This legislation reauthorizes the Cybersecurity Act of 2015, extending its provisions until 2035, with a focus on strengthening national cybersecurity defenses and adapting to modern threats. It introduces new definitions for key terms such as artificial intelligence, critical infrastructure, and Sector Risk Management Agencies, reflecting the evolving landscape of cyber threats. These updates aim to ensure the Act remains relevant and effective in protecting vital information systems and infrastructure.

The bill mandates significant updates to federal procedures for sharing cybersecurity information, emphasizing the rapid dissemination of actionable cyber threat indicators and defensive measures to state, local, tribal, and territorial governments, as well as non-federal critical infrastructure owners. It explicitly authorizes and encourages the use of artificial intelligence for preventing, detecting, analyzing, and mitigating cybersecurity threats across federal and non-federal entities. Furthermore, the legislation requires the Secretary of Homeland Security to develop and implement a continuous outreach plan to educate critical infrastructure owners, particularly small and rural operators, on the benefits and processes of sharing cyber threat information.

Key amendments include clarifying that shared information retains copyright or trade secret protection and allowing its use to rapidly inform Sector Risk Management Agencies about potential threats. The bill also expands the scope of biennial cybersecurity threat reports to specifically include ransomware and prepositioning activities, ensuring a comprehensive understanding of emerging attack vectors. Conforming amendments update definitions within the Homeland Security Act to encompass modern cybersecurity vulnerabilities and technologies, including operational technology and Internet of Things devices impacted by ransomware.