,i  #aaf? ,,congress  #a/ ,session  ,h4 
,r4 #dgib  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,octob] #bb1 #bjai,mr4
 ,t$ ,lieu ( ,cali=nia introduc$ !      
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,en]gy & ,comm]ce  ,a     
,,bill  ,to e/abli% a volunt>y program  
to id5tify & promote int]net-connect$   
products t meet indu/ry-lead+           
cyb]security & data security /&>ds1     
guidel9es1 be/ practices1 me?odologies1 
proc$ures1 & processes1 & = o!r         
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,cyb] ,%ield ,act ( #bjai4 
#b4 ,def9itions ,9 ?is ,act--  7#a7 !   
t]m ,advisory ,committee means ! ,cyb]  
,%ield ,advisory ,committee e/abli%$ by 
! ,secret>y "u section #c7;a72  7#b7 !  
t]m b5*m>ks means /&>ds1 guidel9es1 be/ 
practices1 me?odologies1 proc$ures1 &   
processes2  7#c7 ! t]m cov]$ product    
means a consum]-fac+ physical object t  
c-- 7,a7 connect to ! int]net or o!r    
network2 &  7,b7  7i7 collect1 s5d1 or  
receive data2 or  7ii7 control ! actions

 ( a physical object or sy/em2  7#d7 !  
t]m ,cyb] ,%ield program means !        
volunt>y program e/abli%$ by ! ,secret>y
 "u section #d7;a77#a72 &  7#e7 ! t]m   
,secret>y means ! ,secret>y ( ,comm]ce4 
#c4 ,cyb] ,%ield ,advisory ,committee   
7a7 ,e/abli%m5t ,n lat] ?an #ij days    
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y %all e/abli% ! ,cyb] ,%ield   
,advisory ,committee4  7b7 ,duties  7#a7
 ,9 g5]al ,n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is ,act1 ! ,advisory     
,committee %all provide recomm5dations  
to ! ,secret>y reg>d+--  7,a7 ! =mat &  
cont5t ( ! ,cyb] ,%ield labels requir$  
to be e/abli%$ "u section #d2 &  7,b7 ! 
process = id5tify+1 e/abli%+1 report+   
on1 adopt+1 ma9ta9+1 & promot+          
compliance ) ! volunt>y cyb]security &  
data security b5*m>ks requir$ to be     
e/abli%$ "u section #d4  7#b7 ,public   
availability ( recomm5dations ,!        
,advisory ,committee %all publi%1 &     
provide ! public ) an opportunity to    
comm5t on1 ! recomm5dations provid$ to !

 ,secret>y "u p>agraph 7#a74  7c7       
,memb]s1 *air1 & duties  7#a7 ,appo9tm5t
  7,a7 ,9 g5]al ,! ,advisory ,committee 
%all be compos$ ( memb]s appo9t$ by !   
,secret>y f among individuals :o are    
specially qualifi$ to s]ve on !         
,advisory ,committee bas$ on !          
education1 tra9+1 or exp]i5ce ( ^?      
individuals4  7,b7 ,repres5tation       
,memb]s appo9t$ "u subp>agraph 7,a7 %all
 include-- 7i7 repres5tatives ( ! cov]$ 
products indu/ry1 includ+ small1 m$ium1 
& l>ge bus9esses2  7ii7 cyb]security    
exp]ts1 includ+ indep5d5t cyb]security  
rese>*]s t specialize 9 areas su* z     
cryptanalysis1 h>dw>e & s(tw>e security1
 wireless & network security1 cl\d      
security1 & data privacy2  7iii7 public 
int]e/ advocates2  7iv7 a liaison f !   
,in=mation ,security & ,privacy         
,advisory ,bo>d e/abli%$ "u section     
#ba7;a7 ( ! ,national ,in/itute ( ,/&>ds
 & ,te*nology ,act 7#ae ,u4,s4,c4       
#bgh;g-#d7;a77 :o is a memb] ( t ,bo>d z
 describ$ 9 p>agraph 7#c7 ( su* section 

#ba7;a72  7v7 ,f$]al employees )        
exp]tise 9 c]tification1 cov]$ devices1 
or cyb]security1 includ+ employees (--  
7,i7 ! ,dep>tm5t ( ,comm]ce2  7,,ii7 !  
,national ,in/itute ( ,/&>ds &          
,te*nology2  7,,iii7 ! ,f$]al ,trade    
,commission2  7,,iv7 ! ,f$]al           
,communications ,commission2 &  7,v7 !  
,consum] ,product ,safety ,commission2 &
  7vi7 an exp]t :o %all ensure t1       
subject to subsection 7e71 ! ,advisory  
,committee con=ms to & complies ) !     
requirem5ts "u ! ,f$]al ,advisory       
,committee ,act 7#e ,u4,s4,c4 ,app474   
7,c7 ,limitation ,9 appo9t+ memb]s "u   
subp>agraph 7,a71 ! ,secret>y %all      
ensure t-- 7i7 ea* int]e/ gr\p describ$ 
9 clauses 7i71 7ii71 7iii71 & 7v7 (     
subp>agraph 7,b7 is proportionally      
repres5t$ on ! ,advisory ,committee1    
includ+--  7,i7 bus9esses ( ea* size    
describ$ 9 clause 7i7 ( t subp>agraph2  
7,,ii7 ,f$]al employees ) exp]tise 9 ea*
 subject describ$ 9 clause 7v7 ( t      
subp>agraph2 &  7,,iii7 ,f$]al employees

 f ea* ag5cy describ$ 9 subclauses 7,i7 
?r\gh 7,v7 ( clause 7v7 ( t subp>agraph2
 &  7ii7 no s+le int]e/ gr\p describ$ 9 
clauses 7i71 7ii71 7iii71 & 7v7 (       
subp>agraph 7,b7 is repres5t$ by a      
majority ( ! memb]s ( ! ,advisory       
,committee4  7#b7 ,*air ,! ,secret>y    
%all designate a memb] ( ! ,advisory    
,committee to s]ve z ,*air4  7#c7 ,pay  
,memb]s ( ! ,advisory ,committee %all   
s]ve )\t pay1 except t ! ,secret>y may  
all[ a memb]1 :ile att5d+ meet+s ( !    
,advisory ,committee or a subcommittee (
 ! ,advisory ,committee1 p] diem1       
travel1 & transportation exp5ses        
au?oriz$ "u section #egjc ( title #e1   
,unit$ ,/ates ,code4  7d7 ,support /aff2
 adm9i/rative s]vices  7#a7 ,support    
/aff ,! ,secret>y %all provide support  
/aff = ! ,advisory ,committee4  7#b7    
,adm9i/rative s]vices ,^u ! reque/ ( !  
,advisory ,committee1 ! ,secret>y %all  
provide any in=mation1 adm9i/rative     
s]vices1 & supplies t ! ,secret>y       
consid]s necess>y = ! ,advisory         

,committee to c>ry out ! duties & p[]s (
 ! ,advisory ,committee4  7e7 ,no       
t]m9ation ,section #ad ( ! ,f$]al       
,advisory ,committee ,act 7#e ,u4,s4,c4 
,app47 %all n apply to ! ,advisory      
,committee4  7f7 ,au?orization (        
appropriations ,!re are au?oriz$ to be  
appropriat$ su* sums z may be necess>y  
to c>ry out ?is section4  #d4 ,cyb]     
,%ield program  7a7 ,e/abli%m5t (       
program  7#a7 ,9 g5]al ,! ,secret>y %all
 e/abli% a volunt>y program to id5tify &
 c]tify cov]$ products ?r\gh volunt>y   
c]tification & label+ (1 & o!r =ms (    
communication ab\t1 cov]$ products &    
subsets ( cov]$ products t meet         
indu/ry-lead+ cyb]security & data       
security b5*m>ks to enhance cyb]security
 & protect data4  7#b7 ,labels ,labels  
appli$ to cov]$ products "u ! ,cyb]     
,%ield program-- 7,a7 %all be digital &1
 if feasible1 physical & affix$ to !    
cov]$ product or packag+2 &  7,b7 may be
 9 ! =m ( diff]5t grades t display !    
ext5t to :i* a cov]$ product meets !    

indu/ry-lead+ cyb]security & data       
security b5*m>ks4  7b7 ,consultation ,n 
lat] ?an #ij days aft] ! date ( enactm5t
 ( ?is ,act1 ! ,secret>y %all e/abli% a 
process = consult+ int]e/$ p>ties1 !    
,secret>y ( ,heal? & ,human ,s]vices1 ! 
,commission] ( ,food & ,drugs1 !        
,secret>y ( ,homel& ,security1 & ! heads
 ( o!r ,f$]al ag5cies 9 c>ry+ out !     
,cyb] ,%ield program4  7c7 ,duties ,9   
c>ry+ out ! ,cyb] ,%ield program1 !     
,secret>y-- 7#a7 %all--  7,a7 by conv5+ 
& consult+ int]e/$ p>ties & ! heads (   
o!r ,f$]al ag5cies1 e/abli% & ma9ta9    
cyb]security & data security b5*m>ks =  
cov]$ products ) ! ,cyb] ,%ield label to
 ensure t ^? cov]$ products p]=m bett]  
?an c\nt]p>ts ( ^? cov]$ products t d n 
h ! ,cyb] ,%ield label2 &  7,b7 9 c>ry+ 
out subp>agraph 7,a7-- 7i7 engage 9 an  
op5 public review & comm5t process2     
7ii7 9 consultation ) ! ,advisory       
,committee1 id5tify & apply cyb]security
 & data security b5*m>ks to diff]5t     
subsets ( cov]$ products bas$ on1 )     

respect to ea* su* subset--  7,i7 any   
cyb]security & data security risk relat+
 to cov]$ products 9 ! subset2  7,,ii7 !
 s5sitivity ( ! in=mation collect$1     
transmitt$1 or /or$ by cov]$ products 9 
! subset2  7,,iii7 ! functionality (    
cov]$ products 9 ! subset2  7,,iv7 !    
security practices & te/+ proc$ures us$ 
9 develop+ & manufactur+ cov]$ products 
9 ! subset2  7,v7 ! level ( exp]tise1   
qualifications1 & pr(essional           
accr$itation ( ! /aff employ$ by !      
manufactur]s ( cov]$ products 9 ! subset
 :o are responsible = cyb]security ( !  
cov]$ products2 &  7,,vi7 any o!r       
crit]ia ! ,advisory ,committee &        
,secret>y det]m9e is necess>y &         
appropriate2 &  7iii7 to ! ext5t        
possible1 incorporate exi/+ cyb]security
 & data security b5*m>ks1 su* z !       
basel9e ( cyb]security features def9$ 9 
! docum5t entitl$ ,core ,cyb]security   
,feature ,basel9e = ,securable ,io,t    
,devices3 ,a ,/>t+ ,po9t = ,io,t ,device
 ,manufactur]s1 publi%$ by ! ,national  

,in/itute ( ,/&>ds & ,te*nology 9 ,july 
#bjai1 or any successor !reto2  7#b7 may
 n e/abli% any cyb]security & data      
security b5*m>k "u p>agraph 7#a7 t is   
arbitr>y1 caprici\s1 an abuse (         
discretion1 or o!rwise n 9 accordance ) 
law2  7#c7 %all p]mit a manufactur] or  
di/ributor ( a cov]$ product to display 
a ,cyb] ,%ield label reflect+ ! ext5t to
 :i* ! cov]$ product meets !            
cyb]security & data security b5*m>ks    
e/abli%$ "u p>agraph 7#a72  7#d7 %all   
promote te*nologies1 practices1 &       
policies t-- 7,a7 are compliant ) !     
cyb]security & data security b5*m>ks    
e/abli%$ "u p>agraph 7#a72 &  7,b7 !    
,secret>y det]m9es are ! pref]r$        
te*nologies1 practices1 & policies 9 !  
m>ketplace =--  7i7 enhanc+             
cyb]security2  7ii7 ensur+ t            
cyb]security is incorporat$ 9 all       
aspects ( ! life cycle ( a cov]$        
product2 &  7iii7 protect+ data2  7#e7  
%all "w to enhance public aw>5ess ( !   
,cyb] ,%ield label1 includ+ ?r\gh public

 outrea*1 education1 rese>* &           
developm5t1 & o!r means2  7#f7 %all     
pres]ve ! integrity ( ! ,cyb] ,%ield    
label2  7#g7 if helpful 9 fulfill+ !    
obligation "u p>agraph 7#f71 may elect  
to n treat a cov]$ product z a cov]$    
product c]tifi$ "u ! ,cyb] ,%ield       
program until ! cov]$ product meets     
appropriate con=mity /&>ds1 :i* may     
include--  7,a7 /&>ds relat+ to te/+ by 
an accr$it$ ?ird-p>ty c]tify+ laboratory
 or o!r entity 9 accordance ) ! ,cyb]   
,%ield program2 &  7,b7 c]tification by 
! laboratory or entity describ$ 9       
subp>agraph 7,a7 t ! cov]$ product meets
 ! applicable cyb]security & data       
security b5*m>ks e/abli%$ "u p>agraph   
7#a72  7#h7 n less frequ5tly ?an        
annually aft] ! date on :i* ! ,secret>y 
e/abli%es cyb]security & data security  
b5*m>ks = a cov]$ product category "u   
p>agraph 7#a71 %all review1 &1 if       
appropriate1 update ! cyb]security &    
data security b5*m>ks1 = t cov]$ product
 category2  7#i7 %all solicit comm5ts f 

int]e/$ p>ties & ! ,advisory ,committee 
be=e e/abli%+ or revis+ a ,cyb] ,%ield  
cov]$ product category or cyb]security &
 data security b5*m>k 7or be=e !        
effective date ( ! e/abli%m5t or        
revision ( a cov]$ product category or  
cyb]security & data security b5*m>k72   
7#aj7 ^u adoption ( a new or revis$     
cov]$ product category or cyb]security &
 data security b5*m>k1 %all provide     
reasonable notice to int]e/$ p>ties (   
any *anges 7includ+ effective dates7 to 
cov]$ product categories or cyb]security
 & data security b5*m>ks1 along )--     
7,a7 an explanation ( ! *anges2 &  7,b7 
z appropriate1 responses to comm5ts     
submitt$ by int]e/$ p>ties2  7#aa7 %all 
provide appropriate lead "t be=e !      
applicable effective date = a new or a  
significant revision to a cov]$ product 
category or cyb]security & data security
 b5*m>k1 tak+ into acc\nt ! tim+        
requirem5ts ( ! manufactur+1 m>ket+1 &  
di/ribution process = any cov]$ product 
address$2 &  7#ab7 may remove !         

c]tification ( a cov]$ product z a cov]$
 product c]tifi$ "u ! ,cyb] ,%ield      
program if ! manufactur] ( ! c]tifi$    
cov]$ product falls out ( con=mity ) !  
b5*m>ks e/abli%$ "u p>agraph 7#a7 = !   
cov]$ product1 z det]m9$ by ! ,secret>y4
  7d7 ,deadl9es ,n lat] ?an #b ye>s aft]
 ! date ( enactm5t ( ?is ,act1 !        
,secret>y %all e/abli% cyb]security &   
data security b5*m>ks = cov]$ products  
"u subsection 7c77#a71 :i* %all take    
effect n lat] ?an #fj days aft] ! date  
on :i* ! ,secret>y e/abli%es !          
cyb]security & data security b5*m>ks4   
7e7 ,adm9i/ration ,! ,secret>y1 9       
consultation ) ! ,advisory ,committee1  
may ent] into a contract ) a ?ird p>ty  
to adm9i/] ! ,cyb] ,%ield program if--  
7#a7 ! ?ird p>ty is an imp>tial         
adm9i/rator2 &  7#b7 ent]+ into !       
contract improves ! cyb]security & data 
security ( cov]$ products4  7f7 ,program
 evaluation  7#a7 ,9 g5]al ,n lat] ?an  
#c ye>s aft] ! date on :i* ! ,secret>y  
e/abli%es cyb]security & data security  

b5*m>ks = cov]$ products "u subsection  
7c77#a71 & n less frequ5tly ?an e #c    
ye>s !reaft]1 ! ,inspector ,g5]al ( !   
,dep>tm5t ( ,comm]ce %all--  7,a7       
evaluate ! ,cyb] ,%ield program2 &  7,b7
 submit a report on ! results ( !       
evaluation c>ri$ out "u subp>agraph 7,a7
 to--  7i7 ! ,committee on ,comm]ce1    
,sci5ce1 & ,transportation ( ! ,s5ate2 &
  7ii7 ! ,committee on ,en]gy & ,comm]ce
 ( ! ,h\se ( ,repres5tatives4  7#b7     
,requirem5ts ,9 conduct+ an evaluation  
"u p>agraph 7#a77;,a71 ! ,inspector     
,g5]al ( ! ,dep>tm5t ( ,comm]ce %all--  
7,a7 ) respect to ! cyb]security & data 
security b5*m>ks e/abli%$ "u subsection 
7c77#a7-- 7i7 evaluate ! ext5t to :i* ! 
cyb]security & data security b5*m>ks    
address cyb]security & data security    
?reats2 &  7ii7 assess h[ ! cyb]security
 & data security b5*m>ks h evolv$ to    
meet em]g+ cyb]security & data security 
?reats2  7,b7 conduct cov]t te/+ ( cov]$
 products to evaluate ! integrity (     
c]tification te/+ "u ! ,cyb] ,%ield     

program2  7,c7 assess ! co/s to         
bus9esses t manufacture cov]$ products (
 p>ticipat+ 9 ! ,cyb] ,%ield program2   
7,d7 evaluate ! level ( p>ticipation 9 !
 ,cyb] ,%ield program by bus9esses t    
manufacture cov]$ products2  7,e7 assess
 ! level ( public aw>5ess & consum]     
aw>5ess ( ! ,cyb] ,%ield label2  7,f7   
det]m9e :e!r any private sector or      
int]national cyb]security c]tification  
programs comp>able to ! ,cyb] ,%ield    
program exi/2 &  7,g7 if any private    
sector or int]national cyb]security     
c]tification programs describ$ 9        
subp>agraph 7,f7 exi/1 evaluate h[ ea*  
su* private sector or int]national      
cyb]security c]tification program       
int]acts ) & comp>es to ! ,cyb] ,%ield  
program4  7g7 ,au?orization (           
appropriations ,!re are au?oriz$ to be  
appropriat$ su* sums z may be necess>y  
to c>ry out ?is section4  #e4 ,cyb]     
%ield digital cov]$ product portal  7a7 
,9 g5]al ,! ,secret>y %all make publicly
 available on ! website ( ! ,dep>tm5t ( 

,comm]ce 9 a se>*able =mat--  7#a7 a web
 page provid+ in=mation ab\t ! ,cyb]    
,%ield program2  7#b7 a database ( cov]$
 products c]tifi$ "u ! ,cyb] ,%ield     
program2 &  7#c7 contact in=mation = ea*
 manufactur] ( a cov]$ product c]tifi$  
"u ! ,cyb] ,%ield program t may be us$  
by consum]s to contact ! manufactur]    
reg>d+ que/ions or compla9ts4  7b7      
,requirem5ts ,! database e/abli%$ "u    
subsection 7a77#b7 %all include-- 7#a7 !
 cyb]security & data security b5*m>ks   
e/abli%$ "u section #d7;c77#a7 = ea*    
cov]$ product category2 &  7#b7 = ea*   
cov]$ product c]tifi$ "u ! ,cyb] ,%ield 
program-- 7,a7 ! c]tification = ! cov]$ 
product2  7,b7 ! "n & manufactur] ( !   
cov]$ product2  7,c7 ! contact in=mation
 = ! manufactur] ( ! cov]$ product2     
7,d7 ! functionality ( ! cov]$ product2 
7,e7 ! location ( any applicable privacy
 policy2 &  7,f7 any o!r in=mation t !  
,secret>y det]m9es to be necess>y &     
appropriate4  #f4 ,rule ( con/ruction ,!
 decision ( a manufactur] ( a cov]$     

product to n p>ticipate 9 ! ,cyb] ,%ield
 program %all n affect ! liability ( !  
manufactur] = a cyb]security or data    
security brea* ( t cov]$ product4