This bill requires the Secretary of the department where the Coast Guard operates to assess cybersecurity risks for certain software and hardware used at specified maritime facilities. The Secretary must do these assessments in coordination with the Director of the Cybersecurity and Infrastructure Security Agency (CISA). Assessments must begin within one year of the bill and happen every year after that. The bill lets the Secretary ignore end-user license agreements or contracts that would block an assessment, and lets the Secretary assess systems without needing the owner’s permission. Owners or operators of covered facilities must send annual reports listing covered software and hardware they use or planned to use, whether those items were made by a foreign entity or in a foreign country of concern, and any cybersecurity incidents or other risks. Owners must certify that covered software and hardware meet National Institute of Standards and Technology (NIST) standards or equivalent within the past year, or get a waiver from the Secretary. The Secretary must report yearly to congressional homeland security committees on findings, actions taken, and recommendations. Many assessment and report details are not released to the public, but the Secretary may share information with other federal entities or partners as appropriate.
If you own or operate a covered maritime facility regulated under parts 105 or 106 of 33 CFR, you will need to submit a report within 180 days of the law and then every year. Your report must list covered software and hardware in use or planned for use, note if those items were made by certain foreign entities or in certain foreign countries, and describe cybersecurity incidents and other risks. You must certify that listed systems meet NIST or equivalent standards within the past year, unless the Secretary grants a waiver. The Department (through the Coast Guard) and CISA will be able to assess your facility’s software and hardware annually, even if contracts or consent would otherwise block access.
No publicly available information on costs, appropriations, or funding mechanisms is included in the bill text provided.
No publicly available information in the bill text about supporters' stated arguments or reasons for the bill.
No publicly available information in the bill text about opponents' stated objections or concerns.