Farm and Food Cybersecurity Act of 2025
The Farm and Food Cybersecurity Act of 2025 would require the Secretary of Agriculture, working with the Cybersecurity and Infrastructure Security Agency, to conduct a biennial risk assessment of cybersecurity threats and vulnerabilities affecting the agriculture and food critical infrastructure sector. The assessment would examine the nature of cyberattacks, their potential effects on food safety, availability, public health, the economy, and national security, as well as the readiness of federal, state, local, and private-sector entities to prevent, detect, respond to, and recover from such incidents. It would also review existing policies and identify gaps, barriers, and recommendations for legislative or administrative action, including concerns about duplicative or conflicting regulations that may hinder operational security efforts.
The bill also directs the Secretary of Agriculture, in coordination with other federal agencies, to conduct an annual cross-sector crisis simulation exercise over five years focused on a food-related emergency or disruption. These exercises would be designed to test preparedness, improve coordination and information sharing, identify weaknesses in the food supply chain and critical infrastructure, and generate best practices and recommendations. The exercises are intended to include a broad range of participants from government, industry, academia, and cybersecurity stakeholders, including the Food and Agriculture-Information Sharing and Analysis Center and sector coordinating councils. The bill authorizes $1 million annually for fiscal years 2026 through 2030 to carry out the simulation program.
If enacted, the bill would add a new federal planning, assessment, and exercise mandate for the agriculture and food critical infrastructure sector, expanding the Department of Agriculture’s role in cybersecurity resilience. It would require recurring reports to Congress and formal consultation with private-sector and interagency partners, while potentially influencing future federal guidance, preparedness standards, and policy changes affecting farms, processors, distributors, retailers, and related infrastructure operators. The bill does not directly impose operational cybersecurity requirements on private entities, but it could shape federal oversight and interagency coordination in this sector.
Based on the bill text and the absence of recorded committee debate or votes, the measure appears to have a generally supportive and bipartisan framing. Its sponsors include senators from both parties, and the bill emphasizes preparedness, resilience, and coordination rather than regulation or enforcement. The inclusion of private-sector consultation and language cautioning against duplicative or conflicting requirements suggests an effort to make the proposal broadly acceptable to industry and policymakers concerned with practical implementation.
The main point of potential contention is the scope of federal involvement in a sector that includes both public and private actors, especially the bill’s requirement for recurring assessments and annual simulation exercises. Some stakeholders may be concerned about the administrative burden, the effectiveness of federal coordination, or whether the bill could lead to additional regulatory expectations despite its stated intent to avoid compliance-heavy approaches. Another possible issue is how broadly the agriculture and food critical infrastructure sector is defined, since it covers the full chain from production through disposal and includes consumers and regulators, which may raise questions about implementation and stakeholder inclusion.