Review - HR 10569 Introduced – CISA and Biosecurity

Last month, Rep Khanna (D,CA) introduced HR 10569, the Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act. The bill would amend 6 USC 652 to require CISA to treat biotechnology and biomanufacturing as critical infrastructure even though it does not have a designated Sector Specific Agency designation. No new funding is authorized by this bill. 

According to a press release from the office of Rep Peters (D,CA), a cosponsor of this bill: 

“America’s leadership in the sector is a strategic advantage we cannot take for granted. As technology advances and our adversaries grow more capable, American national security, public health, and competitiveness will continue to face more serious threats. Our legislation will strengthen America’s biotech ecosystem against cyber threats, supply chain disruptions, and other vulnerabilities. To maintain our leadership in biotechnology, we need to make sure that the United States remains a safe place to innovate.” 

Moving Forward  

Neither Khanna, nor his two cosponsors, are members of the House Homeland Security Committee to which this bill was assigned for consideration. This means that there is little chance of the bill being considered by that Committee. I would not expect that Committee to consider the bill because of its reliance on the outdated ‘Sector-Specific Agency’ terminology. 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-10569-introduced-cisa-and-biosecurity - subscriptions required. 

Short Takes – 10-15-26 - Federal Register Edition

Facility Response Plan 

Clean Water Act Hazardous Substance Facility Response Plans: Compliance Date Delay and Changes to Reflect Administration Policy. EPA final rule. Summary: “The Environmental Protection Agency (EPA) is finalizing an extension to the compliance date for Facility Response Plans (FRPs) required by the Clean Water Act (CWA) addressing potential worst-case discharges of CWA hazardous substances. These requirements apply to onshore non-transportation-related facilities that could reasonably be expected to cause substantial harm to the environment from a CWA hazardous substance worst-case discharge to navigable waters, adjoining shorelines, or the exclusive economic zone. This action is also finalizing language modifications to remove references to climate change and environmental justice in the FRP requirements to align with Executive Order 14148 [link added] of January 20, 2025. EPA is revising the compliance deadlines in light of serious concerns that facilities may be unable to comply with the relevant requirements by the existing deadline. These changes are necessary to allow the Agency to consider implementation and compliance assistance tools that regulated facilities may be able to take advantage of when complying with the new requirements, and to ensure proper planning for all communities while promoting a science-based and risk-based approach to planning. EPA also recognizes that a delay would provide time for EPA to consider whether revisions are necessary before facilities must comply.” 

TSCA  

Trichloroethylene (TCE); Regulation Under the Toxic Substances Control Act (TSCA); Compliance Date Extensions. EPA notice of proposed rulemaking. Summary: “The Environmental Protection Agency (EPA or Agency) is proposing to extend certain compliance dates applicable to certain entities subject to the regulation of trichloroethylene (TCE) under the Toxic Substances Control Act (TSCA) until December 31, 2027, including for certain chemical processors in meeting the prohibition compliance deadline for the processing of TCE, industrial and commercial use of TCE as a processing aid, and associated wastewater disposal; and for refrigerant manufacturers in meeting the compliance deadline for phasing down TCE feedstock in the production of HFC-134a. This proposed compliance extension would allow for necessary and reasonable transition periods for regulated entities under TSCA section 6(d).” 

Space Geek  

Notice of Intent to Prepare a Programmatic Environmental Impact Statement (PEIS), Open Public Scoping Period, and Hold Public Scoping Meetings on the Proposed SpaceX Starship-Super Heavy Launch and Landing Operations at the Boca Chica Launch Site at Starbase, Texas and Expansion of Starship Landing and Expenditure Locations. FAA notice of intent to prepare PEIS. Summary: “In accordance with the National Environmental Policy Act of 1969, as amended (NEPA) and FAA Order 1050.1G, FAA National Environmental Policy Act Implementing Procedures, FAA is announcing its intent to prepare a PEIS analyzing Space Exploration Technologies Corp.'s (SpaceX) proposal to increase Starship-Super Heavy operations at the Boca Chica Launch Site at Starbase, TX and expand Starship landing and expenditure locations. Subsequent license modifications or renewals under 14 CFR part 400 are within the scope of the PEIS, and the issuance of temporary airspace closures associated with the Proposed Action are included in FAA's Federal Action. FAA is requesting comments concerning the scope and content of the PEIS. A Draft PEIS will be released for public review and comment at a later date.” 

Executive Orders 

EO 14435 - Emergency Tax Relief on Diesel Fuel. 

OMB Approves FCC Satellite Spectrum Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that approved a final rule from the FCC on “Satellite Spectrum Abundance (SB Docket No. 25-180)”. The notice of proposed rulemaking was published on June 27th, 2025. 

According to the 2026 Unified Agenda entry for this rulemaking: 

“On May 22, 2025, the Commission adopted a Notice of Proposed Rulemaking to seek further comment on ways to use the 12.7-13.25 GHz band (12.7 GHz band) and the 42.0-42.5 GHz band (42 GHz band) more efficiently and intensively. Specifically, the item seeks comment on the possibility of achieving more intensive use of the 12.7 GHz band by satellite communications through the removal of existing regulatory restrictions and the opening of the band to a wider range of satellite operations. Likewise, it seeks comment on the potential for more intensive use of the 42 GHz band by adding for the first time an allocation for fixed-satellite service (FSS). In both instances, the item seeks comment on ways to protect any incumbent spectrum users in the bands, as well as ways to protect spectrum users, particularly Federal operators, in adjacent bands.” 

This final rule will be covered under my limited Space Geek coverage and its publication will be reported in the appropriate Short Takes post. 

2 Advisories Published – 10-13-26

Today CISA’s NCCIC-ICS published two control system security advisories for products from Swann and Inductive Automation. 

Advisories  

Swann Advisory - This advisory describes three missing authentication for critical function vulnerabilities in the Swann Communications SWIFI-SE2KIC WiFi camera. The vulnerabilities were reported to CISA by Elliott Phillips. 

Inductive Automation Advisory - This advisory describes an incorrect authorization vulnerability in the Inductive Automation Ignition Software. The vulnerability was reported by Tim Hemingway. 

Review - Vulnerability Notifications

Last week I discussed HR 10671, the Securing Our Critical Infrastructure Act. The bill would require CISA to establish a vulnerability notification program for water facilities. Today, I would like to take a brief look at how such a program might work. 

Unfortunately, it is not really possible to produce a short version of the post that appears on my CFSN Detailed Analysis blog- https://patrickcoyle.substack.com/p/vulnerability-notifications - subscription required. It addresses the following topics: 

• Notification Agency,   
• Identification of Vulnerabilities, 
• Vulnerable Device Identification, 
• Notification Process, 
• Facility Response,   
• KEV Special Case,   
• Other Routes of Attack, and    
• Program Drawbacks   

The article will be removed from the normal paywall tomorrow. 

HR 10083 Introduced – Water Cyber Grant Reauthorization

Back in August, Rep Cisneros (D,CA) introduced HR 10083, the Water Technology and Resilience Reauthorization Act. This bill is a clean reauthorization of the EPA’s Advanced drinking water technology grant program {42 USC 300j-19h(b)}. Technically, no new funding is authorized by this bill; it continues the current $10 million annual funding authorization. 

According to a press release from Cisneros’ office:  

“The grant funding would be used to invest in technologies that address cybersecurity vulnerabilities in drinking water systems. Recent reports showed that at least seven U.S. states have reported cyberattacks affecting water infrastructure to the FBI. The Metropolitan Water District of Southern California signed on as a supporting organization.” 

The bill would amend §300j-19h(b)(5)(A) to read: 

“(A) Authorization of appropriations - There is authorized to be appropriated to carry out the program $10,000,000 for each of fiscal years 2022 through 2026 2027 through 2031, to remain available until expended.” 

Grants under this program can be used to fund “technology that could address cybersecurity vulnerabilities” {§300j-19h(b)(1)(A)(ii) and (iii)} 

Moving Forward  

While Cisneros is not a member of the House Energy and Commerce Committee to which the bill was referred for consideration, but one of his eight cosponsors, Rep Carter (D,LA), is a member of the Committee. This means that there may be sufficient influence to see the bill considered by that Committee. While I do not expect any organized opposition to this bill, I would be very surprised to see any action on the bill this late in the session. 

Even without this bill, Congress could fund this program in the FY 2027 spending bill, but it was not included in the House IER spending bill (HR 9171). But the water facility cybersecurity situation became more of a recognized problem after that bill was crafted, so the grant funding could still end up in the year end spending mix.