The Insure Cybersecurity Act of 2025 requires the Assistant Secretary of Commerce for Communications and Information to create a working group on cyber insurance within 90 days of the law taking effect. The working group must include representatives from CISA, NIST, the Treasury Department, the Department of Justice, the Federal Trade Commission, and at least one State insurance regulator. The Assistant Secretary will chair the group.
The working group must define or refine the term "cyber insurance," explain common policy terms in plain language, and show how policy provisions map to common cyber incidents (including ransomware) and to common customer responses such as system recovery and possible ransom payments. The group must also explain coverage inclusions and exclusions, describe constraints issuers face when covering large losses (for example reputational loss or intellectual property loss), and develop guidance customers can use to evaluate coverage levels. The group will gather input from issuers about ways to expand coverage (such as better actuarial and cyber risk data, information sharing, and measuring customer cybersecurity practices) and identify measures that could lower policy costs and reduce cyber risk and incidents.
The working group must consult publicly with issuers, agents and brokers, business and small business representatives, academia, state regulators, owners and operators of critical infrastructure, and other experts. It must submit a report to Congress within one year after it first meets and terminates when the report is submitted. The statute says the working group’s recommendations do not have to be adopted and that the group does not gain new authority to regulate insurance.
After the report is submitted, the Assistant Secretary must publish informative resources on the NTIA public website within 90 days. Those resources must incorporate the working group’s recommendations, be useful to many stakeholders (issuers, agents, brokers, and customers), include case studies where appropriate, and be promoted through outreach. Use of the resources is voluntary.
No publicly available information on costs or appropriations. The bill text does not specify funding or authorize particular appropriations.
No publicly available information on proponents' arguments in the bill text or metadata.
No publicly available information on opponents' arguments in the bill text or metadata.