Bill > HR10671

This bill, titled the Securing Our Critical Infrastructure Act, updates and makes permanent a temporary program run by the Cybersecurity and Infrastructure Security Agency—a federal agency responsible for protecting the nation's critical infrastructure from cyber threats—by expanding its focus from just ransomware attacks to general security vulnerabilities affecting information systems. Under the updated program, specific "covered utilities," which the bill defines primarily as smaller water and wastewater systems serving up to 100,000 individuals as well as certain other public water and treatment facilities, will be automatically enrolled in federal cyber hygiene services designed to scan and secure their networks, though they are allowed to opt out. Additionally, the legislation directs the agency to provide direct incident response help if one of these utilities suffers a cyber attack, requires coordination with the Environmental Protection Agency, sets a five-year expiration date for the program, and protects any sensitive information or personal data shared by these utilities from being made public through federal or state freedom of information laws.