H.R. 5079 — Widespread Information Management for the Welfare of Infrastructure and Government Act

This section amends the Cybersecurity Act of 2015 (6 U.S.C. 1501 et seq.) as follows: (1) in section 102, incorporates definitions of "artificial intelligence" (from 15 U.S.C. 9401), "critical infrastructure" (from 42 U.S.C. 5195c(e)), and "Sector Risk Management Agency" (from 6 U.S.C. 650) and redesignates existing paragraphs accordingly; (2) in section 103, requires the development, issuance, and appropriate updates of procedures for federal sharing of cyber threat indicators and defensive measures, ensures federal technical assistance capabilities for non-federal entities, adds provisions for one-time read-ins to select critical infrastructure personnel, and sets a 60-day notification requirement for updates; (3) in section 104, expands authorizations for preventing cybersecurity threats to include certain Sector Risk Management Agencies, changes a requirement that information-sharing activities "shall be" privacy-protective to "may be," authorizes preclusion of non-cybersecurity AI in such activities, and permits technical capabilities to utilize cybersecurity-specific AI; and (4) in section 105, requires periodic updates to policies and guidance on non-federal sharing of cyber threat indicators and defensive measures with federal entities—prioritizing rapid dissemination to state, local, Tribal, and territorial governments and critical infrastructure owners—and directs an outreach plan by the Department of Homeland Security.