Sponsor
Bennie Thompson
Representative · D-MS
Representative · D-MS
The bill improves FEMA/CISA's ability to provide timely cybersecurity guidance and oversight to protect operations and critical infrastructure, at the cost of added compliance pressure and administrative burdens for private, state/local, and federal entities.
Federal agencies, state governments, and critical infrastructure operators (e.g., utilities) will receive FEMA/CISA-developed guidance to mitigate cyber risks that could disrupt FEMA operations, improving operational continuity and resilience.
Federal employees and state governments can obtain FEMA/CISA guidance without a temporal restriction, and Congress will receive a required progress report within one year, enabling more timely cybersecurity assistance and greater transparency/oversight of mitigation efforts.
Private-sector entities (including utilities and nonprofits) and state/local governments may face new compliance expectations or pressure to align with federal guidance, increasing operational costs and straining budgets.
Preparing the guidance and the required progress report will add administrative workload for FEMA and CISA staff that could divert limited resources from other operational cybersecurity and emergency-response tasks.
Based on analysis of 2 sections of legislative text.
Requires FEMA and CISA to produce private-sector guidance to mitigate cybersecurity risks that could impede federal agency operations and report progress to Congress within one year.
Official title: To amend the Homeland Security Act of 2002 to provide for the mitigation of cybersecurity risks by the Federal Emergency Management Agency, and for other purposes.
Introduced July 21, 2025 by Bennie Thompson · Last progress July 21, 2025
Requires FEMA and CISA to develop guidance for the private sector to mitigate cybersecurity risks that could impede federal agency operations, removes a dated phrase limiting the authority, and directs FEMA (with CISA) to report to relevant congressional committees within one year on progress implementing that new guidance.