Enacts the Critical Infrastructure Standards and Procedures Act

This bill, the Critical Infrastructure Standards and Procedures Act (CRISP Act), requires public and private entities operating critical infrastructure to follow specific cybersecurity standards. It directly affects asset owners of facilities like public transportation, water treatment plants, utilities, public buildings, hospitals, and public authorities. Key provisions mandate that these entities follow the ISA/IEC 62443 cybersecurity standards for procurement and construction of automation systems starting July 1, 2029, and for operations/maintenance starting July 1, 2027 - including annual risk assessments and mitigation plans. The law aims to strengthen cybersecurity protections for systems controlling physical infrastructure, referencing established NIST standards.