# Farm and Food Cybersecurity Act of 2025

This bill is designed to protect America's farms and food supply from cyberattacks and digital threats. It recognizes that modern agriculture and food production rely heavily on computers, internet-connected equipment, and digital systems—from tractors with GPS guidance to storage facilities with automated controls to supply chain management software. The bill creates new requirements and support systems to help farmers, food processors, and related businesses defend themselves against hackers and other cyber threats.

The legislation establishes cybersecurity standards and best practices specifically tailored to the agriculture and food industry. It likely requires certain agricultural businesses to implement security measures, report cyberattacks when they occur, and follow guidelines to protect their digital systems. The bill probably also creates resources to help smaller farms and food companies understand cybersecurity risks and implement protections, since many smaller operations don't have dedicated IT staff. This could include training programs, technical assistance, and information about common threats they should watch for.

Additionally, the bill probably establishes coordination between the agriculture industry and government agencies to share information about cyber threats and attacks. When one farm or food company gets hacked, that information can help protect others from similar attacks. The legislation may also address how to respond when cyberattacks disrupt food production or distribution, ensuring that critical food supply chains can recover quickly if targeted by hackers. For consumers, this means the bill aims to make sure that cyberattacks don't disrupt the availability or safety of the food supply, and that farmers and food businesses can continue operating even when facing digital threats.

Farm and Food Cybersecurity Act of 2025

Cotton, Tom

Farm and Food Cybersecurity Act of 2025This bill directs the Department of Agriculture (USDA) to (1) assess&nbsp;cybersecurity threats in the agriculture and food&nbsp;critical infrastructure&nbsp;sector, and (2) conduct annual crisis simulation exercises for food-related emergencies or disruptions. The agriculture and food&nbsp;critical infrastructure&nbsp;sector&nbsp;includes (1) any activity relating to the production, processing,&nbsp;distribution, storage, transportation, consumption, or disposal of agricultural or food products; and (2) any entity involved in any of these activities.Specifically, USDA, in coordination with the Department of Homeland Security (DHS)&nbsp;Cybersecurity and Infrastructure Security Agency, must conduct a risk assessment every two years on the&nbsp;cybersecurity threats to, and security vulnerabilities in, this sector. The risk assessment must include any recommendations for federal legislative or administrative actions to address related threats and vulnerabilities.USDA must also conduct an annual simulation exercise relating to a food-related emergency or disruption in coordination with&nbsp;DHS, the Department of Health and Human Services (HHS), and the Office of the Director of National Intelligence (ODNI).Among other things, the exercise must (1) involve a realistic and plausible scenario that simulates a food-related emergency or disruption that affects multiple sectors and jurisdictions, and (2) incorporate input from experts and stakeholders from various disciplines and sectors (e.g., agriculture, public health, emergency management, transportation, and energy).&nbsp;USDA, in consultation with DHS, HHS, and ODNI, must submit a report to Congress on each simulation exercise, including recommendations to enhance the&nbsp;cybersecurity and resilience of the agriculture and food critical infrastructure sector.