' has the
meaning given that term in section 2 of the GENIUS Act (12
U.S.C. 5901).
(3) Director.--The term ``Director'' means the Director of
the Cybersecurity and Infrastructure Security Agency.
(4) National security memorandum 22.--The term ``National
Security Memorandum 22'' means the National Security Memorandum
on Critical Infrastructure and Resilience (NSM-22), issued
April 30, 2024.
(5) Sector risk management agency.--The term ``Sector Risk
Management Agency'' has the meaning given that term in section
2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
SEC. 3. SECTOR RISK MANAGEMENT AGENCY SECTOR-SPECIFIC PLANS.
(a) Update of Sector-Specific Plans.--Not later than 1 year after
the date of enactment of this Act, the Director shall update the
sector-specific plans for--
(1) the Chemical Sector, as that term is used in National
Security Memorandum 22;
(2) the Commercial Facilities Sector, as that term is used
in National Security Memorandum 22;
(3) the Communications Sector, as that term is used in
National Security Memorandum 22;
(4) the Critical Manufacturing Sector, as that term is used
in National Security Memorandum 22;
(5) the Dams Sector, as that term is used in National
Security Memorandum 22;
(6) the Defense Industrial Base Sector, as that term is
used in National Security Memorandum 22;
(7) the Emergency Services Sector, as that term is used in
National Security Memorandum 22;
(8) the Energy Sector, as that term is used in National
Security Memorandum 22;
(9) the Financial Services Sector, as that term is used in
National Security Memorandum 22;
(10) the Food and Agriculture Sector, as that term is used
in National Security Memorandum 22;
(11) the Government Services and Facilities Sector, as that
term is used in National Security Memorandum 22;
(12) the Healthcare and Public Health Sector, as that term
is used in National Security Memorandum 22;
(13) the Information Technology Sector, as that term is
used in National Security Memorandum 22;
(14) the Nuclear Reactors, Materials, and Waste Sector, as
that term is used in National Security Memorandum 22;
(15) the Transportation Systems Sector, as that term is
used in National Security Memorandum 22; and
(16) the Water and Wastewater Sector, as that term is used
in National Security Memorandum 22.
(b) Technology-Facilitated Threats.--In carrying out subsection
(a)--
(1) each sector-specific plan shall incorporate sector-
specific risk management practices to address risks exacerbated
or facilitated by disruptive technologies, such as artificial
intelligence, including--
(A) malicious activity, sabotage, or efforts to
otherwise clandestinely degrade artificial intelligence
systems or the supply chain of an artificial
intelligence system, including training or test data,
frameworks or software libraries, training or inference
computing environments, or other components necessary
for the training, management, or maintenance of an
artificial intelligence system used by an owner or
operator of critical infrastructure;
(B) malicious activity leveraging artificial
intelligence capabilities for computer network
exploitation campaigns directed at the networks of
owners and operators of critical infrastructure;
(C) risks and mitigations associated with the
deployment of cloud-based architecture, robotics, and
zero trust principles (as defined in NIST Special
Publication 800-207 or any successor publication);
(D) evolving risks associated with social
engineering techniques and digitally manipulated or
digitally generated images, audio, video, or text
documents; and
(E) interagency and public-private information and
threat intelligence sharing functions dependent on the
organization, funding, and expertise of agencies (as
defined in section 4101 of title 5, United States
Code); and
(2) with respect to the sector-specific plan for the
Financial Services Sector pursuant to subsection (a)(9), the
Director shall coordinate with the Secretary of the Treasury to
develop a process to determine digital asset vulnerabilities
relating to cryptographic risks resulting from quantum
computing.
(c) Interagency Coordination.--In carrying out subsection (a), the
Director shall coordinate with each relevant designated Sector Risk
Management Agency.
(d) Reports to Congress.--Not later than 30 days after the date on
which the Director completes the update of the sector-specific plans
required under subsection (a), the Director shall--
(1) inform and provide a copy of each sector-specific plan
to--
(A) the Committee on Homeland Security and
Governmental Affairs of the Senate;
(B) the Select Committee on Intelligence of the
Senate;
(C) the Committee on Homeland Security of the House
of Representatives; and
(D) the Permanent Select Committee on Intelligence
of the House of Representatives;
(2) inform and provide a copy of the sector-specific plan
for the Defense Industrial Base Sector updated pursuant to
subsection (a)(6) to--
(A) the Committee on Armed Services of the Senate;
and
(B) the Committee on Armed Services of the House of
Representatives;
(3) inform and provide a copy of the sector-specific plan
for the Energy Sector updated pursuant to subsection (a)(8)
to--
(A) the Committee on Energy and Natural Resources
of the Senate; and
(B) the Committee on Energy and Commerce of the
House of Representatives;
(4) inform and provide a copy of the sector-specific plan
for the Financial Services Sector updated pursuant to
subsection (a)(9) to--
(A) the Committee on Finance of the Senate; and
(B) the Committee on Financial Services of the
House of Representatives;
(5) inform and provide a copy of the sector-specific plan
for the Food and Agriculture Sector updated pursuant to
subsection (a)(10) to--
(A) the Committee on Agriculture, Nutrition, and
Forestry of the Senate;
(B) the Committee on Health, Education, Labor, and
Pensions of the Senate;
(C) the Committee on Finance of the Senate;
(D) the Committee on Agriculture of the House of
Representatives;
(E) the Committee on Energy and Commerce of the
House of Representatives; and
(F) the Committee on Ways and Means of the House of
Representatives;
(6) inform and provide a copy of the sector-specific plan
for the Government Services and Facilities Sector updated
pursuant to subsection (a)(11) to--
(A) the Committee on Environment and Public Works
of the Senate;
(B) the Committee on Oversight and Government
Reform of the House of Representatives; and
(C) the Committee on Transportation and
Infrastructure of the House of Representatives;
(7) inform and provide a copy of the sector-specific plan
for the Healthcare and Public Health Sector updated pursuant to
subsection (a)(12) to--
(A) the Committee on Health, Education, Labor, and
Pensions of the Senate;
(B) the Committee on Finance of the Senate;
(C) the Committee on Energy and Commerce of the
House of Representatives; and
(D) the Committee on Ways and Means of the House of
Representatives;
(8) inform and provide a copy of the sector-specific plan
for the Transportation Systems Sector updated pursuant to
subsection (a)(15) to--
(A) the Committee on Commerce, Science, and
Transportation of the Senate; and
(B) the Committee on Transportation and
Infrastructure of the House of Representatives; and
(9) inform and provide a copy of the sector-specific plan
for the Water and Wastewater Sector updated pursuant to
subsection (a)(16) to--
(A) the Committee on Environment and Public Works
of the Senate; and
(B) the Committee on Transportation and
Infrastructure of the House of Representatives.
SEC. 4. BIENNIAL REASSESSMENT.
(a) In General.--Not later than 2 years after the date on which the
Director completes the update of the sector-specific plans required
under section 3(a), and not less frequently than once every 2 years
thereafter, the Director shall--
(1) conduct a reassessment of each sector-specific plan;
and
(2) issue revised sector-specific plans.
(b) Notification to Congress.--Not later than 30 days after the
date on which the Director completes each update of the sector-specific
plans required under subsection (a), the Director shall inform and
provide copies of each sector-specific plan to the relevant committees
of Congress in the manner prescribed under section 3(d).
<all>