To amend the Homeland Security Act of 2002 to provide for the mitigation of cybersecurity risks by the Federal Emergency Management Agency, and for other purposes.
Legislative Progress
IntroducedMr. Thompson of Mississippi introduced the following bill; which was …
Summary
What This Bill Does
This bill updates federal law to explicitly require the Federal Emergency Management Agency (FEMA) to address cybersecurity threats that could disrupt its emergency response operations. It also requires FEMA to report to Congress within one year on its progress in strengthening its cybersecurity defenses.
Who Benefits and How
Cybersecurity vendors and federal contractors benefit most directly through new opportunities to provide cybersecurity services, software, and hardware to FEMA. Defense contractors and cybersecurity consulting firms specializing in government work stand to gain contracts worth millions as FEMA works to meet its new cybersecurity mandate. State and local emergency management agencies also benefit indirectly from a more secure federal emergency response system, reducing risks during natural disasters and crises.
Who Bears the Burden and How
FEMA and its leadership face new compliance and reporting obligations, requiring staff time, resources, and budget to implement cybersecurity improvements and prepare congressional reports. The Cybersecurity and Infrastructure Security Agency (CISA) takes on additional consultative responsibilities working with FEMA. Ultimately, federal taxpayers will bear the costs of FEMA's cybersecurity upgrades, though these costs are not specified in the bill.
Key Provisions
- Adds "mitigating cybersecurity risks" as an official statutory responsibility of FEMA under the Homeland Security Act of 2002
- Defines cybersecurity risks as those that could impede FEMA's operational capabilities during emergencies
- Requires FEMA's Administrator to work with CISA's Director on cybersecurity improvements
- Mandates a progress report to three congressional committees (Homeland Security, Transportation and Infrastructure, and Governmental Affairs) by one year after the bill becomes law
- Removes outdated language that limited FEMA's responsibilities to those existing "as of the day before enactment"
Evidence Chain:
This summary is derived from the structured analysis below. See "Detailed Analysis" for per-title beneficiaries/burden bearers with clause-level evidence links.
Primary Purpose
Amends the Homeland Security Act of 2002 to add cybersecurity risk mitigation as a responsibility of the Federal Emergency Management Agency (FEMA) and requires a progress report to Congress.
Policy Domains
Legislative Strategy
"Strengthen FEMA's cybersecurity posture by explicitly adding cybersecurity risk mitigation to its statutory responsibilities and establishing Congressional oversight through mandatory reporting"
Likely Beneficiaries
- Federal Emergency Management Agency (FEMA) - receives explicit authority and mandate to address cybersecurity
- Cybersecurity and Infrastructure Security Agency (CISA) - expanded consultative role with FEMA
- Cybersecurity vendors and contractors - potential for increased federal contracts to help FEMA mitigate cyber risks
- State and local emergency management agencies - benefit from improved federal cybersecurity resilience
- Critical infrastructure sectors - benefit from more secure emergency response capabilities
Likely Burden Bearers
- FEMA leadership and staff - new compliance and reporting obligations
- Federal taxpayers - potential costs associated with cybersecurity improvements and staffing
Bill Structure & Actor Mappings
Who is "The Secretary" in each section?
- "agency"
- → Federal Emergency Management Agency (FEMA)
- "the_director"
- → Director of the Cybersecurity and Infrastructure Security Agency (CISA)
- "the_administrator"
- → Administrator of the Federal Emergency Management Agency (FEMA)
Key Definitions
Terms defined in this bill
As defined in section 2200 of the Homeland Security Act of 2002
Federal Emergency Management Agency (FEMA)
We use a combination of our own taxonomy and classification in addition to large language models to assess meaning and potential beneficiaries. High confidence means strong textual evidence. Always verify with the original bill text.
Learn more about our methodology