House and Senate members propose legislation for CISA to step up cyber defenses for biotech

Bipartisan lawmakers have proposed legislation aimed at enhancing the Cybersecurity and Infrastructure Security Agency's (CISA) focus on protecting the biotechnology, biomanufacturing, and biological data sectors, as these areas do not fit neatly into existing critical infrastructure designations. Two bills, the Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act and the Protecting Biological Data Act, share cosponsors. One bill seeks to direct the Department of Homeland Security (DHS) to develop plans protecting these areas as critical infrastructure, including updating the National Infrastructure Protection Plan with biotech sector input. The other bill aims to ensure systems handling genomic sequences and sensitive biometric data are covered as critical infrastructure and integrated into the national cyber strategy, involving CISA in joint exercises and personnel adjustments for biometric data security. Proponents argue that biotechnology infrastructure and data are vital to national security, citing recent cyberattacks suffered by companies like Boston Scientific and Amgen. Supporters view these measures as necessary to ensure the resilience of the U.S.'s leadership in biotechnology amidst physical and cyber threats.

The narrative frames the extension of critical infrastructure protection to the biotechnology sector as a matter of national security, linking biological data and biomanufacturing directly to America's competitive standing and defense posture against foreign threats. The pattern observed is leveraging urgent security concerns (cyberattacks on major biotech firms) to introduce broad legislative solutions that mandate systemic restructuring within existing federal agencies like DHS and CISA. This tactic shifts the focus from incremental risk management to structural designation, suggesting that current sector boundaries are insufficient for modern threat environments. A key tension lies in the scope: while proponents stress resilience against physical and cyber threats, the bills deliberately avoid creating a new infrastructure category, relying instead on weaving biotech into existing frameworks. The implication is that strategic importance can be recognized by redefining responsibilities within established structures rather than fundamentally altering the categorization system. The cost borne is the potential for legislative inertia if the proposed structural changes are stalled, leaving critical infrastructure vulnerable in the interim. What assumptions about what constitutes 'critical' versus 'specialized' can be safely deferred while pursuing these necessary protections? How does this approach balance the need for specific sector attention with the administrative realities of federal designation?