#aaith ,,congress #b;d ,session ,s4 #cdjd ,,an ,,act ,to require a report on ,federal support to the cybersecurity of commercial satellite systems1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,satellite ,cybersecurity ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,commerce1 ,science1 and ,transportation and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce1 the ,committee on ,space1 ,science1 and ,technology1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 7#b7 ,clearinghouse ,the term clearinghouse means the commercial satellite system cybersecurity clearinghouse required to be developed and maintained under section #d7;b77#a74 7#c7 ,commercial satellite system ,the term commercial satellite system-- 7,a7 means a system that-- 7i7 is owned or operated by a non-,federal entity that holds a license issued by the ,united ,states for business operations2 and 7ii7 is composed of not less than #a earth satellite2 and 7,b7 includes-- 7i7 any ground support infrastructure for each satellite in the system2 and 7ii7 any transmission link among and between any satellite in the system and any ground support infrastructure in the system4 7#d7 ,critical infrastructure ,the term critical infrastructure has the meaning given the term in subsection 7e7 of the ,critical ,infrastructures ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#e7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given the term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#f7 ,cybersecurity threat ,the term cybersecurity threat has the meaning given the term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#g7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 #c4 ,report on commercial satellite cybersecurity 7a7 ,study ,the ,comptroller ,general of the ,united ,states shall conduct a study on the actions the ,federal ,government has taken to support the cybersecurity of commercial satellite systems1 including as part of any action to address the cybersecurity of critical infrastructure sectors4 7b7 ,report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall report to the appropriate congressional committees on the study conducted under subsection 7a71 which-- 7#a7 shall include-- 7,a7 information on efforts of the ,federal ,government1 and the effectiveness of those efforts1 to-- 7i7 address or improve the cybersecurity of commercial satellite systems2 and 7ii7 support related efforts with international entities or the private sector2 7,b7 information on the resources made available to the public by ,federal agencies to address cybersecurity risks and threats to commercial satellite systems1 including resources made available through the clearinghouse2 7,c7 information on the extent to which commercial satellite systems are reliant on1 or relied on by1 critical infrastructure2 7,d7 an analysis of how commercial satellite systems and the threats to those systems are integrated into critical infrastructure risk analyses and protection plans2 7,e7 information on the extent to which ,federal agencies are reliant on commercial satellite systems and how ,federal agencies mitigate cybersecurity risks associated with those systems2 7,f7 information on the extent to which ,federal agencies are reliant on commercial satellite systems that are owned wholly or in part or controlled by foreign entities1 or that have infrastructure in foreign countries1 and how ,federal agencies mitigate associated cybersecurity risks2 7,g7 information on the extent to which ,federal agencies coordinate or duplicate authorities and take other actions focused on the cybersecurity of commercial satellite systems2 and 7,h7 as determined appropriate by the ,comptroller ,general of the ,united ,states1 recommendations to support the cybersecurity of commercial satellite systems1 including recommendations on information that should be shared through the clearinghouse2 and 7#b7 shall not include recommendations described in paragraph 7#a77;,h7 for new or changing authorities or regulations for ,federal agencies4 7c7 ,consultation ,in carrying out subsections 7a7 and 7b71 the ,comptroller ,general of the ,united ,states shall coordinate with appropriate ,federal agencies and organizations1 including-- 7#a7 the ,department of ,commerce2 7#b7 the ,office of the ,national ,cyber ,director2 7#c7 the ,department of ,homeland ,security2 7#d7 the ,department of ,defense2 7#e7 the ,department of ,transportation2 7#f7 the ,federal ,communications ,commission2 7#g7 the ,national ,aeronautics and ,space ,administration2 7#h7 the ,national ,executive ,committee for ,space-,based ,positioning1 ,navigation1 and ,timing2 7#i7 the ,national ,space ,council2 7#aj7 the ,office of ,science and ,technology ,policy2 7#aa7 the ,department of ,justice2 and 7#ab7 the ,committee for the ,assessment of ,foreign ,participation in the ,united ,states ,telecommunications ,services ,sector4 7d7 ,briefing ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall provide a briefing to the appropriate congressional committees on the study conducted under subsection 7a74 7e7 ,classification ,the report made under subsection 7b7 shall be unclassified but may include a classified annex4 #d4 ,responsibilities of the department of commerce 7a7 ,small business concern defined ,in this section1 the term small business concern has the meaning given the term in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7b7 ,establishment of commercial satellite system cybersecurity clearinghouse 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary1 in coordination with the ,secretary of ,homeland ,security1 shall develop and maintain a commercial satellite system cybersecurity clearinghouse for the purpose of serving as a repository for publicly available resources1 guidance1 frameworks1 voluntary recommendations1 and tools4 7#b7 ,requirements ,the clearinghouse-- 7,a7 shall be publicly available online2 7,b7 shall contain publicly available commercial satellite system cybersecurity resources1 including the voluntary recommendations consolidated under subsection 7c77#a72 7,c7 shall contain appropriate materials for reference by entities that develop1 operate1 or maintain commercial satellite systems2 7,d7 shall contain materials specifically aimed at assisting small business concerns with the secure development1 operation1 and maintenance of commercial satellite systems2 7,e7 may contain controlled unclassified information distributed to commercial entities through a process determined appropriate by the ,secretary2 and 7,f7 may not contain sensitive security or proprietary information in the absence of the establishment and use of a gateway to limit access to approved users1 as determined by the ,secretary4 7#c7 ,content maintenance ,the ,secretary shall maintain current and relevant cybersecurity information on the clearinghouse4 7#d7 ,existing platform or website ,to the extent practicable1 the ,secretary shall establish and maintain the clearinghouse using an online platform1 a website1 or a capability in existence as of the date of enactment of this ,act4 7c7 ,consolidation of commercial satellite system cybersecurity recommendations 7#a7 ,in general ,the ,secretary1 in coordination with the ,secretary of ,homeland ,security1 shall consolidate voluntary cybersecurity recommendations designed to assist in the development1 maintenance1 and operation of commercial satellite systems4 7#b7 ,requirements ,the recommendations consolidated under paragraph 7#a7 shall include materials appropriate for a public resource addressing1 to the greatest extent practicable1 the following3 7,a7 ,risk-based1 cybersecurity-informed engineering1 including continuous monitoring and resiliency4 7,b7 ,planning for retention or recovery of positive control of commercial satellite systems in the event of a cybersecurity incident4 7,c7 ,protection against unauthorized access to vital commercial satellite system functions4 7,d7 ,physical protection measures designed to reduce the vulnerabilities of a commercial satellite system's command1 control1 and telemetry receiver systems4 7,e7 ,protection against jamming1 eavesdropping1 hijacking1 computer network exploitation1 spoofing1 threats to optical satellite communications1 and electromagnetic pulse4 7,f7 ,security against threats throughout a commercial satellite system's mission lifetime4 7,g7 ,management of supply chain risks that affect the cybersecurity of commercial satellite systems4 7,h7 ,protection against vulnerabilities posed by ownership of commercial satellite systems or commercial satellite system companies by foreign entities4 7,i7 ,protection against vulnerabilities posed by locating physical infrastructure1 such as satellite ground control systems1 in foreign countries4 7,j7 ,as appropriate1 and as applicable pursuant to the maintenance requirement under subsection 7b77#c71 relevant findings and recommendations from the study conducted by the ,comptroller ,general of the ,united ,states under section #c7;a74 7,k7 ,any other recommendations to ensure the confidentiality1 availability1 and integrity of data residing on or in transit through commercial satellite systems only for the purpose described in subsection 7b77#a74 7d7 ,implementation ,in implementing this section1 the ,secretary shall-- 7#a7 to the extent practicable1 carry out the implementation in partnership with the private sector2 7#b7 coordinate with-- 7,a7 the ,secretary of ,homeland ,security1 the ,office of the ,national ,cyber ,director1 the ,national ,space ,council1 the ,director of the ,national ,institute of ,standards and ,technology1 and the head of any other agency with expertise relating to cybersecurity or satellite communications determined appropriate by the ,secretary2 and 7,b7 the heads of appropriate ,federal agencies with expertise and experience in satellite operations1 including the entities described in section #c7;c7 to enable the alignment of ,federal efforts on commercial satellite system cybersecurity and1 to the extent practicable1 consistency in ,federal recommendations relating to commercial satellite system cybersecurity2 and 7#c7 consult with non-,federal entities developing commercial satellite systems or otherwise supporting the cybersecurity of commercial satellite systems1 including private1 consensus organizations that develop relevant standards4 7e7 ,report ,not later than #a year after the date of enactment of this ,act1 and every #b years thereafter until the date that is #i years after the date of enactment of this ,act1 the ,secretary shall submit to the appropriate congressional committees a report summarizing-- 7#a7 the general status of any partnership with the private sector described in subsection 7d77#a72 7#b7 the results of consultations with a non-,federal entity described in subsection 7d77#c72 7#c7 the coordination carried out pursuant to subsection 7d77#b72 7#d7 the establishment and maintenance of the clearinghouse pursuant to subsection 7b72 7#e7 the recommendations consolidated pursuant to subsection 7c77#a72 and 7#f7 general feedback received by the ,secretary on the clearinghouse from non-,federal entities1 including overall trends and any proposed changes to the clearinghouse as a result of the feedback4 #e4 ,strategy ,not later than #abj days after the date of the enactment of this ,act1 the ,secretary1 jointly with the ,national ,space ,council and the ,office of the ,national ,cyber ,director1 in coordination with the ,secretary of ,homeland ,security1 the ,director of the ,office of ,space ,commerce1 the ,director of the ,office of ,science and ,technology ,policy1 and the heads of other relevant agencies1 shall submit to the appropriate congressional committees a strategy to support coordination1 information sharing1 and voluntary best practices among ,federal agencies and private sector stakeholders relating to the cybersecurity of commercial satellite systems1 which shall include an identification of-- 7#a7 proposed coordination roles among relevant agencies2 and 7#b7 as applicable1 the extent to which cybersecurity threats to commercial satellite systems are addressed in-- 7,a7 critical infrastructure risk analyses and protection plans2 and 7,b7 activities relating to commercial satellite systems4 #f4 ,rules of construction ,nothing in this ,act shall be construed to-- 7#a7 designate commercial satellite systems or other space assets as a critical infrastructure sector2 7#b7 infringe upon or alter the authorities of the agencies described in section #c7;c72 7#c7 authorize the development or implementation of any rulemaking or regulatory requirement1 including by way of enforcement action or condition on any license or permit for a commercial satellite system2 or 7#d7 modify or expand existing authorities of the ,committee on ,foreign ,investment in the ,united ,states or the ,committee for the ,assessment of ,foreign ,participation in the ,united ,states ,telecommunications ,service ,sector4 ,passed the ,senate ,september #bc1 #bjbf4,secretary