Congress mandates FEMA cybersecurity duty, demands progress report
H.R. 4579 — FEMA Cybersecurity Improvement Act · Filed by Bennie Thompson (D-MS) · Introduced Jul 21, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill adds cybersecurity risk mitigation to FEMA's statutory duties under the Homeland Security Act and requires FEMA to submit a progress report to Congress within one year on how it is addressing cybersecurity threats to its own operations. The bill does not create new funding, new enforcement powers, or new restrictions on private entities—it clarifies FEMA's internal operational mandate and creates a reporting requirement to Congress.
Why we flagged it
The bill's operative mechanism is to add cybersecurity risk mitigation as an explicit statutory duty for FEMA and require reporting to Congress. This is a straightforward accountability and transparency measure, not a subsidy, deregulation, or private carve-out.
What the text implies
- The bill references 'section 2200' for the definition of 'cybersecurity risks' but does not restate that definition in this text. The operative scope of FEMA's new duty depends on what section 2200 actually says—a limit of this analysis, not a defect of the bill.
- The one-year reporting deadline creates a near-term accountability checkpoint but does not establish ongoing reporting cadence; Congress may need to revisit the reporting requirement if it wishes continuous oversight.
- The bill does not appropriate funds for FEMA cybersecurity improvements, so implementation depends on FEMA's existing budget and prioritization—the statutory duty may exceed available resources.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Citizens depend on FEMA for emergency response; a cybersecurity breach could cripple disaster relief. This bill makes cybersecurity a statutory duty for FEMA and mandates public reporting to Congress, improving accountability and reducing the risk that cyber vulnerabilities in emergency systems go unaddressed. There is no offsetting cost to citizens.
Named in the bill
Federal Emergency Management Agency (FEMA), Cybersecurity and Infrastructure Security Agency (CISA), House Committee on Homeland Security, House Committee on Transportation and Infrastructure, Senate Committee on Homeland Security and Governmental Affairs, Homeland Security Act of 2002
Where it stands
- Jul 21, 2025 — Introduced · Congress.gov: “Introduced in House”
- Jul 21, 2025 — Referred to House Committee on Transportation and Infrastructure and House Committee on Homeland Security · Congress.gov: “Referred to the Committee on Homeland Security, and in addition to the Committee on Transportation and…”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,291 characters) on Jul 2, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Congress mandates FEMA cybersecurity duty, demands progress report” QuorumCivic. https://share.quorumcivic.app/bill/119/hr4579 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.