Official Summaries

Farm and Food Cybersecurity Act of 2025

This bill directs the Department of Agriculture (USDA) to (1) assess cybersecurity threats in the agriculture and food critical infrastructure sector, and (2) conduct annual crisis simulation exercises for food-related emergencies or disruptions. The agriculture and food critical infrastructure sector includes (1) any activity relating to the production, processing, distribution, storage, transportation, consumption, or disposal of agricultural or food products; and (2) any entity involved in any of these activities.

Specifically, USDA, in coordination with the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency, must conduct a risk assessment every two years on the cybersecurity threats to, and security vulnerabilities in, this sector. The risk assessment must include any recommendations for federal legislative or administrative actions to address related threats and vulnerabilities.

USDA must also conduct an annual simulation exercise relating to a food-related emergency or disruption in coordination with DHS, the Department of Health and Human Services (HHS), and the Office of the Director of National Intelligence (ODNI).

Among other things, the exercise must (1) involve a realistic and plausible scenario that simulates a food-related emergency or disruption that affects multiple sectors and jurisdictions, and (2) incorporate input from experts and stakeholders from various disciplines and sectors (e.g., agriculture, public health, emergency management, transportation, and energy). 

USDA, in consultation with DHS, HHS, and ODNI, must submit a report to Congress on each simulation exercise, including recommendations to enhance the cybersecurity and resilience of the agriculture and food critical infrastructure sector.

Current Full Text

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 754 Introduced in Senate (IS)]

<DOC>






119th CONGRESS
  1st Session
                                 S. 754

     To direct the Secretary of Agriculture to periodically assess 
 cybersecurity threats to, and vulnerabilities in, the agriculture and 
 food critical infrastructure sector and to provide recommendations to 
  enhance their security and resilience, to require the Secretary of 
   Agriculture to conduct an annual cross-sector simulation exercise 
   relating to a food-related emergency or disruption, and for other 
                               purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                           February 26, 2025

  Mr. Cotton (for himself, Ms. Slotkin, Mr. Ricketts, Mr. Tillis, Ms. 
Lummis, Mr. Budd, and Mrs. Britt) introduced the following bill; which 
was read twice and referred to the Committee on Agriculture, Nutrition, 
                              and Forestry

_______________________________________________________________________

                                 A BILL


 
     To direct the Secretary of Agriculture to periodically assess 
 cybersecurity threats to, and vulnerabilities in, the agriculture and 
 food critical infrastructure sector and to provide recommendations to 
  enhance their security and resilience, to require the Secretary of 
   Agriculture to conduct an annual cross-sector simulation exercise 
   relating to a food-related emergency or disruption, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Farm and Food Cybersecurity Act of 
2025''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Agriculture and food critical infrastructure sector.--
        The term ``agriculture and food critical infrastructure 
        sector'' means--
                    (A) any activity relating to the production, 
                processing, distribution, storage, transportation, 
                consumption, or disposal of agricultural or food 
                products; and
                    (B) any entity involved in an activity described in 
                subparagraph (A), including a farmer, rancher, 
                processor, manufacturer, distributor, retailer, 
                consumer, and regulator.
            (2) Cybersecurity threat; defensive measure; incident; 
        security vulnerability.--The terms ``cybersecurity threat'', 
        ``defensive measure'', ``incident'', and ``security 
        vulnerability'' have the meanings given those terms in section 
        2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
            (3) Secretary.--The term ``Secretary'' means the Secretary 
        of Agriculture.
            (4) Sector-specific ISAC.--The term ``sector-specific 
        ISAC'' means the Food and Agriculture-Information Sharing and 
        Analysis Center.

SEC. 3. ASSESSMENT OF CYBERSECURITY THREATS AND SECURITY 
              VULNERABILITIES IN THE AGRICULTURE AND FOOD CRITICAL 
              INFRASTRUCTURE SECTOR.

    (a) Risk Assessment.--The Secretary, in coordination with the 
Cybersecurity and Infrastructure Security Agency, shall conduct a risk 
assessment, on a biennial basis, on the cybersecurity threats to, and 
security vulnerabilities in, the agriculture and food critical 
infrastructure sector, including--
            (1) the nature and extent of cyberattacks and incidents 
        that affect the agriculture and food critical infrastructure 
        sector;
            (2) the potential impacts of a cyberattack or incident on 
        the safety, security, and availability of food products, as 
        well as on the economy, public health, and national security of 
        the United States;
            (3) the current capability and readiness of the Federal 
        Government, State and local governments, and private sector 
        entities to prevent, detect, mitigate, respond to, and recover 
        from cyberattacks and incidents described in paragraph (2);
            (4) the existing policies, standards, guidelines, best 
        practices, and initiatives applicable to the agriculture and 
        food critical infrastructure sector to enhance defensive 
        measures in that sector;
            (5) the gaps, challenges, barriers, or opportunities for 
        improving defensive measures in the agriculture and food 
        critical infrastructure sector; and
            (6) any recommendations for Federal legislative or 
        administrative actions to address the cybersecurity threats to, 
        and security vulnerabilities in, the agriculture and food 
        critical infrastructure sector, including intrusive, 
        duplicative, or conflicting regulatory requirements that may 
        divert attention and resources from operational risk management 
        to a compliance regime that impedes security efforts.
    (b) Private Sector Participation.--In conducting a risk assessment 
under subsection (a), the Secretary shall consult with appropriate 
entities in the private sector, including--
            (1) the sector-specific ISAC; and
            (2) the appropriate sector coordinating council.
    (c) Biennial Report.--Not later than 1 year after the date of 
enactment of this Act, and every 2 years thereafter, the Secretary 
shall submit a report on each risk assessment conducted under 
subsection (a) to--
            (1) the Committee on Agriculture, Nutrition, and Forestry 
        of the Senate;
            (2) the Committee on Homeland Security and Governmental 
        Affairs of the Senate;
            (3) the Committee on Agriculture of the House of 
        Representatives; and
            (4) the Committee on Homeland Security of the House of 
        Representatives.

SEC. 4. FOOD SECURITY AND CYBER RESILIENCE SIMULATION EXERCISE.

    (a) Establishment.--The Secretary, in coordination with the 
Secretary of Homeland Security, the Secretary of Health and Human 
Services, the Director of National Intelligence, and the heads of other 
relevant Federal agencies, shall conduct, over a 5-year period, an 
annual cross-sector crisis simulation exercise relating to a food-
related emergency or disruption (referred to in this section as an 
``exercise'').
    (b) Purposes.--The purposes of each exercise are--
            (1) to assess the preparedness and response capabilities of 
        Federal, State, Tribal, local, and territorial governments and 
        private sector entities in the event of a food-related 
        emergency or disruption;
            (2) to identify and address gaps and vulnerabilities in the 
        food supply chain and critical infrastructure;
            (3) to enhance coordination and information sharing among 
        stakeholders involved in food production, processing, 
        distribution, and consumption;
            (4) to evaluate the effectiveness and efficiency of 
        existing policies, programs, and resources relating to food 
        security and resilience;
            (5) to develop and disseminate best practices and 
        recommendations for improving food security and resilience; and
            (6) to identify key stakeholders and categories that were 
        missing from the exercise to ensure the inclusion of those 
        stakeholders and categories in future exercises.
    (c) Design.--Each exercise shall--
            (1) involve a realistic and plausible scenario that 
        simulates a food-related emergency or disruption affecting 
        multiple sectors and jurisdictions;
            (2) incorporate input from experts and stakeholders from 
        various disciplines and sectors, including agriculture, public 
        health, nutrition, emergency management, transportation, 
        energy, water, communications, related equipment suppliers and 
        manufacturers, and cybersecurity, including related academia 
        and private sector information security researchers and 
        practitioners, including the sector-specific ISAC;
            (3) use a variety of methods and tools, such as tabletop 
        exercises, workshops, seminars, games, drills, or full-scale 
        exercises; and
            (4) include participants from Federal, State, Tribal, 
        local, and territorial governments and private sector entities, 
        including the sector-specific ISAC and appropriate sector 
        coordinating councils, that have roles and responsibilities 
        relating to food security and resilience.
    (d) Private Sector Participation.--In conducting an exercise, the 
Secretary shall consult with appropriate entities in the private 
sector, including--
            (1) the sector-specific ISAC; and
            (2) the appropriate sector coordinating councils.
    (e) Feedback; Report.--After each exercise, the Secretary, in 
consultation with the heads of the Federal agencies described in 
subsection (a), shall--
            (1) provide feedback to, and an evaluation of, the 
        participants in that exercise on their performance and 
        outcomes; and
            (2) produce, and submit to Congress, a report that 
        summarizes, with respect to that exercise, the findings of that 
        exercise, lessons learned from that exercise, and 
        recommendations to enhance the cybersecurity and resilience of 
        the agriculture and food critical infrastructure sector.
    (f) Authorization of Appropriations.--There is authorized to be 
appropriated to carry out this section $1,000,000 for each of fiscal 
years 2026 through 2030.
                                 <all>