,,ii #aaith ,,congress #ast ,session ,s4 #ged ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #bf1 #bjbe,mr4 ,cotton 7for himself1 ,ms4 ,slotkin1 ,mr4 ,ricketts1 ,mr4 ,tillis1 ,ms4 ,lummis1 ,mr4 ,budd1 and ,mrs4 ,britt7 introduced the following bill2 which was read twice and referred to the ,committee on ,agriculture1 ,nutrition1 and ,forestry ,a ,,bill ,to direct the ,secretary of ,agriculture to periodically assess cybersecurity threats to1 and vulnerabilities in1 the agriculture and food critical infrastructure sector and to provide recommendations to enhance their security and resilience1 to require the ,secretary of ,agriculture to conduct an annual cross-sector simulation exercise relating to a food-related emergency or disruption1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,farm and ,food ,cybersecurity ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,agriculture and food critical infrastructure sector ,the term agriculture and food critical infrastructure sector means-- 7,a7 any activity relating to the production1 processing1 distribution1 storage1 transportation1 consumption1 or disposal of agricultural or food products2 and 7,b7 any entity involved in an activity described in subparagraph 7,a71 including a farmer1 rancher1 processor1 manufacturer1 distributor1 retailer1 consumer1 and regulator4 7#b7 ,cybersecurity threat2 defensive measure2 incident2 security vulnerability ,the terms cybersecurity threat1 defensive measure1 incident1 and security vulnerability have the meanings given those terms in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#c7 ,secretary ,the term ,secretary means the ,secretary of ,agriculture4 7#d7 ,sector-specific ,,isac ,the term sector-specific ,,isac means the ,food and ,agriculture-,information ,sharing and ,analysis ,center4 #c4 ,assessment of cybersecurity threats and security vulnerabilities in the agriculture and food critical infrastructure sector 7a7 ,risk assessment ,the ,secretary1 in coordination with the ,cybersecurity and ,infrastructure ,security ,agency1 shall conduct a risk assessment1 on a biennial basis1 on the cybersecurity threats to1 and security vulnerabilities in1 the agriculture and food critical infrastructure sector1 including-- 7#a7 the nature and extent of cyberattacks and incidents that affect the agriculture and food critical infrastructure sector2 7#b7 the potential impacts of a cyberattack or incident on the safety1 security1 and availability of food products1 as well as on the economy1 public health1 and national security of the ,united ,states2 7#c7 the current capability and readiness of the ,federal ,government1 ,state and local governments1 and private sector entities to prevent1 detect1 mitigate1 respond to1 and recover from cyberattacks and incidents described in paragraph 7#b72 7#d7 the existing policies1 standards1 guidelines1 best practices1 and initiatives applicable to the agriculture and food critical infrastructure sector to enhance defensive measures in that sector2 7#e7 the gaps1 challenges1 barriers1 or opportunities for improving defensive measures in the agriculture and food critical infrastructure sector2 and 7#f7 any recommendations for ,federal legislative or administrative actions to address the cybersecurity threats to1 and security vulnerabilities in1 the agriculture and food critical infrastructure sector1 including intrusive1 duplicative1 or conflicting regulatory requirements that may divert attention and resources from operational risk management to a compliance regime that impedes security efforts4 7b7 ,private sector participation ,in conducting a risk assessment under subsection 7a71 the ,secretary shall consult with appropriate entities in the private sector1 including-- 7#a7 the sector-specific ,,isac2 and 7#b7 the appropriate sector coordinating council4 7c7 ,biennial report ,not later than #a year after the date of enactment of this ,act1 and every #b years thereafter1 the ,secretary shall submit a report on each risk assessment conducted under subsection 7a7 to-- 7#a7 the ,committee on ,agriculture1 ,nutrition1 and ,forestry of the ,senate2 7#b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7#c7 the ,committee on ,agriculture of the ,house of ,representatives2 and 7#d7 the ,committee on ,homeland ,security of the ,house of ,representatives4 #d4 ,food security and cyber resilience simulation exercise 7a7 ,establishment ,the ,secretary1 in coordination with the ,secretary of ,homeland ,security1 the ,secretary of ,health and ,human ,services1 the ,director of ,national ,intelligence1 and the heads of other relevant ,federal agencies1 shall conduct1 over a #e-year period1 an annual cross-sector crisis simulation exercise relating to a food-related emergency or disruption 7referred to in this section as an exercise74 7b7 ,purposes ,the purposes of each exercise are-- 7#a7 to assess the preparedness and response capabilities of ,federal1 ,state1 ,tribal1 local1 and territorial governments and private sector entities in the event of a food-related emergency or disruption2 7#b7 to identify and address gaps and vulnerabilities in the food supply chain and critical infrastructure2 7#c7 to enhance coordination and information sharing among stakeholders involved in food production1 processing1 distribution1 and consumption2 7#d7 to evaluate the effectiveness and efficiency of existing policies1 programs1 and resources relating to food security and resilience2 7#e7 to develop and disseminate best practices and recommendations for improving food security and resilience2 and 7#f7 to identify key stakeholders and categories that were missing from the exercise to ensure the inclusion of those stakeholders and categories in future exercises4 7c7 ,design ,each exercise shall-- 7#a7 involve a realistic and plausible scenario that simulates a food-related emergency or disruption affecting multiple sectors and jurisdictions2 7#b7 incorporate input from experts and stakeholders from various disciplines and sectors1 including agriculture1 public health1 nutrition1 emergency management1 transportation1 energy1 water1 communications1 related equipment suppliers and manufacturers1 and cybersecurity1 including related academia and private sector information security researchers and practitioners1 including the sector-specific ,,isac2 7#c7 use a variety of methods and tools1 such as tabletop exercises1 workshops1 seminars1 games1 drills1 or full-scale exercises2 and 7#d7 include participants from ,federal1 ,state1 ,tribal1 local1 and territorial governments and private sector entities1 including the sector-specific ,,isac and appropriate sector coordinating councils1 that have roles and responsibilities relating to food security and resilience4 7d7 ,private sector participation ,in conducting an exercise1 the ,secretary shall consult with appropriate entities in the private sector1 including-- 7#a7 the sector-specific ,,isac2 and 7#b7 the appropriate sector coordinating councils4 7e7 ,feedback2 report ,after each exercise1 the ,secretary1 in consultation with the heads of the ,federal agencies described in subsection 7a71 shall-- 7#a7 provide feedback to1 and an evaluation of1 the participants in that exercise on their performance and outcomes2 and 7#b7 produce1 and submit to ,congress1 a report that summarizes1 with respect to that exercise1 the findings of that exercise1 lessons learned from that exercise1 and recommendations to enhance the cybersecurity and resilience of the agriculture and food critical infrastructure sector4 7f7 ,authorization of appropriations ,there is authorized to be appropriated to carry out this section #a1jjj1jjj for each of fiscal years #bjbf through #bjcj4