,,ii #aaeth ,,congress #ast ,session ,s4 #bjbj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #bf1 #bjag,mr4 ,markey introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish a voluntary program to identify and promote ,internet-connected products that meet industry-leading cybersecurity and data security standards1 guidelines1 best practices1 methodologies1 procedures1 and processes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,shield ,act of #bjag4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,advisory ,committee means the ,cyber ,shield ,advisory ,committee established under section #c7;a72 7#b7 the term benchmarks means standards1 guidelines1 best practices1 methodologies1 procedures1 and processes2 7#c7 the term covered product means a consumer-facing physical object that can-- 7,a7 connect to the ,internet2 and 7,b7 collect1 send1 or receive data2 7#d7 the term ,cyber ,shield program means the voluntary program established under section #d7;a77#a72 and 7#e7 the term ,secretary means the ,secretary of ,commerce4 #c4 ,cyber ,shield ,advisory ,committee 7a7 ,establishment ,not later than #ij days after the date of enactment of this ,act1 the ,secretary shall establish a ,cyber ,shield ,advisory ,committee4 7b7 ,duties 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,advisory ,committee shall provide recommendations to the ,secretary regarding-- 7,a7 the format and content of the ,cyber ,shield labels required to be established under section #d2 and 7,b7 the process for identifying1 establishing1 reporting on1 adopting1 maintaining1 and promoting compliance with the voluntary cybersecurity and data security benchmarks required to be established under section #d4 7#b7 ,public availability of recommendations ,the ,advisory ,committee shall publish1 and provide the public with an opportunity to comment on1 the recommendations provided to the ,secretary under paragraph 7#a74 7c7 ,members1 chairman1 and duties 7#a7 ,appointment 7,a7 ,in general ,the ,advisory ,committee shall be composed of members appointed by the ,secretary from among individuals who are specially qualified to serve on the ,advisory ,committee based on their education1 training1 or experience4 7,b7 ,representation ,members appointed under subparagraph 7,a7 shall include-- 7i7 representatives of the covered products industry1 including small1 medium1 and large businesses2 7ii7 cybersecurity experts2 7iii7 public interest advocates2 and 7iv7 ,federal employees with expertise in certification1 covered devices1 or cybersecurity1 including employees of the ,department of ,commerce1 the ,federal ,trade ,commission1 and the ,federal ,communications ,commission4 7,c7 ,limitation ,in appointing members under subparagraph 7,a71 the ,secretary shall ensure that-- 7i7 each interest group described in clauses 7i7 through 7iv7 of subparagraph 7,b7 is proportionally represented on the ,advisory ,committee1 including-- 7,i7 businesses of each size described in such clause 7i72 7,,ii7 ,federal employees with expertise in each subject described in such clause 7iv72 and 7,,iii7 ,federal employees from each agency described in such clause 7iv72 and 7ii7 no single interest group is represented by a majority of the members of the ,advisory ,committee4 7#b7 ,chair ,the ,secretary shall designate a member of the ,advisory ,committee to serve as ,chair4 7#c7 ,pay ,members of the ,advisory ,committee shall serve without pay1 except that the ,secretary may allow a member1 while attending meetings of the ,advisory ,committee or a subcommittee of the ,advisory ,committee1 expenses authorized under section #egjc of title #e1 ,united ,states ,code1 relating to per diem1 travel1 and transportation4 7d7 ,support staff2 administrative services 7#a7 ,support staff ,the ,secretary shall provide support staff for the ,advisory ,committee4 7#b7 ,administrative services ,upon request by the ,advisory ,committee1 the ,secretary shall provide any information1 administrative services1 and supplies that the ,secretary considers necessary for the ,advisory ,committee to carry out its duties and powers4 7e7 ,no termination ,section #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,advisory ,committee4 #d4 ,cyber ,shield program 7a7 ,establishment of program 7#a7 ,in general ,the ,secretary shall establish a voluntary program to identify and certify covered products with superior cybersecurity and data security through voluntary certification and labeling of1 and other forms of communication about1 covered products and subsets of covered products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data4 7#b7 ,grades ,labels applied to products under the ,cyber ,shield program-- 7,a7 may be digital2 and 7,b7 may be in the form of different grades that display the extent to which a product meets the industry-leading cybersecurity and data security benchmarks4 7b7 ,consultation ,not later than #ij days after the date of enactment of this ,act1 the ,secretary shall establish a process for consulting interested parties1 the ,secretary of ,health and ,human ,services1 the ,commissioner of ,food and ,drugs1 the ,secretary of ,homeland ,security1 and other ,federal agencies in carrying out the ,cyber ,shield program4 7c7 ,duties ,in carrying out the ,cyber ,shield program1 the ,secretary-- 7#a7 shall-- 7,a7 establish and maintain cybersecurity and data security benchmarks1 by convening and consulting interested parties and other ,federal agencies1 for products with the ,cyber ,shield label to ensure that those products perform better than their less secure counterparts2 and 7,b7 in carrying out subparagraph 7,a7-- 7i7 engage in an open public review and comment process2 7ii7 in consultation with the ,advisory ,committee1 identify and apply cybersecurity and data security benchmarks to different subsets of covered products based on-- 7,i7 cybersecurity and data security risk2 7,,ii7 the sensitivity of the information collected1 transmitted1 or stored by the product2 and 7,,iii7 product functionality2 and 7iii7 to the extent possible1 incorporate existing benchmarks when establishing and maintaining cybersecurity and data security benchmarks2 7#b7 may not establish benchmarks under paragraph 7#a7 that are-- 7,a7 arbitrary1 capricious1 an abuse of discretion1 or otherwise not in accordance with law2 or 7,b7 unsupported by evidence2 7#c7 shall permit a manufacturer or distributor of a covered product to display a ,cyber ,shield label reflecting the extent to which the product meets the industry-leading cybersecurity and data security benchmarks established under paragraph 7#a72 7#d7 shall promote technologies that are compliant with the cybersecurity and data security benchmarks established by the ,secretary as the preferred technologies in the marketplace for-- 7,a7 enhancing cybersecurity2 and 7,b7 protecting data2 7#e7 shall work to enhance public awareness of the ,cyber ,shield label1 including through public outreach1 education1 research and development1 and other means2 7#f7 shall preserve the integrity of the ,cyber ,shield label2 7#g7 if helpful in fulfilling the obligation under paragraph 7#f71 may elect to not treat a covered product as a ,cyber ,shield-certified product until the product meets appropriate conformity standards1 which may include-- 7,a7 testing by an accredited third-party certifying laboratory or other entity in accordance with the ,cyber ,shield program2 and 7,b7 certification by the laboratory or entity described in subparagraph 7,a7 as meeting the applicable cybersecurity and data security benchmarks established by the ,secretary2 7#h7 not less frequently than once every #b years after establishing cybersecurity and data security benchmarks for a product category under paragraph 7#a71 shall review and1 if appropriate1 update the cybersecurity and data security benchmarks for that product category2 7#i7 shall solicit comments from interested parties and the ,advisory ,committee prior to establishing or revising a ,cyber ,shield product category or benchmark 7or prior to the effective date of the establishment or revision of a product category or benchmark72 7#aj7 upon adoption of a new or revised product category or benchmark1 shall provide reasonable notice to interested parties of any changes 7including effective dates7 to product categories or benchmarks1 along with-- 7,a7 an explanation of the changes2 and 7,b7 as appropriate1 responses to comments submitted by interested parties2 and 7#aa7 shall provide appropriate lead time prior to the applicable effective date for a new or a significant revision to a product category or benchmark1 taking into account the timing requirements of the manufacturing1 product marketing1 and distribution process for the product or products addressed4 7d7 ,deadlines ,not later than #b years after the date of enactment of this ,act1 the ,secretary shall establish cybersecurity and data security benchmarks for covered products under subsection 7c77#a71 which shall take effect not later than #fj days after the date on which the benchmarks are established4 7e7 ,administration ,the ,secretary1 in consultation with the ,advisory ,committee1 may enter into a contract with a third party to administer the ,cyber ,shield program if-- 7#a7 the third party is an impartial administrator2 and 7#b7 entering into the contract improves the cybersecurity and data security of covered products4 7f7 ,program evaluation 7#a7 ,in general ,not later than #d years after the date of enactment of this ,act1 and not less frequently than every #b years thereafter1 the ,inspector ,general of the ,department of ,commerce shall evaluate the ,cyber ,shield program4 7#b7 ,requirements ,in conducting an evaluation under paragraph 7#a71 the ,inspector ,general of the ,department of ,commerce shall-- 7,a7 evaluate the extent to which the cybersecurity and data security benchmarks established under the ,cyber ,shield program address cybersecurity and data security threats2 7,b7 assess how the benchmarks have evolved to meet emerging cybersecurity and data security threats2 7,c7 conduct covert testing to evaluate the integrity of certification testing2 and 7,d7 assess the costs to businesses of participating in the ,cyber ,shield program4 #e4 ,cyber shield digital product portal 7a7 ,in general ,the ,secretary shall make publicly available on the website of the ,department of ,commerce in a searchable format-- 7#a7 a web page providing information about the ,cyber ,shield program2 and 7#b7 a database of covered products certified under the ,cyber ,shield program4 7b7 ,requirements ,the database established under subsection 7a7 shall include-- 7#a7 the cybersecurity and data security benchmarks for each product category2 and 7#b7 for each covered product certified under the ,cyber ,shield program-- 7,a7 the certification for the product2 7,b7 the name and manufacturer of the product2 7,c7 the contact information for the manufacturer2 7,d7 the functionality of the product2 7,e7 the location of any applicable privacy policy2 and 7,f7 any other information the ,secretary determines necessary and appropriate4 #f4 ,rule of construction ,the decision of a manufacturer of a covered product not to participate in the ,cyber ,shield program shall not affect the liability of the manufacturer for a cybersecurity or data security breach of that covered product4