,i #aafth ,,congress #ast ,session ,h4 ,r4 #dgib ,,in ,,the ,,house ,,of ,,representatives ,october #bb1 #bjai,mr4 ,ted ,lieu of ,california introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to establish a voluntary program to identify and promote internet-connected products that meet industry-leading cybersecurity and data security standards1 guidelines1 best practices1 methodologies1 procedures1 and processes1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,shield ,act of #bjai4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,advisory ,committee means the ,cyber ,shield ,advisory ,committee established by the ,secretary under section #c7;a72 7#b7 the term benchmarks means standards1 guidelines1 best practices1 methodologies1 procedures1 and processes2 7#c7 the term covered product means a consumer-facing physical object that can-- 7,a7 connect to the internet or other network2 and 7,b7 7i7 collect1 send1 or receive data2 or 7ii7 control the actions of a physical object or system2 7#d7 the term ,cyber ,shield program means the voluntary program established by the ,secretary under section #d7;a77#a72 and 7#e7 the term ,secretary means the ,secretary of ,commerce4 #c4 ,cyber ,shield ,advisory ,committee 7a7 ,establishment ,not later than #ij days after the date of enactment of this ,act1 the ,secretary shall establish the ,cyber ,shield ,advisory ,committee4 7b7 ,duties 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,advisory ,committee shall provide recommendations to the ,secretary regarding-- 7,a7 the format and content of the ,cyber ,shield labels required to be established under section #d2 and 7,b7 the process for identifying1 establishing1 reporting on1 adopting1 maintaining1 and promoting compliance with the voluntary cybersecurity and data security benchmarks required to be established under section #d4 7#b7 ,public availability of recommendations ,the ,advisory ,committee shall publish1 and provide the public with an opportunity to comment on1 the recommendations provided to the ,secretary under paragraph 7#a74 7c7 ,members1 chair1 and duties 7#a7 ,appointment 7,a7 ,in general ,the ,advisory ,committee shall be composed of members appointed by the ,secretary from among individuals who are specially qualified to serve on the ,advisory ,committee based on the education1 training1 or experience of those individuals4 7,b7 ,representation ,members appointed under subparagraph 7,a7 shall include-- 7i7 representatives of the covered products industry1 including small1 medium1 and large businesses2 7ii7 cybersecurity experts1 including independent cybersecurity researchers that specialize in areas such as cryptanalysis1 hardware and software security1 wireless and network security1 cloud security1 and data privacy2 7iii7 public interest advocates2 7iv7 a liaison from the ,information ,security and ,privacy ,advisory ,board established under section #ba7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#d7;a77 who is a member of that ,board as described in paragraph 7#c7 of such section #ba7;a72 7v7 ,federal employees with expertise in certification1 covered devices1 or cybersecurity1 including employees of-- 7,i7 the ,department of ,commerce2 7,,ii7 the ,national ,institute of ,standards and ,technology2 7,,iii7 the ,federal ,trade ,commission2 7,,iv7 the ,federal ,communications ,commission2 and 7,v7 the ,consumer ,product ,safety ,commission2 and 7vi7 an expert who shall ensure that1 subject to subsection 7e71 the ,advisory ,committee conforms to and complies with the requirements under the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app474 7,c7 ,limitation ,in appointing members under subparagraph 7,a71 the ,secretary shall ensure that-- 7i7 each interest group described in clauses 7i71 7ii71 7iii71 and 7v7 of subparagraph 7,b7 is proportionally represented on the ,advisory ,committee1 including-- 7,i7 businesses of each size described in clause 7i7 of that subparagraph2 7,,ii7 ,federal employees with expertise in each subject described in clause 7v7 of that subparagraph2 and 7,,iii7 ,federal employees from each agency described in subclauses 7,i7 through 7,v7 of clause 7v7 of that subparagraph2 and 7ii7 no single interest group described in clauses 7i71 7ii71 7iii71 and 7v7 of subparagraph 7,b7 is represented by a majority of the members of the ,advisory ,committee4 7#b7 ,chair ,the ,secretary shall designate a member of the ,advisory ,committee to serve as ,chair4 7#c7 ,pay ,members of the ,advisory ,committee shall serve without pay1 except that the ,secretary may allow a member1 while attending meetings of the ,advisory ,committee or a subcommittee of the ,advisory ,committee1 per diem1 travel1 and transportation expenses authorized under section #egjc of title #e1 ,united ,states ,code4 7d7 ,support staff2 administrative services 7#a7 ,support staff ,the ,secretary shall provide support staff for the ,advisory ,committee4 7#b7 ,administrative services ,upon the request of the ,advisory ,committee1 the ,secretary shall provide any information1 administrative services1 and supplies that the ,secretary considers necessary for the ,advisory ,committee to carry out the duties and powers of the ,advisory ,committee4 7e7 ,no termination ,section #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,advisory ,committee4 7f7 ,authorization of appropriations ,there are authorized to be appropriated such sums as may be necessary to carry out this section4 #d4 ,cyber ,shield program 7a7 ,establishment of program 7#a7 ,in general ,the ,secretary shall establish a voluntary program to identify and certify covered products through voluntary certification and labeling of1 and other forms of communication about1 covered products and subsets of covered products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data4 7#b7 ,labels ,labels applied to covered products under the ,cyber ,shield program-- 7,a7 shall be digital and1 if feasible1 physical and affixed to the covered product or packaging2 and 7,b7 may be in the form of different grades that display the extent to which a covered product meets the industry-leading cybersecurity and data security benchmarks4 7b7 ,consultation ,not later than #ij days after the date of enactment of this ,act1 the ,secretary shall establish a process for consulting interested parties1 the ,secretary of ,health and ,human ,services1 the ,commissioner of ,food and ,drugs1 the ,secretary of ,homeland ,security1 and the heads of other ,federal agencies in carrying out the ,cyber ,shield program4 7c7 ,duties ,in carrying out the ,cyber ,shield program1 the ,secretary-- 7#a7 shall-- 7,a7 by convening and consulting interested parties and the heads of other ,federal agencies1 establish and maintain cybersecurity and data security benchmarks for covered products with the ,cyber ,shield label to ensure that those covered products perform better than counterparts of those covered products that do not have the ,cyber ,shield label2 and 7,b7 in carrying out subparagraph 7,a7-- 7i7 engage in an open public review and comment process2 7ii7 in consultation with the ,advisory ,committee1 identify and apply cybersecurity and data security benchmarks to different subsets of covered products based on1 with respect to each such subset-- 7,i7 any cybersecurity and data security risk relating to covered products in the subset2 7,,ii7 the sensitivity of the information collected1 transmitted1 or stored by covered products in the subset2 7,,iii7 the functionality of covered products in the subset2 7,,iv7 the security practices and testing procedures used in developing and manufacturing covered products in the subset2 7,v7 the level of expertise1 qualifications1 and professional accreditation of the staff employed by the manufacturers of covered products in the subset who are responsible for cybersecurity of the covered products2 and 7,,vi7 any other criteria the ,advisory ,committee and ,secretary determine is necessary and appropriate2 and 7iii7 to the extent possible1 incorporate existing cybersecurity and data security benchmarks1 such as the baseline of cybersecurity features defined in the document entitled ,core ,cybersecurity ,feature ,baseline for ,securable ,io,t ,devices3 ,a ,starting ,point for ,io,t ,device ,manufacturers1 published by the ,national ,institute of ,standards and ,technology in ,july #bjai1 or any successor thereto2 7#b7 may not establish any cybersecurity and data security benchmark under paragraph 7#a7 that is arbitrary1 capricious1 an abuse of discretion1 or otherwise not in accordance with law2 7#c7 shall permit a manufacturer or distributor of a covered product to display a ,cyber ,shield label reflecting the extent to which the covered product meets the cybersecurity and data security benchmarks established under paragraph 7#a72 7#d7 shall promote technologies1 practices1 and policies that-- 7,a7 are compliant with the cybersecurity and data security benchmarks established under paragraph 7#a72 and 7,b7 the ,secretary determines are the preferred technologies1 practices1 and policies in the marketplace for-- 7i7 enhancing cybersecurity2 7ii7 ensuring that cybersecurity is incorporated in all aspects of the life cycle of a covered product2 and 7iii7 protecting data2 7#e7 shall work to enhance public awareness of the ,cyber ,shield label1 including through public outreach1 education1 research and development1 and other means2 7#f7 shall preserve the integrity of the ,cyber ,shield label2 7#g7 if helpful in fulfilling the obligation under paragraph 7#f71 may elect to not treat a covered product as a covered product certified under the ,cyber ,shield program until the covered product meets appropriate conformity standards1 which may include-- 7,a7 standards relating to testing by an accredited third-party certifying laboratory or other entity in accordance with the ,cyber ,shield program2 and 7,b7 certification by the laboratory or entity described in subparagraph 7,a7 that the covered product meets the applicable cybersecurity and data security benchmarks established under paragraph 7#a72 7#h7 not less frequently than annually after the date on which the ,secretary establishes cybersecurity and data security benchmarks for a covered product category under paragraph 7#a71 shall review1 and1 if appropriate1 update the cybersecurity and data security benchmarks1 for that covered product category2 7#i7 shall solicit comments from interested parties and the ,advisory ,committee before establishing or revising a ,cyber ,shield covered product category or cybersecurity and data security benchmark 7or before the effective date of the establishment or revision of a covered product category or cybersecurity and data security benchmark72 7#aj7 upon adoption of a new or revised covered product category or cybersecurity and data security benchmark1 shall provide reasonable notice to interested parties of any changes 7including effective dates7 to covered product categories or cybersecurity and data security benchmarks1 along with-- 7,a7 an explanation of the changes2 and 7,b7 as appropriate1 responses to comments submitted by interested parties2 7#aa7 shall provide appropriate lead time before the applicable effective date for a new or a significant revision to a covered product category or cybersecurity and data security benchmark1 taking into account the timing requirements of the manufacturing1 marketing1 and distribution process for any covered product addressed2 and 7#ab7 may remove the certification of a covered product as a covered product certified under the ,cyber ,shield program if the manufacturer of the certified covered product falls out of conformity with the benchmarks established under paragraph 7#a7 for the covered product1 as determined by the ,secretary4 7d7 ,deadlines ,not later than #b years after the date of enactment of this ,act1 the ,secretary shall establish cybersecurity and data security benchmarks for covered products under subsection 7c77#a71 which shall take effect not later than #fj days after the date on which the ,secretary establishes the cybersecurity and data security benchmarks4 7e7 ,administration ,the ,secretary1 in consultation with the ,advisory ,committee1 may enter into a contract with a third party to administer the ,cyber ,shield program if-- 7#a7 the third party is an impartial administrator2 and 7#b7 entering into the contract improves the cybersecurity and data security of covered products4 7f7 ,program evaluation 7#a7 ,in general ,not later than #c years after the date on which the ,secretary establishes cybersecurity and data security benchmarks for covered products under subsection 7c77#a71 and not less frequently than every #c years thereafter1 the ,inspector ,general of the ,department of ,commerce shall-- 7,a7 evaluate the ,cyber ,shield program2 and 7,b7 submit a report on the results of the evaluation carried out under subparagraph 7,a7 to-- 7i7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 and 7ii7 the ,committee on ,energy and ,commerce of the ,house of ,representatives4 7#b7 ,requirements ,in conducting an evaluation under paragraph 7#a77;,a71 the ,inspector ,general of the ,department of ,commerce shall-- 7,a7 with respect to the cybersecurity and data security benchmarks established under subsection 7c77#a7-- 7i7 evaluate the extent to which the cybersecurity and data security benchmarks address cybersecurity and data security threats2 and 7ii7 assess how the cybersecurity and data security benchmarks have evolved to meet emerging cybersecurity and data security threats2 7,b7 conduct covert testing of covered products to evaluate the integrity of certification testing under the ,cyber ,shield program2 7,c7 assess the costs to businesses that manufacture covered products of participating in the ,cyber ,shield program2 7,d7 evaluate the level of participation in the ,cyber ,shield program by businesses that manufacture covered products2 7,e7 assess the level of public awareness and consumer awareness of the ,cyber ,shield label2 7,f7 determine whether any private sector or international cybersecurity certification programs comparable to the ,cyber ,shield program exist2 and 7,g7 if any private sector or international cybersecurity certification programs described in subparagraph 7,f7 exist1 evaluate how each such private sector or international cybersecurity certification program interacts with and compares to the ,cyber ,shield program4 7g7 ,authorization of appropriations ,there are authorized to be appropriated such sums as may be necessary to carry out this section4 #e4 ,cyber shield digital covered product portal 7a7 ,in general ,the ,secretary shall make publicly available on the website of the ,department of ,commerce in a searchable format-- 7#a7 a web page providing information about the ,cyber ,shield program2 7#b7 a database of covered products certified under the ,cyber ,shield program2 and 7#c7 contact information for each manufacturer of a covered product certified under the ,cyber ,shield program that may be used by consumers to contact the manufacturer regarding questions or complaints4 7b7 ,requirements ,the database established under subsection 7a77#b7 shall include-- 7#a7 the cybersecurity and data security benchmarks established under section #d7;c77#a7 for each covered product category2 and 7#b7 for each covered product certified under the ,cyber ,shield program-- 7,a7 the certification for the covered product2 7,b7 the name and manufacturer of the covered product2 7,c7 the contact information for the manufacturer of the covered product2 7,d7 the functionality of the covered product2 7,e7 the location of any applicable privacy policy2 and 7,f7 any other information that the ,secretary determines to be necessary and appropriate4 #f4 ,rule of construction ,the decision of a manufacturer of a covered product to not participate in the ,cyber ,shield program shall not affect the liability of the manufacturer for a cybersecurity or data security breach of that covered product4