I 
118TH CONGRESS 
1ST SESSION H. R. 1219 
To establish a food and agriculture cybersecurity clearinghouse in the National 
Telecommunications and Information Administration, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 27, 2023 
Mr. PFLUGER (for himself, Mr. VEASEY, Mr. CURTIS, and Ms. MATSUI) intro-
duced the following bill; which was referred to the Committee on Energy 
and Commerce, and in addition to the Committee on Agriculture, for a 
period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To establish a food and agriculture cybersecurity clearing-
house in the National Telecommunications and Informa-
tion Administration, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Food and Agriculture 
Industry Cybersecurity Support Act’’. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. NTIA FOOD AND AGRICULTURE CYBERSECURITY 
CLEARINGHOUSE. 
(a) NTIA FOOD AND AGRICULTURE CYBERSECURITY 
CLEARINGHOUSE.— 
(1) ESTABLISHMENT.— 
(A) IN
GENERAL.—Not later than 180 
days after the date of the enactment of this 
Act, the Assistant Secretary shall establish in 
the NTIA a food and agriculture cybersecurity 
clearinghouse (in this section referred to as the 
‘‘clearinghouse’’). 
(B) REQUIREMENTS.—The clearinghouse 
shall— 
(i) be publicly available online; 
(ii) contain current, relevant, and 
publicly available food and agriculture in-
dustry focused cybersecurity resources, in-
cluding the recommendations described in 
paragraph (2), and any other appropriate 
materials for reference by entities that de-
velop products with potential security 
vulnerabilities for the food and agriculture 
industry; 
(iii) contain a mechanism for individ-
uals or entities in the food and agriculture 
industry to request in-person or virtual 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
support from the NTIA or, if appropriate, 
a cooperating agency for cybersecurity re-
lated issues; 
(iv) contain a Frequently Asked Ques-
tions (FAQ) section, updated at least an-
nually, with answers to the top 20 most 
frequently asked questions relevant to the 
cybersecurity of the food and agriculture 
industry; and 
(v) 
include 
materials 
specifically 
aimed at assisting small business concerns 
and non-technical users in the food and ag-
riculture industry with critical cybersecu-
rity protections related to the food and ag-
riculture industry, including recommenda-
tions on how to respond to a ransomware 
attack and resources for additional infor-
mation, including the ‘‘Stop Ransomware’’ 
site hosted by the Cybersecurity and Infra-
structure Security Agency of the Depart-
ment of Homeland Security. 
(C) EXISTING PLATFORM OR WEBSITE.— 
The Assistant Secretary may establish the 
clearinghouse on an online platform or a 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
website that is in existence as of the date of the 
enactment of this Act. 
(2) CONSOLIDATION
OF
FOOD
AND
AGRI-
CULTURE INDUSTRY CYBERSECURITY RECOMMENDA-
TIONS.— 
(A) IN
GENERAL.—The Assistant Sec-
retary, in consultation with the Administrator 
of the Farm Service Agency of the Department 
of Agriculture and relevant Sector Risk Man-
agement Agencies, shall consolidate public and 
private sector best practices to produce a set of 
voluntary cybersecurity recommendations relat-
ing to the development, maintenance, and oper-
ation of the food and agriculture industry. 
(B) REQUIREMENTS.—The recommenda-
tions consolidated under subparagraph (A) shall 
include, to the greatest extent practicable, ma-
terials addressing the following: 
(i) Risk-based, cybersecurity-informed 
engineering, including continuous moni-
toring and resiliency. 
(ii) Planning for retention or recovery 
of positive control of systems in the food 
and agriculture industry in the event of a 
cybersecurity incident. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(iii) Protection against unauthorized 
access to critical functions of the food and 
agriculture industry. 
(iv) Cybersecurity against threats to 
products of the food and agriculture indus-
try throughout the lifetimes of such prod-
ucts. 
(v) How businesses in the food and 
agriculture industry should respond to 
ransomware attacks, including details on 
the legal obligations of such businesses in 
the event of such an attack, including re-
porting requirements and Federal re-
sources for support. 
(vi) Any other recommendations to 
ensure the confidentiality, availability, and 
integrity of data residing on or in transit 
through systems in the food and agri-
culture industry. 
(3) IMPLEMENTATION.—In implementing this 
subsection, the Assistant Secretary shall— 
(A) to the extent practicable, consult with 
the private sector; 
(B) consult with non-Federal entities de-
veloping equipment and systems utilized in the 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
food and agriculture industry, including private, 
consensus organizations that develop relevant 
standards; 
(C) consult with the Director of the Cyber-
security and Infrastructure Security Agency of 
the Department of Homeland Security; 
(D) consult with food and agriculture in-
dustry trade groups; 
(E) consult with relevant Sector Risk Man-
agement Agencies; 
(F) consult with civil society organizations; 
(G) consult with the Administrator of the 
Small Business Administration; and 
(H) consider the development of an advi-
sory board to advise the Assistant Secretary on 
implementing this subsection, including the col-
lection of data through the clearinghouse and 
the disclosure of such data. 
(b) STUDY.— 
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a study on the ac-
tions the Federal Government has taken or may 
take to improve the cybersecurity of the food and 
agriculture industry. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(2) REPORT.—Not later than 90 days after the 
date of the enactment of this Act, the Comptroller 
General of the United States shall submit to Con-
gress a report on the study conducted under para-
graph (1), which shall include information on the 
following: 
(A) The effectiveness of efforts of the Fed-
eral Government to improve the cybersecurity of 
the food and agriculture industry. 
(B) The resources made available to the 
public, as of the date of such submission, by 
Federal agencies to improve the cybersecurity 
of the food and agriculture industry, including 
to address cybersecurity risks and cybersecurity 
threats to the food and agriculture industry. 
(C) The extent to which Federal agencies 
coordinate or duplicate authorities and take 
other actions for the improvement of the cyber-
security of the food and agriculture industry. 
(D) Whether there is an appropriate plan 
in place to prevent or adequately mitigate the 
risks of a coordinated attack on the food and 
agriculture industry. 
(E) The advantages and disadvantages of 
creating a food and agriculture industry specific 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
Information Sharing and Analysis Center 
(ISAC), including required actions by the Fed-
eral Government and expected costs to the Fed-
eral Government to create such an organization 
and potential industry and civil society partners 
who could operate such an organization. 
(F) The advantages and disadvantages of 
the creation by the Assistant Secretary of a 
database containing a software bill of materials 
(SBOM) for the most common internet-con-
nected hardware and software applications used 
in the food and agriculture industry and rec-
ommendations for how the Assistant Secretary 
can maintain and update such database. 
(3) COORDINATION.—In carrying out para-
graphs (1) and (2), the Comptroller General of the 
United States shall coordinate with appropriate Fed-
eral agencies, including the following: 
(A) The Department of Health and 
Human Services. 
(B) The Department of Commerce. 
(C) The Department of Agriculture. 
(D) The Federal Communications Commis-
sion. 
(E) The Department of Energy. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(F) The Small Business Administration. 
(4) PROCESS
FOR
STUDYING
CREATION
OF 
ISAC.—In studying the advantages and disadvan-
tages of creating a food and agriculture industry 
specific Information Sharing and Analysis Center for 
purposes of including in the report required by para-
graph (2) the information required by subparagraph 
(E) of such paragraph, the Comptroller General 
shall convene stakeholders that include civil society 
organizations, individual food and agriculture pro-
ducers, and the Federal agencies described in para-
graph (3). 
(5) BRIEFING.—Not later than 90 days after 
the date on which the Comptroller General of the 
United States submits the report under paragraph 
(2), the Comptroller General shall provide to Con-
gress a briefing regarding such report. 
(6) CLASSIFICATION.—The report under para-
graph (2) shall be unclassified but may include a 
classified annex. 
(c) DEFINITIONS.—In this section: 
(1) ASSISTANT SECRETARY.—The term ‘‘Assist-
ant Secretary’’ means the Assistant Secretary of 
Commerce for Communications and Information. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(2) CYBERSECURITY RISK.—The term ‘‘cyberse-
curity risk’’ has the meaning given such term in sec-
tion 2200 of the Homeland Security Act of 2002 (6 
U.S.C. 650). 
(3) CYBERSECURITY THREAT.—The term ‘‘cy-
bersecurity threat’’ has the meaning given such term 
in section 2200 of the Homeland Security Act of 
2002 (6 U.S.C. 650). 
(4) FOOD AND AGRICULTURE INDUSTRY.—The 
term ‘‘food and agriculture industry’’ means— 
(A) equipment and systems utilized in the 
food and agriculture supply chain, such as com-
puter vision algorithms for precision agri-
culture, grain silos, and related food and agri-
culture storage infrastructure; 
(B) food and agriculture goods processors, 
growers, and distributors; and 
(C) information technology systems of 
businesses engaged in farming, ranching, plant-
ing, harvesting, food and agriculture product 
storage, food or animal genetic modification, 
the design or production of agrochemicals, or 
the design or production of food and agriculture 
tools. 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(5) INCIDENT.—The term ‘‘incident’’ has the 
meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
(6) NTIA.—The term ‘‘NTIA’’ means the Na-
tional Telecommunications and Information Admin-
istration. 
(7) SECTOR RISK MANAGEMENT AGENCY.—The 
term ‘‘Sector Risk Management Agency’’ has the 
meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
(8) SECURITY VULNERABILITY.—The term ‘‘se-
curity vulnerability’’ has the meaning given such 
term in section 2200 of the Homeland Security Act 
of 2002 (6 U.S.C. 650). 
(9) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ means a small business 
concern described in section 3 of the Small Business 
Act (15 U.S.C. 632). 
(10) SOFTWARE
BILL
OF
MATERIALS.—The 
term ‘‘software bill of materials’’ has the meaning 
given such term in section 10 of Executive Order 
14028 (86 Fed. Reg. 26633; relating to improving 
the Nation’s cybersecurity). 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS
(d) SUNSET.—This section shall have no force or ef-
fect after the date that is 7 years after the date of the 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
02:06 Mar 14, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6301
E:\BILLS\H1219.IH
H1219
kjohnson on DSK79L0C42PROD with BILLS