,,ii  #aaeth ,,congress  #ast ,session  
,s4 #ecf  ,,in ,,the ,,senate ,,of ,,the
 ,,united ,,states  ,march #g1 #bjag,mr4
 ,reed 7for himself1 ,ms4 ,collins1 and 
,mr4 ,warner7 introduced the following  
bill2 which was read twice and referred 
to the ,committee on ,banking1 ,housing1
 and ,urban ,affairs  ,a ,,bill  ,to    
promote transparency in the oversight of
 cybersecurity risks at publicly traded 
companies4  #a4 ,short title ,this ,act 
may be cited as the ,cybersecurity      
,disclosure ,act of #bjag4  #b4         
,cybersecurity transparency  7a7        
,definitions ,in this section--  7#a7   
the term ,commission means the          
,securities and ,exchange ,commission2  
7#b7 the term cybersecurity threat--    
7,a7 means an action1 not protected by  
the ,first ,amendment to the            
,constitution of the ,united ,states1 on
 or through an information system that  
may result in an unauthorized effort to 
adversely impact the security1          
availability1 confidentiality1 or       

integrity of an information system or   
information that is stored on1 processed
 by1 or transiting an information       
system2 and  7,b7 does not include any  
action that solely involves a violation 
of a consumer term of service or a      
consumer licensing agreement2  7#c7 the 
term information system-- 7,a7 has the  
meaning given the term in section #cejb 
of title #dd1 ,united ,states ,code2 and
  7,b7 includes industrial control      
systems1 such as supervisory control and
 data acquisition systems1 distributed  
control systems1 and programmable logic 
controllers2  7#d7 the term issuer has  
the meaning given the term in section #c
 of the ,securities ,exchange ,act of   
#aicd 7#ae ,u4,s4,c4 #gh;c72  7#e7 the  
term ,,nist means the ,national         
,institute of ,standards and            
,technology2 and  7#f7 the term         
reporting company means any company that
 is an issuer--  7,a7 the securities of 
which are registered under section #ab  
of the ,securities ,exchange ,act of    

#aicd 7#ae ,u4,s4,c4 #ghl72 or  7,b7    
that is required to file reports under  
section #ae7;d7 of such ,act 7#ae       
,u4,s4,c4 #gho7d774  7b7 ,requirement   
,to issue rules ,not later than #cfj    
days after the date of enactment of this
 ,act1 the ,commission shall issue final
 rules to require each reporting        
company1 in the annual report submitted 
under section #ac or section #ae7;d7 of 
the ,securities ,exchange ,act of #aicd 
7#ae ,u4,s4,c4 #ghm and #gho7d77 or the 
annual proxy statement submitted under  
section #ad7;a7 of such ,act 7#ae       
,u4,s4,c4 #ghn7a77--  7#a7 to disclose  
whether any member of the governing     
body1 such as the board of directors or 
general partner1 of the reporting       
company has expertise or experience in  
cybersecurity and in such detail as     
necessary to fully describe the nature  
of the expertise or experience2 and     
7#b7 if no member of the governing body 
of the reporting company has expertise  
or experience in cybersecurity1 to      

describe what other cybersecurity steps 
taken by the reporting company were     
taken into account by such persons      
responsible for identifying and         
evaluating nominees for any member of   
the governing body1 such as a nominating
 committee4  7c7 ,cybersecurity         
expertise or experience ,for purposes of
 subsection 7b71 the ,commission1 in    
consultation with ,,nist1 shall define  
what constitutes expertise or experience
 in cybersecurity1 such as professional 
qualifications to administer information
 security program functions or          
experience detecting1 preventing1       
mitigating1 or addressing cybersecurity 
threats1 using commonly defined roles1  
specialities1 knowledge1 skills1 and    
abilities1 such as those provided in    
,,nist ,special ,publication #hjj-aha   
entitled ,,nice ,cybersecurity          
,workforce ,framework1 or any successor 
thereto4