Guidance on rural cybersecurity readiness

Section 405(d) of the Cybersecurity Act of 2015 (6 U.S.C. 1533(d)) (as amended by section 5(2)) is amended by adding at the end the following: (5) Rural cybersecurity guidance (A) Definition of rural In this paragraph, the term rural has the meaning given such term by the Health Resources and Services Administration. (B) Guidance on rural cybersecurity readiness Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2025, the Secretary shall issue guidance to rural entities on best practices to improve cyber readiness, including strategies— (i) to improve cyber infrastructure, including any technical safeguards to mitigate cybersecurity risk; (ii) to integrate best practices issued by the Secretary to improve cybersecurity preparedness; (iii) to improve employee preparation to mitigate any cybersecurity risks, including existing public-private programs to support educational initiatives; and (iv) to implement policies to facilitate mandatory cybersecurity incident reporting requirements under law. (C) GAO study and report (i) In general Not later than 3 years after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2025, the Comptroller General of the United States shall conduct, and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that describes the results of, a study to examine how rural entities have implemented the recommendations included in the guidance under subparagraph (B). (ii) Requirements The study under clause (i) shall assess— (I) how rural entities have implemented any technical safeguards and any challenges faced by such rural entities in areas for which safeguards were not implemented; (II) steps to further support cyber resilience for rural entities; (III) areas to improve coordination between Federal agencies, including for the purposes of required cyber reporting; and (IV) any opportunities to support public-private collaboration in the area of cyber readiness..