RESILIENCE Act of 2026

Not later than one year after the date of the enactment of this Act, the Director shall establish a one-year pilot program for appropriate State, local, Tribal, and territorial government officials to be trained by appropriate Agency officials regarding carrying out security vulnerability or terrorism risk assessments of critical infrastructure facilities.

Not later than 180 days after the completion of the pilot program under paragraph (1), the Director shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the pilot program.

Subsection (c) of section 2202 of the Homeland Security Act of 2002 (6 U.S.C. 652) is amended—

(A) by redesignating paragraphs (6) through (14) as paragraphs (7) through (15), respectively; and

(B) by inserting after paragraph (5) the following:

(6) maintain one or more clearinghouses for owners and operators of critical infrastructure and other relevant stakeholders, which may include nonprofit organizations, to access security guidance, best practices, and other voluntary content developed by the Agency, or aggregated from trusted sources, in a manner consistent with the requirements of section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) and the Plain Writing Act of 2010 (5 U.S.C. 301 note; Public Law 111–274);.

The Director shall make publicly available, on an annual basis, a report detailing outreach the Agency has conducted to critical infrastructure owners and operators regarding security guidance, best practices, and other voluntary content. Each such report shall include the following:

(A) A summary regarding how the Agency determines methods and frequency of outreach.

(B) The various methods of outreach carried out by the Agency, including briefings, emails, and conferences.

(C) For each such method of outreach, a summary of such outreach that has been carried out—

(i) to each of the 16 critical infrastructure sectors;

(ii) in rural, suburban, and urban areas;

(iii) by each regional office of the Agency; and

(iv) through protective security advisors and governmental coordinating councils.

(D) Detailed plans to expand outreach to critical infrastructure owners and operators.

Chapter 35 of title 44, United States Code (commonly known as the Paperwork Reduction Act), shall not apply to any rulemaking or information collection required under this section or paragraph (6) of section 2202(c) of the Homeland Security Act of 2002, as amended by subsection (b).

Nothing in this section or the amendments made by this section may be construed to create, satisfy, or waive any requirement under Federal civil rights laws, including the following:

(1) Title II of the Americans With Disabilities Act of 1990 (42 U.S.C. 12131 et seq.).

(2) Title VI of the Civil Rights Act of 1964 (42 U.S.C. 2000d et seq.).

In this section:

The term Agency means the Cybersecurity and Infrastructure Security Agency of the Department.

The term Department means the Department of Homeland Security.

The term Director means the Director of the Agency.

The term nonprofit organization means—

(A) an organization of the type described in subsection (c)(3) of section 501 of the Internal Revenue Code of 1986 and exempt from taxation under subsection (a) of such section; and

(B) determined by the Secretary to be at risk of a terrorist attack.