Summary#
The Telecommunications Cybersecurity and Resilience Act would create a new law; it does not amend another Act. It would establish a public-private advisory working group within the National Telecommunications and Information Administration (NTIA) to develop voluntary cybersecurity practices and a certification process. Its stated goal is to encourage voluntary alignment across the telecommunications sector; the bill does not guarantee better cybersecurity. It has been introduced and referred to a Senate committee, and is not law.
- The working group must develop and update cybersecurity practices and guidance, and create a network of independent third-party assessors. The Cybersecurity and Infrastructure Security Agency (CISA) would issue and maintain the practices; NTIA would convene the group and provide its administrative home.
- Carriers and other eligible entities may choose whether to adopt the practices and seek certification. The bill does not require them to do either.
- The Assistant Secretary of Commerce for Communications and Information would approve certification criteria, set up an assessor designation process, and approve or reject proposed certifications.
- An approved certification could provide an affirmative defense in state or federal court that the entity used due care or acted reasonably, subject to exceptions including gross negligence or failure to materially implement and maintain the practices.
- State or local governments could not enforce cybersecurity requirements that are inconsistent with the Act against a certified entity. The bill does not give federal agencies general new power to regulate or audit entities’ cybersecurity operations.
What it means for you#
- Telecommunications carriers and eligible suppliers: You could choose to adopt the practices and seek certification; the bill does not make adoption or certification mandatory. A certified entity must routinely implement and maintain cybersecurity practices aligned with the practices during its certification period.
- Certified entities: Certification would last no more than two years and require a comprehensive reassessment to renew. It could provide a legal defense and protection from inconsistent state or local cybersecurity requirements, but it is not immunity from liability.
- Employees of covered companies and assessors: The bill would prohibit retaliation for lawful reporting or assistance with an investigation into conduct reasonably believed to involve non-compliance or misrepresentation about certification.
- Federal agencies: NTIA, CISA, and other named agencies would have roles in creating, publishing, coordinating, and reporting on the practices and certification process.
- Customers and the general public: The bill does not directly change telecommunications service, customer rights, or prices.
Money#
The bill assigns federal work but provides no cost estimate or appropriation amount.
- No publicly available information on the expected cost of staffing and running the working group, certification process, or required reports.
- The bill does not state who pays for ordinary assessments. If an early reassessment finds that an entity materially failed to follow the practices, that entity must pay the reassessment costs.
What is unclear#
- The working group must develop the practices, assessor criteria, and processes after enactment; the bill does not set out their full details.
- The bill does not say what ordinary assessments will cost or who will pay for them.
- The Assistant Secretary may withhold detailed implementation guidance if release could create cybersecurity risks. The bill does not specify how much guidance might be withheld.
- The bill does not define “materially failed” or explain how courts should decide whether a state or local requirement is “inconsistent” with the Act.
- The bill refers to a separate policy directive for what counts as a significant cyber-incident; that definition is not included in the supplied text.
Case for#
- A possible argument for the bill is that shared, risk-based practices could give carriers and suppliers a common voluntary guide without requiring every entity to use the same approach.
- Independent assessors and government approval could provide a way to check whether an entity has implemented the practices it chose to adopt.
- The bill would allow a certified entity to use certification as evidence of due care or reasonableness, while retaining exceptions for serious failures or misconduct.
- The working group would include federal agencies, carriers, suppliers, state and local network operators, and independent experts, bringing different perspectives into the guidance.
Case against#
- Because adoption and certification are voluntary, entities could opt out; the bill does not guarantee a common cybersecurity baseline across the sector.
- Certification could limit state and local cybersecurity requirements for certified entities, even though the bill does not fully explain how conflicts would be determined.
- A certified entity could receive a legal defense, but the bill does not spell out how that defense would work in particular cases.
- Certification, reassessment, and federal administration may cost money, but the bill provides no overall cost estimate or ordinary assessment payment rules.
- Some implementation guidance could be withheld from the public, limiting what customers and other observers can see about the practices.