,,ii #aaith ,,congress #ast ,session ,s4 #bde ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,january #bd1 #bjbe,mr4 ,hickenlooper 7for himself and ,mrs4 ,capito7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require the ,assistant ,secretary of ,commerce for ,communications and ,information to establish a working group on cyber insurance1 to require dissemination of informative resources for issuers and customers of cyber insurance1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,insure ,cybersecurity ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,assistant ,secretary ,the term ,assistant ,secretary means the ,assistant ,secretary of ,commerce for ,communications and ,information4 7#b7 ,critical infrastructure ,the term critical infrastructure has the meaning given the term in subsection 7e7 of the ,critical ,infrastructures ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c74 7#c7 ,customer ,the term customer means an individual or organization that purchases cyber insurance from an issuer4 7#d7 ,cyber incident ,the term cyber incident has the meaning given the term incident in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#e7 ,cyber insurance ,subject to section #c7;c77#a77;,a71 the term cyber insurance means an insurance policy that includes coverage for losses1 damages1 and costs incurred due to cyber incidents4 7#f7 ,issuer ,the term issuer means an organization that issues cyber insurance4 7#g7 ,policy ,the term policy means a policy for cyber insurance4 7#h7 ,small business ,the term small business has the meaning given the term small business concern in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#i7 ,working group ,the term working group means the working group established under section #c7;a74 #c4 ,working group on cyber insurance 7a7 ,establishment ,not later than #ij days after the date of enactment of this ,act1 the ,assistant ,secretary shall establish a working group on cyber insurance4 7b7 ,composition 7#a7 ,membership ,the working group shall be composed of the following members3 7,a7 ,not less than #a member from each of the following3 7i7 ,the ,cybersecurity and ,infrastructure ,security ,agency4 7ii7 ,the ,national ,institute of ,standards and ,technology4 7iii7 ,the ,department of the ,treasury4 7iv7 ,the ,department of ,justice4 7v7 ,the ,federal ,trade ,commission4 7,b7 ,not less than #a ,state insurance regulator with expertise regarding cybersecurity and cyber insurance4 7#b7 ,chairperson ,the ,assistant ,secretary shall be the chairperson of the working group4 7c7 ,activities 7#a7 ,in general ,the working group shall carry out the following activities3 7,a7 ,for the purposes of the activities of the working group1 define the term cyber insurance in a manner that is different from the definition of that term under section #b7e71 if the working group determines that such a modified definition is necessary4 7,b7 ,analyze and explain in a manner understandable to customers the technical and legal terminology commonly used in policies4 7,c7 ,analyze and explain in a manner understandable to customers how provisions in policies correspond to common types of cyber incidents1 including those involving ransomware4 7,d7 ,analyze and explain in a manner understandable to customers how provisions in policies correspond to common customer responses to cyber incidents1 including with respect to system recovery and potential ransom payments4 7,e7 ,analyze and explain in a manner understandable to customers the terminology used in policies to include or exclude coverage for losses due to cyber incidents4 7,f7 ,analyze and explain in a manner understandable to customers the constraints faced by issuers in covering higher amounts of losses and cyber risk areas1 such as reputational damage and the loss of intellectual property4 7,g7 ,develop information for customers on ways to effectively evaluate the types and levels of coverage offered under a policy4 7,h7 ,develop information for issuers1 agents1 and brokers regarding how to provide and communicate policy provisions that are clear and easy to understand for customers4 7,i7 ,gather input from issuers on what measures could improve the ability of those issuers to offer additional coverage under policies1 including-- 7i7 improvements to their actuarial data and cyber risk data2 7ii7 the development of effective information sharing mechanisms2 and 7iii7 accurate measurement of the cybersecurity practices of customers4 7,j7 ,identify what measures could reduce the cost of policies and reduce the amount of cyber risk and the number of cyber incidents4 7,k7 ,develop recommendations for customers on how best to use cyber insurance and the benefits of doing so4 7#b7 ,consultation ,in carrying out the activities of the working group under paragraph 7#a71 the working group shall consult with the public in an open and transparent manner1 including by consulting with the following stakeholders3 7,a7 ,issuers4 7,b7 ,insurance agents and brokers with experience in the sale and distribution of cyber insurance4 7,c7 ,representatives of business customers from multiple sectors and representatives of small businesses4 7,d7 ,academia4 7,e7 ,state insurance regulators with expertise regarding cybersecurity and cyber insurance4 7,f7 ,owners and operators of critical infrastructure4 7,g7 ,other individuals or entities with cybersecurity and cyber insurance expertise as the ,assistant ,secretary considers appropriate4 7d7 ,report ,not later than #a year after the date on which the working group first convenes1 the working group shall submit to ,congress a report regarding the activities of the working group under subsection 7c7 and any recommendations of the working group4 7e7 ,termination ,the working group shall terminate upon submission of the report required under subsection 7d74 7f7 ,rule of construction ,nothing in this section shall be construed to-- 7#a7 require adoption of the recommendations of the working group2 or 7#b7 provide any authority to any member of the working group or any other individual to regulate the business of insurance that is not already provided under any other provision of law4 #d4 ,dissemination of informative resources for cyber insurance stakeholders 7a7 ,in general ,not later than #ij days after the date on which the working group submits the report required under section #c7;d71 the ,assistant ,secretary shall disseminate and make publicly available informative resources for cyber insurance stakeholders4 7b7 ,requirements ,the ,assistant ,secretary shall ensure that the resources disseminated under subsection 7a7-- 7#a7 incorporate the recommendations included in the report submitted under section #c7;d72 7#b7 are generally applicable and usable by a wide range of cyber insurance stakeholders1 including issuers1 agents1 brokers1 and customers2 and 7#c7 include case studies and specific examples1 where appropriate4 7c7 ,publication ,the resources disseminated under subsection 7a7 shall be published on the public website of the ,national ,telecommunications and ,information ,administration4 7d7 ,outreach ,the ,assistant ,secretary shall conduct outreach and coordination activities to promote the availability of the resources disseminated under subsection 7a7 to relevant industry stakeholders and the general public4 7e7 ,voluntary use ,nothing in this section may be construed to require the use of the resources disseminated under subsection 7a74