Food and Agriculture Industry Cybersecurity Support Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses cybersecurity risks in the food and agriculture industry, with strong focus on AI system security vulnerabilities (2.2), malicious actors conducting cyberattacks (4.2), and governance structures (6.5). Coverage is concentrated in security and governance domains, with minimal attention to AI-specific risks beyond security.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Agriculture, Mining, Construction & Manufacturing
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Professional & Technical Services
• Scientific Research & Development Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Agriculture, Mining, Construction and Manufacturing sector, specifically the food and agriculture industry. It also has coverage of Information sector through references to IT systems and software, and minimal coverage of Professional and Technical Services through cybersecurity consulting references.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory obligations on federal agencies, including establishment of a clearinghouse within 180 days and a GAO study within 90 days.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is titled as an 'Act' and references 'the date of enactment of this Act,' indicating it was proposed and enacted by the United States Congress as federal legislation.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: National Telecommunications and Information Administration (NTIA); Comptroller General of the United States; food and agriculture industry entities; entities that develop products with potential security vulnerabilities for the food and agriculture industry; small business concerns
• Summary: The Act targets federal agencies (NTIA and GAO) with mandatory obligations to establish a clearinghouse and conduct studies. It also targets the food and agriculture industry broadly, including developers of equipment and systems, with voluntary cybersecurity recommendations.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: National Telecommunications and Information Administration (NTIA); Government Accountability Office (GAO); United States Congress
• Summary: The NTIA is responsible for establishing and maintaining the clearinghouse, while the GAO is responsible for conducting the study and reporting to Congress. Congress receives reports and briefings, providing oversight.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Government Accountability Office (GAO); United States Congress; Cybersecurity and Infrastructure Security Agency; Sector Risk Management Agencies
• Summary: The GAO is explicitly tasked with studying and reporting on federal cybersecurity efforts for the food and agriculture industry. Congress receives reports and briefings for oversight. The document also references consultation with CISA and Sector Risk Management Agencies.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document addresses multiple AI lifecycle stages with primary focus on Deploy and Operate and Monitor stages. It covers planning through the establishment of a clearinghouse and consolidation of recommendations, and emphasizes ongoing monitoring and response to cybersecurity incidents throughout product lifetimes.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Task-specific AI

Technical Scope Summary

The document mentions AI systems implicitly through references to 'computer vision algorithms for precision agriculture' and 'information technology systems' but does not explicitly define or extensively discuss AI models, frontier AI, general purpose AI, or other specific AI categories. The focus is on cybersecurity for technology systems in the food and agriculture industry broadly.