II 

118TH CONGRESS 

2D SESSION S. 3661 

To direct the Secretary of Agriculture to periodically assess cybersecurity 

threats to, and vulnerabilities in, the agriculture and food critical infrastructure sector and to provide recommendations to enhance their security and resilience, to require the Secretary of Agriculture to conduct 

an annual cross-sector simulation exercise relating to a food-related emergency or disruption, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 25, 2024 

Mr. COTTON (for himself, Mrs. GILLIBRAND, Mr. RICKETTS, Mrs. BRITT, Mr. 

BARRASSO, Ms. LUMMIS, Mr. ROUNDS, and Mr. MORAN) introduced the 

following bill; which was read twice and referred to the Committee on Agriculture, Nutrition, and Forestry 

A BILL 

To direct the Secretary of Agriculture to periodically assess 

cybersecurity threats to, and vulnerabilities in, the agriculture and food critical infrastructure sector and to 

provide recommendations to enhance their security and 

resilience, to require the Secretary of Agriculture to conduct an annual cross-sector simulation exercise relating 

to a food-related emergency or disruption, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•S 3661 IS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Farm and Food Cyber3 security Act of 2024’’. 

4 SEC. 2. DEFINITIONS. 

5 In this Act: 

6 (1) AGRICULTURE AND FOOD CRITICAL INFRA7 STRUCTURE SECTOR.—The term ‘‘agriculture and 

8 food critical infrastructure sector’’ means— 

9 (A) any activity relating to the production, 

10 processing, distribution, storage, transportation, 

11 consumption, or disposal of agricultural or food 

12 products; and 

13 (B) any entity involved in an activity de14 scribed in subparagraph (A), including a farm15 er, rancher, processor, manufacturer, dis16 tributor, retailer, consumer, and regulator. 

17 (2) CYBERSECURITY THREAT; DEFENSIVE

18 MEASURE; INCIDENT; SECURITY VULNERABILITY.— 

19 The terms ‘‘cybersecurity threat’’, ‘‘defensive meas20 ure’’, ‘‘incident’’, and ‘‘security vulnerability’’ have 

21 the meanings given those terms in section 2200 of 

22 the Homeland Security Act of 2002 (6 U.S.C. 650). 

23 (3) SECRETARY.—The term ‘‘Secretary’’ means 

24 the Secretary of Agriculture. 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•S 3661 IS

1 SEC. 3. ASSESSMENT OF CYBERSECURITY THREATS AND 

2 SECURITY VULNERABILITIES IN THE AGRI3 CULTURE AND FOOD CRITICAL INFRASTRUC4 TURE SECTOR. 

5 (a) STUDY.—The Secretary, in coordination with the 

6 Cybersecurity and Infrastructure Security Agency, shall 

7 conduct a study, on a biennial basis, on the cybersecurity 

8 threats to, and security vulnerabilities in, the agriculture 

9 and food critical infrastructure sector, including— 

10 (1) the nature and extent of cyberattacks and 

11 incidents that affect the agriculture and food critical 

12 infrastructure sector; 

13 (2) the potential impacts of a cyberattack or in14 cident on the safety, security, and availability of 

15 food products, as well as on the economy, public 

16 health, and national security of the United States; 

17 (3) the current capability and readiness of the 

18 Federal Government, State and local governments, 

19 and private sector entities to prevent, detect, re20 spond to, and recover from cyberattacks and inci21 dents described in paragraph (2); 

22 (4) the existing policies, standards, guidelines, 

23 best practices, and initiatives applicable to the agri24 culture and food critical infrastructure sector to en25 hance defensive measures in that sector; 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•S 3661 IS

1 (5) the gaps, challenges, barriers, or opportuni2 ties for improving defensive measures in the agri3 culture and food critical infrastructure sector; and 

4 (6) any recommendations for Federal legislative 

5 or administrative actions to address the cybersecu6 rity threats to, and security vulnerabilities in, the 

7 agriculture and food critical infrastructure sector. 

8 (b) BIENNIAL REPORT.—Not later than 1 year after 

9 the date of enactment of this Act, and every 2 years there10 after, the Secretary shall submit a report on each study 

11 conducted under subsection (a) to— 

12 (1) the Committee on Agriculture, Nutrition, 

13 and Forestry of the Senate; 

14 (2) the Committee on Homeland Security and 

15 Governmental Affairs of the Senate; 

16 (3) the Committee on Agriculture of the House 

17 of Representatives; and 

18 (4) the Committee on Homeland Security of the 

19 House of Representatives. 

20 SEC. 4. FOOD SECURITY AND CYBER RESILIENCE SIMULA21 TION EXERCISE. 

22 (a) ESTABLISHMENT.—The Secretary, in coordina23 tion with the Secretary of Homeland Security, the Sec24 retary of Health and Human Services, the Director of Na25 tional Intelligence, and the heads of other relevant Federal 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•S 3661 IS

1 agencies, shall conduct, over a 5-year period, an annual 

2 cross-sector crisis simulation exercise relating to a food3 related emergency or disruption (referred to in this section 

4 as an ‘‘exercise’’). 

5 (b) PURPOSES.—The purposes of each exercise are— 

6 (1) to assess the preparedness and response ca7 pabilities of Federal, State, Tribal, local, and terri8 torial governments and private sector entities in the 

9 event of a food-related emergency or disruption; 

10 (2) to identify and address gaps and 

11 vulnerabilities in the food supply chain and critical 

12 infrastructure; 

13 (3) to enhance coordination and information 

14 sharing among stakeholders involved in food produc15 tion, processing, distribution, and consumption; 

16 (4) to evaluate the effectiveness and efficiency 

17 of existing policies, programs, and resources relating 

18 to food security and resilience; 

19 (5) to develop and disseminate best practices 

20 and recommendations for improving food security 

21 and resilience; and 

22 (6) to identify key stakeholders and categories 

23 that were missing from the exercise to ensure the in24 clusion of those stakeholders and categories in fu25 ture exercises. 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•S 3661 IS

1 (c) DESIGN.—Each exercise shall— 

2 (1) involve a realistic and plausible scenario 

3 that simulates a food-related emergency or disrup4 tion affecting multiple sectors and jurisdictions; 

5 (2) incorporate input from experts and stake6 holders from various disciplines and sectors, includ7 ing agriculture, public health, nutrition, emergency 

8 management, transportation, energy, water, commu9 nications, related equipment suppliers and manufac10 turers, and cybersecurity, including related academia 

11 and private sector information security researchers 

12 and practitioners and sector-relevant information 

13 sharing and analysis centers; 

14 (3) use a variety of methods and tools, such as 

15 tabletop exercises, workshops, seminars, games, 

16 drills, or full-scale exercises; and 

17 (4) include participants from Federal, State, 

18 Tribal, local, and territorial governments and private 

19 sector entities, including sector-relevant information 

20 sharing and analysis centers, that have roles and re21 sponsibilities relating to food security and resilience. 

22 (d) FEEDBACK; REPORT.—After each exercise, the 

23 Secretary, in consultation with the heads of the Federal 

24 agencies described in subsection (a), shall— 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•S 3661 IS

1 (1) provide feedback to, and an evaluation of, 

2 the participants in that exercise on their perform3 ance and outcomes; and 

4 (2) produce and submit to Congress a report 

5 that summarizes, with respect to that exercise, the 

6 findings of that exercise, lessons learned from that 

7 exercise, and recommendations to enhance the cyber8 security and resilience of the agriculture and food 

9 critical infrastructure sector. 

10 (e) AUTHORIZATION OF APPROPRIATIONS.—There is 

11 authorized to be appropriated to carry out this section 

12 $1,000,000 for each of fiscal years 2024 through 2028. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS