Assessment of cybersecurity threats and security vulnerabilities in the agriculture and food critical infrastructure sector

(a) Risk assessment The Secretary, in coordination with the Cybersecurity and Infrastructure Security Agency, shall conduct a risk assessment, on a biennial basis, on the cybersecurity threats to, and security vulnerabilities in, the agriculture and food critical infrastructure sector, including— (1) the nature and extent of cyberattacks and incidents that affect the agriculture and food critical infrastructure sector; (2) the potential impacts of a cyberattack or incident on the safety, security, and availability of food products, as well as on the economy, public health, and national security of the United States; (3) the current capability and readiness of the Federal Government, State and local governments, and private sector entities to prevent, detect, mitigate, respond to, and recover from cyberattacks and incidents described in paragraph (2); (4) the existing policies, standards, guidelines, best practices, and initiatives applicable to the agriculture and food critical infrastructure sector to enhance defensive measures in that sector; (5) the gaps, challenges, barriers, or opportunities for improving defensive measures in the agriculture and food critical infrastructure sector; and (6) any recommendations for Federal legislative or administrative actions to address the cybersecurity threats to, and security vulnerabilities in, the agriculture and food critical infrastructure sector, including intrusive, duplicative, or conflicting regulatory requirements that may divert attention and resources from operational risk management to a compliance regime that impedes security efforts. (b) Private sector participation In conducting a risk assessment under subsection (a), the Secretary shall consult with appropriate entities in the private sector, including— (1) the sector-specific ISAC; and (2) the appropriate sector coordinating council. (c) Biennial report Not later than 1 year after the date of enactment of this Act, and every 2 years thereafter, the Secretary shall submit a report on each risk assessment conducted under subsection (a) to— (1) the Committee on Agriculture, Nutrition, and Forestry of the Senate; (2) the Committee on Homeland Security and Governmental Affairs of the Senate; (3) the Committee on Agriculture of the House of Representatives; and (4) the Committee on Homeland Security of the House of Representatives.