,,ii #aaith ,,congress #b;d ,session ,s4 #eejh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bd1 #bjbf,mr4 ,warner 7for himself and ,mr4 ,cruz7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish a public-private working group to develop cybersecurity best practices for telecommunications carriers and related supply chain participants1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,telecommunications ,cybersecurity and ,resilience ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,assistant secretary ,the term ,assistant ,secretary means the ,assistant ,secretary of ,commerce for ,communications and ,information4 7#b7 ,eligible entity ,the term eligible entity means-- 7,a7 a telecommunications carrier2 or 7,b7 any other telecommunications sector or related supply chain stakeholder for which ,industry ,best ,practices are developed under section #d4 7#c7 ,,cisa ,the term ,,cisa means the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,commission ,the term ,commission means the ,federal ,communications ,commission4 7#e7 ,,csrma ,the term ,,csrma means ,communications ,sector ,risk ,management ,agency4 7#f7 ,,csric ,the term ,,csric means the ,communications ,security1 ,reliability1 and ,interoperability ,council ,federal advisory committee to the ,commission4 7#g7 ,industry best practices ,the term ,industry ,best ,practices means voluntary cybersecurity frameworks and best practices for eligible entities described in section #d7;a74 7#h7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#i7 ,,nist ,,csf ,the term ,,nist ,,csf means the latest version of the ,,nist ,cybersecurity ,framework4 7#aj7 ,,nsa ,the term ,,nsa means the ,national ,security ,agency4 7#aa7 ,,ntia ,the term ,,ntia means the ,national ,telecommunications and ,information ,administration4 7#ab7 ,,odni ,the term ,,odni means the ,office of the ,director of ,national ,intelligence4 7#ac7 ,,oncd ,the term ,,oncd means the ,office of the ,national ,cyber ,director4 7#ad7 ,relevant congressional committees ,the term relevant congressional committees means the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives4 7#ae7 ,telecommunications carrier ,the term telecommunications carrier has the meaning given that term in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec74 7#af7 ,working group ,the term ,working ,group means the ,telecommunications ,cybersecurity ,working ,group established under section #c7;a74 #c4 ,telecommunications cybersecurity working group 7a7 ,establishment ,there is established1 within ,,ntia1 a public-private advisory body to be known as the ,telecommunications ,cybersecurity ,working ,group that shall-- 7#a7 develop ,industry ,best ,practices1 including associated adoption instructions and materials as outlined in section #d2 7#b7 create a network of independent third-party assessors eligible to certify implementation and maintenance of best practices under section #e1 including criteria for such assessors2 and 7#c7 provide and advise on technical feedback and implementation guidance relating to ,industry ,best ,practices developed pursuant to paragraph 7#a74 7b7 ,membership 7#a7 ,in general ,the ,working ,group shall include representatives from ,,ntia1 ,,cisa1 ,,nist1 ,,odni1 ,,oncd1 ,,nsa1 the ,commission1 and industry members appointed in accordance with paragraph 7#b74 7#b7 ,initial appointment of industry members ,the ,assistant ,secretary shall appoint initial members of the ,working ,group that1 to the extent practicable1 represent the following stakeholder categories3 7,a7 ,national telecommunications carriers4 7,b7 ,regional and rural telecommunications carriers1 including small and medium-sized telecommunications providers4 7,c7 ,communications sector suppliers1 including network infrastructure and equipment manufacturers4 7,d7 ,software and systems providers that offer cloud services1 network management1 or cybersecurity tools4 7,e7 ,state and local government communications or emergency network operators4 7,f7 ,independent cybersecurity experts and representatives of academia4 7,g7 ,other relevant supply chain stakeholders1 as jointly determined by the co-chairs4 7#c7 ,terms and vacancies of industry members 7,a7 ,terms ,each industry member of the ,working ,group shall serve #a term of not longer than #b years and may be reappointed for #a successive term4 7,b7 ,vacancy replacement ,the ,working ,group shall develop a vacancy replacement procedure that includes-- 7i7 for vacancies occurring due to the end of an industry member's term1 a vote not later than #ij days before the last day of the industry member's term2 and 7ii7 for vacancies occurring under paragraph 7#d7 or for any other reason1 joint nomination of a replacement by the co-chairs from the same stakeholder category under paragraph 7#b71 to the extent practicable1 as the industry member creating the vacancy1 subject to approval by a majority vote of the members of the ,working ,group4 7#d7 ,removal ,any member that fails to comply with the conflict of interest policy adopted pursuant to subsection 7c77#d7 shall be removed from the ,working ,group4 7#e7 ,co-chairs ,the ,working ,group shall have #b co-chairs1 of which-- 7,a7 #a shall be the ,assistant ,secretary2 and 7,b7 #a shall be selected by a majority vote among a quorum of the industry members appointed in accordance with paragraph 7#b74 7#f7 ,member access to classified information 7,a7 ,access 7i7 ,in general ,not later than #fj days after the date on which a member is first selected to the ,working ,group and before the member is granted access to any classified information necessary to participate in a closed session pursuant to subsection 7c77#f71 the ,assistant ,secretary shall determine1 for the purposes of the ,working ,group1 if the member should be restricted from reviewing1 discussing1 or possessing classified information4 7ii7 ,management ,access to classified materials shall be managed in accordance with ,executive ,order #acebf 7#ej ,u4,s4,c4 #cafa note2 relating to classified national security information71 or any subsequent corresponding ,executive order4 7,b7 ,protection of information ,a member of the ,working ,group granted access to classified information shall protect the classified information in accordance with the applicable requirements for the particular level of classification of the information4 7,c7 ,rule of construction ,nothing in this paragraph shall be construed to affect the security clearance of a member of the ,working ,group or the authority of a ,federal agency to provide a member of the ,working ,group access to classified information4 7c7 ,procedures 7#a7 ,designated ,federal ,officer ,the ,assistant ,secretary shall designate a ,federal officer or employee to serve as the ,designated ,federal ,officer of the ,working ,group1 consistent with the requirements of chapter #aj of title #e1 ,united ,states ,code 7commonly known as the ,federal ,advisory ,committee ,act74 7#b7 ,initial meeting and bylaws ,not later than #abj days after the date of enactment of this ,act1 the ,working ,group shall convene and establish bylaws that-- 7,a7 govern quorum and voting rules2 7,b7 set deliverable timelines and meeting schedules2 and 7,c7 create procedures for recommending third-party certification assessors1 including conflict-of-interest protocols4 7#c7 ,operating procedures ,unless otherwise specified1 the ,working ,group shall adopt written procedures governing its meetings1 consistent with chapter #aj of title #e1 ,united ,states ,code1 that include-- 7,a7 requirements for public notice of meetings and the maintenance of records and minutes2 7,b7 decision making by majority vote of those present and voting1 or in accordance with the voting rules established in the bylaws2 7,c7 authorization for the establishment of subgroups as necessary1 subject to the approval of the co-chairs2 and 7,d7 approval of the meeting agendas by the co-chair described in subsection 7b77#e77;,a71 in consultation with the co-chair described in subsection 7b77#e77;,b7 and the ,designated ,federal ,officer of the ,working ,group to ensure compliance with applicable laws4 7#d7 ,conflict-of-interest policy 7,a7 ,in general ,the ,working ,group shall adopt and enforce a written conflict of interest policy to ensure that members have a fiduciary responsibility to the ,working ,group1 a duty to report conflicts of interest1 including the appearance of a conflict of interest1 and do not participate in deliberations or votes from which they personally or their employer would directly and materially benefit4 7,b7 ,required disclosures ,the policy under subparagraph 7,a7 shall require each member to publicly disclose all relevant financial and employment relationships and include recusal procedures in the event of a conflict4 7,c7 ,records ,the ,designated ,federal ,officer of the ,working ,group shall maintain records of disclosures under subparagraph 7,b7 and make summaries of the disclosures available to ,,ntia4 7#e7 ,threat information access ,,odni1 in coordination with other appropriate ,federal entities1 shall ensure that the ,working ,group has access to relevant cybersecurity threat information1 including through closed or classified briefings for members eligible to receive such information1 when appropriate4 7#f7 ,closed sessions ,notwithstanding section #ajji of title #e1 ,united ,states ,code1 the ,working ,group may hold closed or restricted-access sessions when the ,assistant ,secretary determines that the matters to be discussed involve any of the following3 7,a7 ,classified information4 7,b7 ,sensitive cybersecurity vulnerabilities4 7,c7 ,threat information4 7,d7 ,proprietary business information4 7,e7 ,other information exempt from public disclosure under section #eeb of title #e1 ,united ,states ,code4 7d7 ,transparency and communication ,the ,assistant ,secretary shall-- 7#a7 publish ,industry ,best ,practices1 implementation guidance1 and criteria for third-party assessors2 7#b7 publish on the website of ,,ntia and submit to the relevant congressional committees the bylaws1 membership1 and procedures of the ,working ,group2 and 7#c7 publish a memorandum of understanding 7or equivalent written coordination instrument7 among ,,ntia1 ,,cisa 7acting through the ,,csrma71 ,,nist1 and the ,commission describing roles1 coordination1 and non-duplication procedures under this ,act4 7e7 ,termination of ,advisory ,committee ,section #ajac7;a7 of title #e1 ,united ,states ,code1 shall not apply with respect to the ,working ,group4 #d4 ,development of ,industry ,best ,practices for cybersecurity 7a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,working ,group shall1 in consultation with the heads of ,,ntia1 ,,cisa1 ,,nist1 ,,odni1 ,,oncd1 ,,nsa1 and the ,commission1 develop and maintain cybersecurity best practices 7and corresponding implementation guidance71 referred to in this ,act as ,industry ,best ,practices1 for telecommunications carriers and other eligible entities that-- 7#a7 are for carriers and communications sector suppliers and the telecommunications sector to elect to implement and maintain2 7#b7 are issued and maintained by ,,cisa1 acting through the ,,csrma1 with ,,ntia serving as the convener and administrative home for the ,working ,group2 7#c7 apply1 as appropriate1 to communications sector suppliers and other supply chain participants1 which may participate as eligible entities for purposes of certification under section #e2 7#d7 focus solely on identifying1 responding to1 mitigating1 preventing1 and remediating cybersecurity incidents and vulnerabilities2 7#e7 are risk-based and consistent with other ,federal cybersecurity risk management frameworks1 including ,,cisa sector guidance1 the ,,nist ,cybersecurity ,framework1 the ,,nist ,risk ,management ,framework1 and relevant cybersecurity guidance developed pursuant to ,executive ,order #adjbh 7#dd ,u4,s4,c4 #ceea note2 relating to improving the nation's cybersecurity71 including those for communications subsectors1 and any relevant successor guidance2 7#f7 may account for1 as appropriate1 relevant cybersecurity requirements and certifications of a current member of the ,north ,atlantic ,treaty ,organization1 a major non-,,nato ally 7as designated under section #eag of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #bcbak771 or a member of the ,five ,eyes countries 7as defined in section #afjf7;c7 of the ,james ,m4 ,inhofe ,national ,defense ,authorization ,act for ,fiscal ,year #bjbc 7#aj ,u4,s4,c4 #bbga note771 including as relevant to interoperability or avoiding unnecessary duplication2 7#g7 avoid duplication of existing cybersecurity risk management processes2 and 7#h7 reflect available threat intelligence1 ,federal cybersecurity advisories1 and technological developments at the time of development or update4 7b7 ,industry ,best ,practices contents ,the ,industry ,best ,practices may include-- 7#a7 application of security updates to network devices1 as available2 7#b7 the timely decommissioning1 or implementation of secure alternative mitigations1 of network devices owned by and under the control and management of the telecommunications carrier that no longer receive updates by the original equipment manufacturer to address identified security vulnerabilities in the network device2 7#c7 the creation and maintenance of configuration management practices for the hardware1 software1 or firmware1 or a combination thereof1 of network devices owned by or under the control and management of the telecommunications carrier including1 at a minimum1 a baseline configuration and configuration management plan that align with internal security policies and ,,nist ,,csf #b4j industry best practices2 7#d7 implementation of appropriate multi-factor authentication1 or identity control and access management measures2 and 7#e7 other such practices as established by the ,working ,group4 7c7 ,review and update ,the ,working ,group shall review and update ,industry ,best ,practices 7and corresponding implementation guidance7 not less frequently than once every #b years1 and interim updates may be made in response to significant cybersecurity incidents or material changes in threat conditions if determined necessary by the ,working ,group1 to reflect evolving cybersecurity risks and technologies4 7d7 ,use of existing bodies ,in carrying out this section1 the ,working ,group may consult with other public-private advisory councils and relevant information-sharing organizations1 as well as any ,federal entities1 including the ,commission1 ,,ntia1 and ,,cisa1 that the ,working ,group determines may be capable of providing meaningful insight with respect to the development of ,industry ,best ,practices 7and corresponding implementation guidance74 7e7 ,publication and guidance access 7#a7 ,in general ,the ,assistant ,secretary shall publish ,industry ,best ,practices 7and corresponding implementation guidance7 on the website of ,,ntia1 to promote transparency and encourage voluntary alignment across the telecommunications sector4 7#b7 ,guidance 7,a7 ,withholding for cybersecurity ,the ,assistant ,secretary1 in consultation with the head of ,,cisa1 may withhold detailed implementation guidance from public release to mitigate cybersecurity risks1 provided that the implementation guidance is made available to eligible entities and eligible cybersecurity assessors for purposes of certification under section #e4 7,b7 ,exemption from disclosure ,detailed implementation guidance withheld under subparagraph 7,a7 is exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code4 7,c7 ,no use for regulatory enforcement ,no information disclosed by an eligible entity for the purposes of informing guidance published or disclosed pursuant to this paragraph may be used in any regulatory proceeding or enforcement action4 7,d7 ,rule of ,construction 7no new ,commission authority7 ,nothing in this ,act shall be construed to expand the authority of the ,commission to promulgate or enforce cybersecurity regulations1 or to require adoption of ,industry ,best ,practices1 which eligible entities may elect to adopt4 7,e7 ,no adverse inference ,no regulatory agency may draw any inferences from an eligible entity choosing not to adopt ,industry ,best ,practices or implementation guidance4 #e4 ,cybersecurity certification requirements for eligible entities 7a7 ,eligible assessor criteria and publication 7#a7 ,development and approval of criteria 7,a7 ,development of criteria ,the ,working ,group shall determine1 and the ,assistant ,secretary shall approve1 criteria for independent third-party cybersecurity assessors4 7,b7 ,documentation ,in developing the criteria under subparagraph 7,a71 the ,working ,group shall publish the assessment criteria and general methodology to be used by eligible cybersecurity assessors1 except for information the ,assistant ,secretary determines should be withheld to mitigate cybersecurity risks4 7#b7 ,publication of eligible cybersecurity assessors ,the ,assistant ,secretary shall-- 7,a7 establish an evaluation process and assessment standard for designating eligible cybersecurity assessors2 7,b7 publish a list of eligible cybersecurity assessors designated pursuant to subparagraph 7,a7 that a telecommunications carrier1 or other eligible entity for which ,industry ,best ,practices were developed1 may elect to evaluate the telecommunication carrier's or eligible entity's implementation of ,industry ,best ,practices and that may issue a proposed certification2 and 7,c7 establish conditions under which to revoke or suspend the designation as an eligible cybersecurity assessor4 7#c7 ,prohibition on certain assessors ,no entity owned or controlled by a telecommunications carrier may be designated as an eligible cybersecurity assessor under this subsection4 7b7 ,certification and ,approval ,process 7#a7 ,approval of certification 7,a7 ,submission 7i7 ,in general ,a telecommunications carrier or other eligible entity that elects to have an eligible cybersecurity assessor evaluate the telecommunication carrier or eligible entity and receives a proposed certification may submit the proposed certification to the ,assistant ,secretary for approval4 7ii7 ,format of submissions ,the ,assistant ,secretary may require submissions of the proposed certification under clause 7i7 to be submitted in machine readable format in the ,open ,security ,controls ,assessment ,language architecture developed by ,,nist1 or a successor framework4 7,b7 ,contents of submission ,a submission under subparagraph 7,a7 shall include-- 7i7 the full assessment report prepared by the eligible cybersecurity assessor2 7ii7 documentation of the ,industry ,best ,practices against which the telecommunications carrier or other eligible entity was evaluated2 and 7iii7 the disclosures required under subsection 7c77#d74 7,c7 ,timeframe for decision ,upon receipt of a proposed certification for approval1 the ,assistant ,secretary shall1 within #cj days1 determine whether the submission is complete and1 not later than #ij days after the date of such determination1 approve or disapprove the complete proposed certification4 7,d7 ,disapproval of certification ,in the event that the ,assistant ,secretary disapproves a proposed certification under this paragraph1 the ,assistant ,secretary shall inform the eligible entity of the basis for the disapproval4 7,e7 ,right to cure and appeal 7i7 ,right to cure ,an eligible entity the proposed certification of which was disapproved by the ,assistant ,secretary shall have #cj days to resubmit the proposed certification1 during which period no adverse action shall be taken by the ,assistant ,secretary against the eligible entity on the basis of lacking a certification4 7ii7 ,right to ,appeal 7,i7 ,in general ,an eligible entity described in clause 7i7 may appeal the disapproval to the ,assistant ,secretary4 7,,ii7 ,process ,the ,assistant ,secretary shall establish the manner and form in which appeals under this clause shall be heard and shall render a decision on any such appeal not later than #ij days after the date of the initiation of the appeal4 7#b7 ,effect of certification ,a certified telecommunications carrier or other eligible entity shall1 in any ,federal or ,state court1 be entitled to an affirmative defense that approval of a certification under paragraph 7#a7 constitutes due care or reasonableness for mitigating1 preventing1 and remediating cybersecurity incidents and vulnerabilities1 unless the telecommunications carrier or other eligible entity is found to have acted with gross negligence1 willful misconduct1 or have not materially implemented and maintained the ,industry ,best ,practices consistent with the approved certification4 7#c7 ,timing2 later change ,the defense under paragraph 7#b7 shall apply if the eligible entity was certified and in compliance with the ,industry ,best ,practices in effect at the time of the incident1 notwithstanding-- 7,a7 subsequent revisions to ,industry ,best ,practices2 or 7,b7 subsequent expiration1 subsequent suspension1 or non-renewal of the certification4 7#d7 ,conflict preemption ,no ,state or political subdivision of a ,state may establish1 maintain1 prescribe1 continue1 or enforce any law1 rule1 regulation1 or requirement imposing a duty1 standard1 requirement1 or liability or enforcing standards for cybersecurity that are inconsistent with this ,act with respect to a certified eligible entity4 7c7 ,certification requirements ,each approved certification under subsection 7b77#a7 shall-- 7#a7 be valid for a period of not more than #b years2 7#b7 be renewable through comprehensive reassessment2 7#c7 include documentation of implementation and maintenance of the applicable ,industry ,best ,practices at the time of certification2 7#d7 require disclosure of any direct financial interest or material business relationship between the assessor and the entity being assessed2 7#e7 include a description of the assessment methodology and criteria used2 and 7#f7 be subject to revocation by the ,assistant ,secretary if the assessor is found to have issued invalid or false certifications4 7d7 ,whistleblower protection 7#a7 ,in general ,no eligible cybersecurity assessor or telecommunications carrier with an approved or pending certification1 or any officer1 employee1 contractor1 subcontractor1 or agent of such company1 may discharge1 demote1 suspend1 threaten1 harass1 or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee to provide information to1 cause information to be provided to1 or otherwise assist in an investigation by an agency1 entity1 or person described in paragraph 7#b71 relating to any conduct that the employee reasonably believes reflects non-compliance with or gross misrepresentation relating to the certification standard established by the ,working ,group4 7#b7 ,agency1 entity1 or person described ,an agency1 entity1 or person described in this paragraph is-- 7,a7 a ,federal regulatory or law enforcement agency2 7,b7 any ,member of ,congress or any committee of ,congress2 or 7,c7 a person with supervisory authority over the employee 7or such other person working for the employer who has the authority to investigate1 discover1 or terminate misconduct74 7e7 ,routine implementation and maintenance obligation ,a certified eligible entity shall routinely implement and maintain cybersecurity practices aligned with ,industry ,best ,practices1 as updated1 during the period of certification4 7f7 ,early reassessment 7#a7 ,authority 7,a7 ,in general ,upon any of the grounds described in paragraph 7#b71 the ,assistant ,secretary may direct an eligible cybersecurity assessor to conduct1 or may on the ,assistant ,secretary's own initiative commission by an alternative eligible cybersecurity assessor1 an early reassessment of a certified eligible entity and may1 upon a written finding of credible evidence of material failure to implement or maintain the ,industry ,best ,practices1 suspend the approved certification of the eligible entity pending successful completion of the reassessment4 7,b7 ,responsibility for costs associated with assessment ,if an assessment conducted pursuant to subparagraph 7,a7 determines that the eligible entity has materially failed to implement or maintain the ,industry ,best ,practices1 the eligible entity shall be responsible for all costs associated with performing the assessment4 7#b7 ,grounds for reassessment ,the grounds described in this paragraph include-- 7,a7 a substantial revision to ,industry ,best ,practices2 7,b7 a telecommunications carrier or other eligible entity experiences a significant cyber-incident1 as defined by ,presidential ,policy ,directive-#da 7,july #bf1 #bjaf2 relating to ,united ,states cyber incident coordination72 and 7,c7 the ,assistant ,secretary receives credible information that-- 7i7 any of the contents submitted to the ,assistant ,secretary under subsection 7b77#a7 to approve a certification were false or fraudulent2 or 7ii7 an eligible entity has failed to routinely implement and maintain cybersecurity practices in accordance with subsection 7e74 7#c7 ,good faith protection ,a certified telecommunications carrier or other eligible entity shall not have its certification under subsection 7b7 revoked solely due to an early reassessment under this subsection1 unless and until the early reassessment produces a final determination that the eligible entity-- 7,a7 materially failed to implement or maintain the ,industry ,best ,practices the entity elected to adopt through the certification process2 or 7,b7 has engaged in gross negligence or willful misconduct4 #f4 ,reporting requirements 7a7 ,annual report ,not later than #a year after the publication of any ,industry ,best ,practices developed under section #d1 and annually thereafter1 the ,assistant ,secretary1 in consultation with the ,working ,group1 shall submit to the relevant congressional committees and publish a public version on the website of ,,ntia a report that includes-- 7#a7 an overview of the development of ,industry ,best ,practices1 and any updates or modifications of ,industry ,best ,practices2 7#b7 data on participation of eligible entities in the certification process2 7#c7 a summary of early reassessment activity1 if any2 7#d7 an assessment of the adoption of ,industry ,best ,practices2 and 7#e7 the effectiveness of ,industry ,best ,practices and certification in enhancing cybersecurity across the telecommunications sector4 7b7 ,event-,triggered report ,not later than #ij days after a substantial revision to ,industry ,best ,practices or a significant cyber-incident1 as defined in ,presidential ,policy ,directive-#da 7,july #bf1 #bjaf2 relating to ,united ,states cyber incident coordination71 affecting the telecommunications sector1 the ,assistant ,secretary1 in consultation with the ,working ,group1 shall submit to ,congress a report that includes1 to the greatest extent practicable1 the consensus views and recommendations of the ,working ,group to improve cybersecurity across the telecommunications sector4 #g4 ,rules of construction ,nothing in this ,act shall be construed to-- 7#a7 grant any regulatory authority to any ,federal agency2 7#b7 expand or otherwise alter obligations or authorities under the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq471 the ,secure and ,trusted ,communications ,networks ,act of #bjai 7#dg ,u4,s4,c4 #afja et seq471 the ,secure ,equipment ,act of #bjba 7#dg ,u4,s4,c4 #afja note71 or any other ,federal law2 7#c7 prohibit the ,working ,group from consulting with or referencing the work product of ,federal advisory committees subject to chapter #aj of title #e1 ,united ,states ,code1 including the ,president's ,national ,security ,telecommunications ,advisory ,committee1 ,,csric1 and the ,commission's ,technological ,advisory ,council2 7#d7 require adoption of ,industry ,best ,practices or implementation guidance1 or authorize any regulatory requirement of adoption2 7#e7 displace or replace the functions of any ,federal advisory council or information-sharing agreement2 7#f7 grant regulatory authority to the ,commission1 or any other ,federal body2 or 7#g7 authorize1 expand1 or imply any ,federal authority to supervise1 direct1 mandate1 regulate1 audit1 or otherwise oversee the cybersecurity operations1 risk-management programs1 technical controls1 or network security practices of any telecommunications carrier or other eligible entity1 except as expressly permitted for the development1 publication1 and voluntary certification of ,industry ,best ,practices under this ,act4 #h4 ,severability ,if any provision of this ,act1 or its application to any person or circumstance1 is held to be unconstitutional1 the remainder of this ,act1 and the application of the provision to any other person or circumstance1 shall not be affected4