Combat Emerging Threats to Critical Infrastructure Act of 2026

This bill requires the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to update sector-specific plans for 16 critical infrastructure sectors to address risks from disruptive technologies like artificial intelligence and digital assets, and to report the updated plans to Congress.

Sec. 2, Definitions: Defines key terms used in the bill, including 'artificial intelligence' (as defined in the National Artificial Intelligence Initiative Act of 2020), 'digital asset' (as defined in the GENIUS Act), 'Director' (meaning the CISA Director), 'National Security Memorandum 22' (the 2024 memorandum on critical infrastructure resilience), and 'Sector Risk Management Agency' (as defined in the Homeland Security Act of 2002).

Sec. 3, Sector Risk Management Agency Sector-Specific Plans: Within one year of enactment, the Director must update sector-specific plans for 16 named sectors (e.g., Chemical, Energy, Financial Services, Healthcare). The updates must incorporate risk management practices for technology-facilitated threats, including malicious use of artificial intelligence, social engineering, and digital manipulation. For the Financial Services Sector, the Director must coordinate with the Treasury Secretary to assess digital asset vulnerabilities from quantum computing. The Director must coordinate with relevant Sector Risk Management Agencies and, within 30 days of completion, provide copies of each updated plan to specified congressional committees.

Sec. 4, Biennial Reassessment: At least every two years after the initial update, the Director must reassess and revise each sector-specific plan. Within 30 days of each revision, the Director must inform and provide copies of the updated plans to the relevant congressional committees in the same manner as the initial update.