Biotech Critical Infrastructure Bills

The biotechnology and biological data critical infrastructure bills introduced September 24, 2026 direct CISA to support biomanufacturers and protect genomic data systems, and they impose no duties on companies.

Each bill amends section 2202 of the Homeland Security Act of 2002, codified at 6 U.S.C. 652, which defines what CISA does. The first, H.R. 10569 and S. 5502, adds biotechnology and biomanufacturing infrastructure to CISA’s outreach, risk assessment, and national planning duties without creating a new critical infrastructure sector. The second, H.R. 10568 and S. 5522, tells CISA to treat genetic data systems that involve genomic sequences and other sensitive biometric data as critical infrastructure, to consult industry on security protocols, and to staff the work. Both track recommendation 2.4a of the National Security Commission on Emerging Biotechnology, which sunsets in December 2026.

For a startup that runs fermentation or cell culture production, or that stores sequence data, the practical change is a federal counterpart at CISA. No rulebook comes with it. The binding obligations arrive from other sources: the Justice Department bulk data rule at 28 C.F.R. part 202, the BIOSECURE provisions in section 851 of the FY2026 National Defense Authorization Act, the military contractor cybersecurity certification rule, and the CIRCIA final rule that CISA sent to the White House budget office on October 1, 2026. The bills matter because they show customers, investors, and insurers where the federal government is looking, and diligence questions follow that attention.

The Senate text reviewed for this report is a draft with sections missing, and it does not define genetic data systems or biotechnology infrastructure. Those definitions are the first items to watch. Two related amendments to the FY27 defense authorization bill were filed in June 2026, and that bill is the likeliest vehicle before the commission ends. For founders, general counsel, and investors, the sensible posture in October 2026 is to build the security and data controls that existing rules already demand, and to treat any CISA outreach as a free channel worth joining.

Detailed Findings

What Do the Two Bills Actually Require?

Each bill amends the Homeland Security Act of 2002 and requires CISA to act, while leaving private companies with no new obligation. The biotechnology and biomanufacturing bill adds owners and operators of that infrastructure to the entities CISA must coordinate with under subsection c, paragraph 2 of 6 U.S.C. 652. Where the infrastructure has no designated sector risk management agency, CISA must assign staff to provide analysis, expertise, and technical assistance, to conduct outreach, and to convene the relevant agencies. A new paragraph 14 directs CISA to take the actions necessary to protect it.

The national risk assessments that feed the plan under section 2202, subsection e, paragraph 1 would be carried out in coordination with existing information sharing and analysis organizations, and the text names BIO ISAC and H ISAC along with industry associations. The bill also adds biotechnology and biomanufacturing infrastructure to the list of sectors the national plan covers. The Senate draft sets a work plan due 45 days after enactment, an implementation report one year later, and a report on emerging biotechnology that must say whether any critical biotechnology areas remain unprotected.

That draft work plan also calls for an update to the national strategic plans by September 30, 2026. The date falls six days after introduction and before the 45 day clock could start, so the final text has to change it. The mismatch is one reason this report treats the reviewed language as a draft.

Do the Bills Create a New Critical Infrastructure Sector?

No. The commission asked Congress to have DHS cover biotechnology under the existing sectors and to say so explicitly if some critical biotechnology areas fit none of them, and press accounts of the September 2026 bill describe plans without a new sector. Sixteen sectors exist. PPD 21 set them in 2013, and NSM 22 of April 30, 2024 kept them without addition, although a 2022 DHS report had raised Space and Bioeconomy sectors.

The sector label matters because biotechnology touches health, agriculture, and industry at once. A plant that ferments a food ingredient may sit under food and agriculture, one that makes a specialty chemical under chemical, one that builds equipment under critical manufacturing, and one that supplies a drug precursor under healthcare and public health. The label selects the sector risk management agency, the reporting criteria, and the regulator that eventually asks questions.

How Would the Biological Data Bill Treat Genomic Data Systems?

The biological data bill makes CISA responsible for the security of genetic data systems that involve genomic sequences and other sensitive biometric data, and the reviewed text leaves that phrase undefined. New paragraphs in section 2202, subsection c, tell CISA to oversee planning and coordination of those security duties, to ensure sufficient staff, to train federal personnel, and to protect biological data and critical biotechnology infrastructure. New subparagraphs in section 2202, subsection e, paragraph 1 direct CISA to treat genetic data systems as critical infrastructure, to consult biotechnology stakeholders and agencies such as the Office of Biometric Identity Management on security protocols, and to collaborate on emerging concerns such as the digital physical boundary between genetic sequence data and physical samples.

The text also requires a secure line of communication for raising concerns, reporting incidents, and requesting technical assistance, and it adds genetic and biometric data security to the list in section 2211, subsection b, paragraph 2. Press reports add joint exercises with industry.