PlainBillCongress, translated.Legislation. Context. Public interest.Referred to the House Committee on Homeland Security.
Congressional Research Service
No official summary is available in the imported record yet.
People & committees
Rep. Gottheimer, Josh [D-NJ-5] · D–NJ
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Referred to the House Committee on Homeland Security.
Introduced in House
Introduced in House
Primary sources
Text links open the official source. We also preserved the text version used in the PlainBill explanation below.
No related bills are listed in this snapshot. This does not establish whether the proposal has appeared in earlier Congresses.
Source last updated: Oct 16, 2026. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze H.R.10671 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine H.R.10671 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine H.R.10671 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine H.R.10671 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.
PlainBill explanation
Based on the full Introduced in House · 2026-10-01 text. This explanation has not received human editorial review. This overview describes the proposal’s major provisions; it does not establish what its real-world effects would be.
The proposed Securing Our Critical Infrastructure Act would broaden a federal cybersecurity warning program beyond its ransomware focus and end its pilot designation. Water and wastewater utilities and other entities meeting the bill's definition of covered utility would be automatically enrolled in applicable cybersecurity services, with an option to leave. Covered utilities would receive incident response assistance if the Director determined they had been affected by a cyber incident, as appropriate. The bill would also protect information shared through the program from public disclosure and restrict its use. The program would end five years after enactment of the termination provision.
This Act may be cited as the Securing Our Critical Infrastructure Act.
by striking associated with common ransomware attacks; (3) by striking pilot each place it appears;
(k) Covered utility defined In this section, the term covered utility means an entity that is any of the following: (1) A water or wastewater utility that serves not more than 100,000 individuals. (2) An eligible entity (as such term is defined in section 40124 of the Infrastructure Investment and Jobs Act (42 U.S.C. 18723)). (3) An operator of any of the following: (A) A public water system (as such term is defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f)). (B) Treatment works (as such term is defined in section 212 of the Federal Water Pollution Control Act (33 U.S.C. 1292)).
the Director shall automatically enroll in the applicable cyber hygiene services of the Cybersecurity and Infrastructure Security Agency each covered utility.
A covered utility enrolled in a cyber hygiene service pursuant to paragraph (1) may disenroll from such service by submitting to the Director notice of such disenrollment.
if the Director determines that a covered utility has been affected by a cyber incident, the Director shall utilize the incident response capabilities of the Cybersecurity and Infrastructure Security Agency to carry out on behalf of such utility a response to such incident, as appropriate.
Information shared by a covered entity with respect to the program established under subsection (a) is exempt from disclosure under section 552(b)(3) of title 5, United States Code, and any provision of State, local, or Tribal freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.
The Director may not disclose, retain, or use information shared by a covered entity with respect to the program established under subsection (a) unless such disclosure, retention, or use, as the case may be, is for a purpose specified in subsection (d)(5)(A) of section 105 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1504).
The program established under subsection (a) shall terminate on the date that is five years after the date of the enactment of this subsection.
Section 2 would amend the existing vulnerability warning program to establish a security vulnerability warning program within the Cybersecurity and Infrastructure Security Agency. It would remove the pilot designation and language tying vulnerabilities to common ransomware attacks, and replace another ransomware reference with language about information systems and related mitigation techniques.
Section 105 of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (6 U.S.C. 652 note) is amended—
(1) in the heading— (A) by striking Ransomware and inserting Security; and (B) by striking pilot;
(2) in subsection (a)— (A) by striking Not later than 1 year after the date of enactment of this Act, the Director shall establish a ransomware vulnerability warning pilot program and inserting There is established in the Cybersecurity and Infrastructure Security Agency a security vulnerability warning program; and (B) by striking associated with common ransomware attacks; (3) by striking pilot each place it appears; (4) in subsection (b)(1), by striking utilized in ransomware attacks and mitigation techniques and inserting for information systems, and mitigation techniques relating thereto;
The bill would replace “covered entities” with “covered utilities” in the existing program's subsection (d). The supplied text does not reproduce that subsection, so it does not establish the full practical effect of this substitution.
(5) in subsection (d), by striking covered entities and inserting covered utilities;
Covered utilities would include water or wastewater utilities serving no more than 100,000 people, entities meeting the referenced infrastructure law's definition of “eligible entity,” and operators of legally defined public water systems or treatment works. The 100,000-person limit appears only in the first category; the other categories use separate statutory definitions. Those referenced definitions are not supplied, limiting what can be concluded about the full scope of eligibility.
(k) Covered utility defined In this section, the term covered utility means an entity that is any of the following: (1) A water or wastewater utility that serves not more than 100,000 individuals. (2) An eligible entity (as such term is defined in section 40124 of the Infrastructure Investment and Jobs Act (42 U.S.C. 18723)). (3) An operator of any of the following: (A) A public water system (as such term is defined in section 1401 of the Safe Drinking Water Act (42 U.S.C. 300f)). (B) Treatment works (as such term is defined in section 212 of the Federal Water Pollution Control Act (33 U.S.C. 1292)).
The agency's Director would have to automatically enroll every covered utility in applicable “cyber hygiene” services, the bill's term for these cybersecurity services. A utility could leave a service by notifying the Director. The bill does not describe the services in detail.
(g) Cyber hygiene services (1) Automatic enrollment As part of the program established under subsection (a), the Director shall automatically enroll in the applicable cyber hygiene services of the Cybersecurity and Infrastructure Security Agency each covered utility. (2) Disenrollment A covered utility enrolled in a cyber hygiene service pursuant to paragraph (1) may disenroll from such service by submitting to the Director notice of such disenrollment.
If the Director determined that a covered utility had been affected by a cyber incident, the Director would have to use the agency's incident response capabilities to respond on the utility's behalf, as appropriate. The provision makes assistance conditional on that determination and appropriateness.
(h) Incident response As part of the program established under subsection (a), if the Director determines that a covered utility has been affected by a cyber incident, the Director shall utilize the incident response capabilities of the Cybersecurity and Infrastructure Security Agency to carry out on behalf of such utility a response to such incident, as appropriate.
Information a covered entity shared concerning the program would be exempt from disclosure under the cited federal provision and state, local, or Tribal laws requiring public access to information or records. This provision uses “covered entity”; the supplied text does not define that term or establish that its scope is identical to “covered utility.”
(2) Exemption from disclosure Information shared by a covered entity with respect to the program established under subsection (a) is exempt from disclosure under section 552(b)(3) of title 5, United States Code, and any provision of State, local, or Tribal freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.
The Director could disclose, retain, or use information shared by a covered entity concerning the program only for purposes specified in a provision of the Cybersecurity Information Sharing Act of 2015. Those permitted purposes are not reproduced in the source bundle.
(3) Prohibited activity The Director may not disclose, retain, or use information shared by a covered entity with respect to the program established under subsection (a) unless such disclosure, retention, or use, as the case may be, is for a purpose specified in subsection (d)(5)(A) of section 105 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1504).
When retaining information shared by a covered entity concerning the program, the Director would have to protect personal information about specific individuals and information identifying them from unauthorized use or disclosure.
(4) Privacy The Director shall retain information shared by a covered entity with respect to the program established under subsection (a) in a manner that protects from unauthorized use or disclosure any of the following: (A) Any personal information that is of a specific individual and included in such retained information. (B) Any information that identifies a specific individual and is included in such retained information.
The Director would have to coordinate with the Environmental Protection Agency's Administrator when carrying out the program.
(i) Coordination In carrying out the program established under subsection (a), the Director shall coordinate with the Administrator of the Environmental Protection Agency.
The program would terminate five years after enactment of the new termination subsection. This is a deadline measured from enactment, not from the bill's introduction.
(j) Termination The program established under subsection (a) shall terminate on the date that is five years after the date of the enactment of this subsection.
The supplied official-actions snapshot, updated October 16, 2026, records introduction in the House and referral to the House Committee on Homeland Security on October 1, 2026. This snapshot does not establish subsequent legislative action or enactment.
Source snapshot updated 2026-10-16T03:22:14Z. 2026-10-01: Referred to the House Committee on Homeland Security. 2026-10-01: Introduced in House
A closer look
Reviewed version: Introduced in House · 2026-10-01. These findings describe provisions and who may benefit; they are not judgments of waste, corruption, or motive.
This review covers the supplied bill text. “None identified” does not rule out provisions in later versions or accompanying reports and disclosures.
Provisions outside the bill’s main subject, or policy changes attached to appropriations.
None identified in the reviewed text
No unrelated provision or policy change attached to appropriations was identified after reviewing the complete supplied introduced text. This conclusion is limited to that version and does not establish absence in other versions or accompanying materials.
Spending directed to particular recipients or places outside ordinary competitive or formula-based allocation.
None identified in the reviewed text
No congressionally directed spending for particular recipients or places was identified after reviewing the complete supplied introduced text. This conclusion is limited to that version and does not establish absence in other versions or accompanying materials. Materials that could establish formal earmark status are not supplied.
Narrow exceptions, exemptions, or preferential treatment that warrant a closer look.
Findings to examine
A narrow legal exemption is identified below. This classification is not a judgment about its justification.
Covered entities sharing information concerning the program would receive a specific confidentiality protection: that information would be exempt from disclosure under the cited federal provision and state, local, or Tribal public-access laws. This exemption directly relates to information sharing under the bill's cybersecurity program. The supplied text does not define “covered entity,” so the full scope of beneficiaries remains uncertain.
(2) Exemption from disclosure Information shared by a covered entity with respect to the program established under subsection (a) is exempt from disclosure under section 552(b)(3) of title 5, United States Code, and any provision of State, local, or Tribal freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records.
Full text preserved for this analysis. Legislative record snapshot: Oct 16, 2026. How PlainBill uses AI