HR 2659 RFS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening Cyber 
Resilience Against State-Sponsored Threats Act’’. 
SEC. 2. INTERAGENCY TASK FORCE AND REPORT ON THE 
TARGETING OF UNITED STATES CRITICAL IN-
FRASTRUCTURE BY PEOPLE’S REPUBLIC OF 
CHINA STATE-SPONSORED CYBER ACTORS. 
(a) INTERAGENCY TASK FORCE.—Not later than 120 
days after the date of the enactment of this Act, the Sec-
retary of Homeland Security, acting through the Director 
of the Cybersecurity and Infrastructure Security Agency 
(CISA) of the Department of Homeland Security, in con-
sultation with the Attorney General, the Director of the 
Federal Bureau of Investigation, and the heads of appro-
priate Sector Risk Management Agencies as determined 
by the Director of CISA, shall establish a joint interagency 
task force (in this section referred to as the ‘‘task force’’) 
to facilitate collaboration and coordination among the Sec-
tor Risk Management Agencies assigned a Federal role or 
responsibility in National Security Memorandum–22, 
issued April 30, 2024 (relating to critical infrastructure 
security and resilience), or any successor document, to de-
tect, analyze, and respond to the cybersecurity threat 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
posed by State-sponsored cyber actors, including Volt Ty-
phoon, of the People’s Republic of China by ensuring that 
such agencies’ actions are aligned and mutually rein-
forcing. 
(b) CHAIRS.— 
(1) CHAIRPERSON.—The Director of CISA (or 
the Director of CISA’s designee) shall serve as the 
chairperson of the task force. 
(2) VICE CHAIRPERSON.—The Director of the 
Federal Bureau of Investigation (or such Director’s 
designee) shall serve as the vice chairperson of the 
task force. 
(c) COMPOSITION.— 
(1) IN GENERAL.—The task force shall consist 
of appropriate representatives of the departments 
and agencies specified in subsection (a). 
(2) QUALIFICATIONS.—To materially assist in 
the activities of the task force, representatives under 
paragraph (1) should be subject matter experts who 
have familiarity and technical expertise regarding cy-
bersecurity, digital forensics, or threat intelligence 
analysis, or in-depth knowledge of the tactics, tech-
niques, and procedures (TTPs) commonly used by 
State-sponsored cyber actors, including Volt Ty-
phoon, of the People’s Republic of China. 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
(d) VACANCY.—Any vacancy occurring in the mem-
bership of the task force shall be filled in the same manner 
in which the original appointment was made. 
(e) ESTABLISHMENT FLEXIBILITY.—To avoid redun-
dancy, the task force may coordinate with any preexisting 
task force, working group, or cross-intelligence effort with-
in the Homeland Security Enterprise or the intelligence 
community that has examined or responded to the cyberse-
curity threat posed by State-sponsored cyber actors, in-
cluding Volt Typhoon, of the People’s Republic of China. 
(f) TASK FORCE REPORTS; BRIEFING.— 
(1) INITIAL REPORT.—Not later than 540 days 
after the establishment of the task force, the task 
force shall submit to the appropriate congressional 
committees the first report containing the initial 
findings, conclusions, and recommendations of the 
task force. 
(2) ANNUAL REPORT.—Not later than one year 
after the date of the submission of the initial report 
under paragraph (1) and annually thereafter for five 
years, the task force shall submit to the appropriate 
congressional committees an annual report con-
taining the findings, conclusions, and recommenda-
tions of the task force. 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
(3) CONTENTS.—The reports under this sub-
section shall include the following: 
(A) An assessment at the lowest classifica-
tion feasible of the sector-specific risks, trends 
relating to incidents impacting sectors, and tac-
tics, techniques, and procedures utilized by or 
relating to State-sponsored cyber actors, includ-
ing Volt Typhoon, of the People’s Republic of 
China. 
(B) An assessment of additional resources 
and authorities needed by Federal departments 
and agencies to better counter the cybersecurity 
threat posed by State-sponsored cyber actors, 
including Volt Typhoon, of the People’s Repub-
lic of China. 
(C) A classified assessment of the extent of 
potential destruction, compromise, or disruption 
to United States critical infrastructure by 
State-sponsored cyber actors, including Volt Ty-
phoon, of the People’s Republic of China in the 
event of a major crisis or future conflict be-
tween the People’s Republic of China and the 
United States. 
(D) A classified assessment of the ability 
of the United States to counter the cybersecu-
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
rity threat posed by State-sponsored cyber ac-
tors, including Volt Typhoon, of the People’s 
Republic of China in the event of a major crisis 
or future conflict between the People’s Republic 
of China and the United States, including with 
respect to different cybersecurity measures and 
recommendations that could mitigate such a 
threat. 
(E) A classified assessment of the ability 
of State-sponsored cyber actors, including Volt 
Typhoon, of the People’s Republic of China to 
disrupt operations of the United States Armed 
Forces by hindering mobility across critical in-
frastructure such as rail, aviation, and ports, 
including how such would impair the ability of 
the United States Armed Forces to deploy and 
maneuver forces effectively. 
(F) A classified assessment of the eco-
nomic and social ramifications of a disruption 
to one or multiple United States critical infra-
structure sectors by State-sponsored cyber ac-
tors, including Volt Typhoon, of the People’s 
Republic of China in the event of a major crisis 
or future conflict between the People’s Republic 
of China and the United States. 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
(G) Such recommendations as the task 
force may have for the Homeland Security En-
terprise, the intelligence community, or critical 
infrastructure owners and operators to improve 
the detection and mitigation of the cybersecu-
rity threat posed by State-sponsored cyber ac-
tors, including Volt Typhoon, of the People’s 
Republic of China. 
(H) A one-time plan for an awareness 
campaign to familiarize critical infrastructure 
owners and operators with security resources 
and support offered by Federal departments 
and agencies to mitigate the cybersecurity 
threat posed by State-sponsored cyber actors, 
including Volt Typhoon, of the People’s Repub-
lic of China. 
(4) BRIEFING.—Not later than 30 days after 
the date of the submission of each report under this 
subsection, the task force shall provide to the appro-
priate congressional committees a classified briefing 
on the findings, conclusions, and recommendations 
of the task force. 
(5) FORM.—Each report under this subsection 
shall be submitted in classified form, consistent with 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
the protection of intelligence sources and methods, 
but may include an unclassified executive summary. 
(6) PUBLICATION.—The unclassified executive 
summary of each report required under this sub-
section shall be published on a publicly accessible 
website of the Department of Homeland Security. 
(g) ACCESS TO INFORMATION.— 
(1) IN GENERAL.—The Secretary of Homeland 
Security, the Director of CISA, the Attorney Gen-
eral, the Director of the Federal Bureau of Inves-
tigation, and the heads of appropriate Sector Risk 
Management Agencies, as determined by the Direc-
tor of CISA, shall provide to the task force such in-
formation, documents, analysis, assessments, find-
ings, evaluations, inspections, audits, or reviews re-
lating to efforts to counter the cybersecurity threat 
posed by State-sponsored cyber actors, including 
Volt Typhoon, of the People’s Republic of China as 
the task force considers necessary to carry out this 
section. 
(2) RECEIPT, HANDLING, STORAGE, AND DIS-
SEMINATION.—Information, documents, analysis, as-
sessments, findings, evaluations, inspections, audits, 
and reviews described in this subsection shall be re-
ceived, handled, stored, and disseminated only by 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
members of the task force consistent with all appli-
cable statutes, regulations, and Executive orders. 
(3) SECURITY CLEARANCES FOR TASK FORCE 
MEMBERS.—No member of the task force may be 
provided with access to classified information under 
this section without the appropriate security clear-
ances. 
(h) TERMINATION.—The task force, and all the au-
thorities of this section, shall terminate on the date that 
is 60 days after the final briefing required under sub-
section (h)(4). 
(i) EXEMPTION FROM FACA.—Chapter 10 of title 
5, United States Code (commonly referred to as the ‘‘Fed-
eral Advisory Committee Act’’), shall not apply to the task 
force. 
(j) EXEMPTION
FROM
PAPERWORK
REDUCTION 
ACT.—Chapter 35 of title 44, United States Code (com-
monly known as the ‘‘Paperwork Reduction Act’’), shall 
not apply to the task force. 
(k) DEFINITIONS.—In this section: 
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security, 
the Committee on Judiciary, and the Select 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
Committee on Intelligence of the House of Rep-
resentatives; and 
(B) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
Judiciary, and the Select Committee on Intel-
ligence of the Senate. 
(2) ASSETS.—The term ‘‘assets’’ means a per-
son, structure, facility, information, material, equip-
ment, network, or process, whether physical or vir-
tual, that enables an organization’s services, func-
tions, or capabilities. 
(3) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given such 
term in section 1016(e) of Public Law 107–56 (42 
U.S.C. 5195c(e)). 
(4) CYBERSECURITY THREAT.—The term ‘‘cy-
bersecurity threat’’ has the meaning given such term 
in section 2200 of the Homeland Security Act of 
2002 (6 U.S.C. 650). 
(5) HOMELAND SECURITY ENTERPRISE.—The 
term ‘‘Homeland Security Enterprise’’ has the 
meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
(6) INCIDENT.—The term ‘‘incident’’ has the 
meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
(7) INFORMATION SHARING.—The term ‘‘infor-
mation sharing’’ means the bidirectional sharing of 
timely and relevant information concerning a cyber-
security threat posed by a State-sponsored cyber 
actor of the People’s Republic of China to United 
States critical infrastructure. 
(8) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given 
such term in section 3(4) of the National Security 
Act of 1947 (50 U.S.C. 3003(4)). 
(9) LOCALITY.—The term ‘‘locality’’ means any 
local government authority or agency or component 
thereof within a State having jurisdiction over mat-
ters at a county, municipal, or other local govern-
ment level. 
(10) SECTOR.—The term ‘‘sector’’ means a col-
lection of assets, systems, networks, entities, or or-
ganizations that provide or enable a common func-
tion for national security (including national defense 
and continuity of Government), national economic 
security, national public health or safety, or any 
combination thereof. 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS
HR 2659 RFS
(11) SECTOR
RISK
MANAGEMENT
AGENCY.— 
The term ‘‘Sector Risk Management Agency’’ has 
the meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
(12) STATE.—The term ‘‘State’’ means any 
State of the United States, the District of Columbia, 
the Commonwealth of Puerto Rico, the Northern 
Mariana Islands, the United States Virgin Islands, 
Guam, American Samoa, and any other territory or 
possession of the United States. 
(13) SYSTEMS.—The term ‘‘systems’’ means a 
combination of personnel, structures, facilities, infor-
mation, materials, equipment, networks, or proc-
esses, whether physical or virtual, integrated or 
interconnected for a specific purpose that enables an 
organization’s services, functions, or capabilities. 
(14) UNITED
STATES.—The term ‘‘United 
States’’, when used in a geographic sense, means 
any State of the United States. 
(15) VOLT
TYPHOON.—The term ‘‘Volt Ty-
phoon’’ means the People’s Republic of China State- 
sponsored cyber actor described in the Cybersecurity 
and Infrastructure Security Agency cybersecurity 
advisory entitled ‘‘PRC State-Sponsored Actors 
Compromise and Maintain Persistent Access to U.S. 
VerDate Sep 11 2014 
23:24 Nov 18, 2025
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2659.RFS
H2659
ssavage on LAPJG3WLY3PROD with BILLS