119th Congress (2025-2026)

HR 5079

Widespread Information Management for the Welfare of Infrastructure and Government Act

Introduced

Jurisdiction

US Congress

Session

119th Congress (2025-2026)

Official source

Chamber

House

Session

119th Congress (2025-2026)

Jurisdiction

US Congress

Bill overview

This bill, the Widespread Information Management for the Welfare of Infrastructure and Government Act, reauthorizes the Cybersecurity Act of 2015. It updates definitions related to artificial intelligence, critical infrastructure, and Sector Risk Management Agencies, and clarifies the sharing of cyber threat indicators between the Federal Government and non-Federal entities. Specifically, it expands the scope of information sharing to include operational technology and edge devices, and addresses the use of artificial intelligence in cybersecurity activities.

Key provisions

Reauthorizes the Cybersecurity Act of 2015 and updates its definitions.
Defines ‘artificial intelligence’ and ‘critical infrastructure’ for the purposes of the Cybersecurity Act.
Clarifies the process for sharing cyber threat indicators between the Federal Government and non-Federal entities.
Expands the types of information shared to include operational technology, edge devices, and IoT devices.
Addresses the use of artificial intelligence in cybersecurity activities, prohibiting its use for certain purposes.
Requires the Department of Homeland Security to develop an outreach plan to encourage participation in cyber threat information sharing.
Mandates annual reporting to Congress on cybersecurity threats and activities.
Extends the effective period of the Cybersecurity Act to 2035.

Who is affected

Federal Government agencies
Non-Federal critical infrastructure owners and operators
Cybersecurity professionals

Positions across the country

No public positions recorded for this legislation.

Arguments in favor

Reasons to support this legislation.

No arguments in favor have been submitted.

Submit yours

Arguments opposed

Reasons to oppose this legislation.

No arguments opposed have been submitted.

Submit yours

Legislative history

2025-09-02House

Referred to the Subcommittee on Cybersecurity and Infrastructure Protection.

2025-09-02House

Referred to the Committee on Homeland Security, and in addition to the Committees on Oversight and Government Reform, Intelligence (Permanent Select), Energy and Commerce, Armed Services, and the Judiciary, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

2025-09-02House

Read the latest version inline or switch to a previous version.

Sep 2, 2025XMLView source

119th CONGRESS — 1st Session

H. R. 5079

IN THE HOUSE OF REPRESENTATIVES

A BILL

To reauthorize the Cybersecurity Act of 2015, and for other purposes.

1.Short title

This Act may be cited as the

Widespread Information Management for the Welfare of Infrastructure and Government Act

2.Reauthorization of Cybersecurity Act of 2015

(a)In generalThe Cybersecurity Act of 2015 (6 U.S.C. 1501 et seq.; enacted as division N of the Consolidated Appropriations Act, 2016; Public Law 114–113) is amended—

(1)

in section 102 (6 U.S.C. 1501; relating to definitions)—

(A)

by redesignating paragraphs (4), (5), (6), (7), (8), (9), (10), (11), (12), (13), (14), (15), (16), (17), and (18) as paragraphs (6), (7), (8), (9), (10), (11), (12), (13), (14), (15), (16), (17), (19), (20), and (21), respectively;

(B)

by inserting after paragraph (3) the following new paragraphs:

(4)Artificial intelligenceThe term artificial intelligence has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(5)Critical infrastructureThe term critical infrastructure has the meaning given such term in section 1016(e) of Public Law 107–56 (42 U.S.C. 5195c(e)).

; and

(C)

by inserting after paragraph (17), as so redesignated, the following new paragraph:

(18)Sector Risk Management AgencyThe term Sector Risk Management Agency has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).

;

(2)

in section 103 (6 U.S.C. 1502; relating to sharing of information by the Federal Government)—

(A)

in subsection (a), in the matter preceding paragraph (1), by striking develop and issue and inserting develop, issue, and, as appropriate, update;

(B)

in subsection (b)—

(i)

in paragraph (1)—

(I)

in the matter preceding subparagraph (A), by inserting and, as appropriate, updated, after developed;

(II)

by amending subparagraph (A) to read as follows:

(A)ensure the Federal Government maintains the capability to provide technical assistance, on a voluntary basis, to non-Federal entities in utilizing cyber threat indicators and defensive measures for cybersecurity purposes;

;

(III)

in subparagraph (E)(ii), by striking and after the semicolon;

(IV)

in subparagraph (F), by striking the period and inserting ; and; and

(V)

by adding at the end the following new subparagraph:

(G)pursuant to section 2212 of the Homeland Security Act of 2002 (6 U.S.C. 662), provide one-time read-ins, as appropriate, to select individuals identified by non-Federal entities that own or operate critical infrastructure;

; and

(ii)

in paragraph (2)—

(I)

by inserting and, as appropriate, updating, after developing; and

(II)

by inserting and defensive measures after promote the sharing of cyber threat indicators; and

(C)

in subsection (c)—

(i)

by inserting and not later than 60 days after any update, as appropriate, of procedures required by subsection (a), after Act,; and

(ii)

by inserting (or update, as appropriate) after procedures;

(3)in section 104 (6 U.S.C. 1503; relating to authorizations for preventing, detecting, analyzing, and mitigating cybersecurity threats)—

(A)

in subsection (c)—

(i)

in paragraph (1), by inserting , including Sector Risk Management Agencies that are agencies and the majority of the systems of which are not covered under subsection (d) or (e) of section 3553 of title 44, United States Code, after Federal Government;

(ii)

in paragraph (3)—

(I)

in the matter preceding subparagraph (A), by striking shall be and inserting may be;

(II)

in subparagraph (A), by striking or after the semicolon;

(III)

in subparagraph (B), by striking the period and inserting ; or; and

(IV)

by adding at the end the following new subparagraph:

(C)to preclude the use of artificial intelligence that is developed or strictly deployed for cybersecurity purposes in carrying out the activities authorized under paragraph (1).

; and

(iii)

in subparagraph (B) of subsection (d)(2), by inserting , which may utilize artificial intelligence that is developed or strictly deployed for cybersecurity purposes, after technical capability;

(4)

in section 105 (6 U.S.C. 1504); relating to sharing of cyber threat indicators and defensive measures with the Federal Government—

(A)

in subsection (a)—

(i)

in paragraph (2), by adding at the end the following new sentences: As appropriate, the Attorney General and the Secretary of Homeland Security shall, in consultation with the heads of the appropriate Federal entities, jointly update such policies and procedures, and issue and make publicly available such updated policies and procedures. Such updates shall prioritize rapid dissemination to State, local, Tribal, and territorial governments and owners and operators of non-Federal critical infrastructure of relevant and actionable cyber threat indicators and defensive measures.;

(ii)

in paragraph (3), in the matter preceding subparagraph (A), by striking developed or issued and inserting developed, issued, or, as appropriate, updated,; and

(iii)

in paragraph (4)—

(I)

in subparagraph (A), by adding at the end the following new sentence: As appropriate, the Attorney General and the Secretary of Homeland Security shall jointly update and make publicly available such guidance to so assist entities and promote such sharing of cyber threat indicators and defensive measures with such Federal entities under this title.; and

(II)

in subparagraph (B), in the matter preceding clause (i), by inserting and, as appropriate, updated, after developed;

(B)

in subsection (b)—

(i)

in paragraph (2)(B), by inserting , and, as appropriate, update, after review; and

(ii)

in paragraph (3), in the matter preceding subparagraph (A), by inserting and, as appropriate, updated, after required;

(C)in subsection (c)—

(i)

in paragraph (1)(D), by inserting , including if such capability and process employs artificial intelligence before the semicolon;

(ii)

in paragraph (2), by adding at the end the following new subparagraph:

(C)OutreachNot later than 90 days after the date of the enactment of this subparagraph, the Secretary of Homeland Security shall develop and continuously implement an outreach plan, including targeted engagement, to ensure Federal and non-Federal entities, particularly small or rural owners or operators of critical infrastructure which often lack dedicated cybersecurity staff but remain vital to national security—

(i)

are aware of the capability and process required by paragraph (1) to share cyber threat indicators and defensive measures, including the benefits real-time information sharing provides;

(ii)

understand how to share cyber threat indicators and defensive measures;

(iii)understand the obligation to remove certain personal information in accordance with section 104(d)(7) prior to sharing a cyber threat indicator;

(iv)

understand how cyber threat indicators and defensive measures are received, processed, used, and protected;

(v)

understand the protections they are afforded in sharing any cyber threat indicators and defensive measures; and

(vi)

can provide feedback to the Secretary when policies, procedures, and guidelines that are unclear or unintentionally prohibitive to sharing cyber threat indicators and defensive measures.

; and

(iii)

by adding at the end the following new subparagraph:

(D)Briefings on outreachThe Secretary of Homeland Security shall annually provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a briefing on the implementation of outreach pursuant to subparagraph (B).

; and

(D)

in subsection (d)—

(i)

in paragraph (1), by inserting copyright or before trade secret protection; and

(ii)

in paragraph (5)(A),

(I)

in clause (iv), by striking or after the semicolon;

(II)

in clause (v)(III), by striking the period and inserting ; or; and

(III)

by adding at the end the following new clause:

(vi)the purpose of rapidly providing other Federal entities, including Sector Risk Management Agencies, awareness of a cybersecurity threat that may impact the information systems of such Agencies.

;

(5)in section 108 (6 U.S.C. 1507; relating to construction and preemption)—

(A)

in subsection (c)—

(i)

in the matter preceding paragraph (1), by striking shall be and inserting may be;

(ii)

in paragraph (2), by striking or after the semicolon;

(iii)

in paragraph (3), by striking the period and inserting ; or; and

(iv)

by adding at the end the following new paragraph:

(4)to preclude the use of artificial intelligence that is developed or strictly deployed for cybersecurity purposes in carrying out activities authorized by this title.

; and

(B)

in subsection (f)—

(i)

in paragraph (3)—

(I)

by inserting to share cyber threat indicators or defensive measures after relationship; and

(II)

by striking or after the semicolon;

(ii)

in paragraph (4), by striking the period and inserting ; or; and

(iii)

by adding at the end the following new paragraph:

(5)to limit or modify, notwithstanding any other provision of law, the authorization to share pursuant to section 104(c)(1) with Sector Risk Management Agencies described in such section.

;

(6)

in section 109 (6 U.S.C. 1508; relating to report on cybersecurity threats)—

(A)

in subsection (a)—

(i)

by inserting and not later than September 30 of every two years thereafter, after Act,;

(ii)

by inserting the Secretary of Homeland Security and after in coordination with;

(iii)

by inserting and the Committee on Homeland Security and Governmental Affairs before of the Senate;

(iv)

by inserting and the Committee on Homeland Security before of the House; and

(v)

by inserting prepositioning activities, ransomware, after attacks,; and

(B)

in subsection (b)—

(i)

in paragraph (1), by inserting prepositioning activities, ransomware, after attacks,;

(i)

in paragraph (2), by inserting prepositioning activity, ransomware, after attack,;

(i)

in paragraph (3), by inserting prepositioning activities, ransomware, after attacks, each place it appears; and

(i)

in paragraph (4), by inserting prepositioning activities, ransomware, after attacks,; and

(7)

in section 111(a) (6 U.S.C. 1510(a), relating to effective period), by striking 2025 and inserting 2035.

(b)Conforming amendments

Section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650; relating to definitions) is amended—

(1)

in paragraph (5)—

(A)

in subparagraph (B), by inserting or compromising after defeating;

(B)

in subparagraph (C), by inserting including a security vulnerability affecting an information system or a technology included in the critical and emerging technologies list of the Office of Science and Technology Policy or successor list, such as artificial intelligence (as such term is defined in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401)), which may be in a Federal entity’s or non-Federal entity’s software or hardware supply chain, after security vulnerability,;

(C)

in subparagraph (D), by inserting or compromise after defeat; and

(D)

in subparagraph (F), by inserting or compromised after exfiltrated;

(2)in paragraph (14), by amending subparagraph (B) to read as follows:

(B)includes, in accordance with section 104(d)(2) of the Cybersecurity Sharing Act of 2015 (6 U.S.C. 1503(d)(2))—

(i)operational technology, including industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers;

(ii)edge devices; and

(iii)internet of things devices, including digital and physical infrastructure impacted by ransomware.

; and

(3)

in paragraph (25), by inserting or compromise after defeat.

HR 5079

Bill overview

Key provisions

Who is affected

Sponsors

Primary sponsor

Cosponsor

Positions across the country

Arguments in favor

Arguments opposed

Bill text

Notable changes

Fiscal impact

Positions across the country