,,ii #aai? ,,congress #b;d ,session ,s4 #eejh ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,septemb] #bd1 #bjbf,mr4 ,w>n] 7= himself & ,mr4 ,cruz7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ,a ,,bill ,to e/abli% a public-private work+ gr\p to develop cyb]security be/ practices = telecommunications c>ri]s & relat$ supply *a9 p>ticipants1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,telecommunications ,cyb]security & ,resili5ce ,act4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,assi/ant secret>y ,! t]m ,assi/ant ,secret>y means ! ,assi/ant ,secret>y ( ,comm]ce = ,communications & ,in=mation4 7#b7 ,eligible entity ,! t]m eligible entity means-- 7,a7 a telecommunications c>ri]2 or 7,b7 any o!r telecommunications sector or relat$ supply *a9 /akehold] = :i* ,indu/ry ,be/ ,practices are develop$ "u section #d4 7#c7 ,,cisa ,! t]m ,,cisa means ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#d7 ,commission ,! t]m ,commission means ! ,f$]al ,communications ,commission4 7#e7 ,,csrma ,! t]m ,,csrma means ,communications ,sector ,risk ,managem5t ,ag5cy4 7#f7 ,,csric ,! t]m ,,csric means ! ,communications ,security1 ,reliability1 & ,int]op]ability ,c\ncil ,f$]al advisory committee to ! ,commission4 7#g7 ,indu/ry be/ practices ,! t]m ,indu/ry ,be/ ,practices means volunt>y cyb]security frameworks & be/ practices = eligible entities describ$ 9 section #d7;a74 7#h7 ,,ni/ ,! t]m ,,ni/ means ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7#i7 ,,ni/ ,,csf ,! t]m ,,ni/ ,,csf means ! late/ v]sion ( ! ,,ni/ ,cyb]security ,framework4 7#aj7 ,,nsa ,! t]m ,,nsa means ! ,national ,security ,ag5cy4 7#aa7 ,,ntia ,! t]m ,,ntia means ! ,national ,telecommunications & ,in=mation ,adm9i/ration4 7#ab7 ,,odni ,! t]m ,,odni means ! ,(fice ( ! ,director ( ,national ,intellig5ce4 7#ac7 ,,oncd ,! t]m ,,oncd means ! ,(fice ( ! ,national ,cyb] ,director4 7#ad7 ,relevant congressional committees ,! t]m relevant congressional committees means ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives4 7#ae7 ,telecommunications c>ri] ,! t]m telecommunications c>ri] has ! mean+ giv5 t t]m 9 section #c ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aec74 7#af7 ,work+ gr\p ,! t]m ,work+ ,gr\p means ! ,telecommunications ,cyb]security ,work+ ,gr\p e/abli%$ "u section #c7;a74 #c4 ,telecommunications cyb]security work+ gr\p 7a7 ,e/abli%m5t ,!re is e/abli%$1 )9 ,,ntia1 a public-private advisory body to be kn[n z ! ,telecommunications ,cyb]security ,work+ ,gr\p t %all-- 7#a7 develop ,indu/ry ,be/ ,practices1 includ+ associat$ adoption in/ructions & mat]ials z outl9$ 9 section #d2 7#b7 create a network ( indep5d5t ?ird-p>ty assessors eligible to c]tify implem5tation & ma9t5ance ( be/ practices "u section #e1 includ+ crit]ia = su* assessors2 & 7#c7 provide & advise on te*nical fe$back & implem5tation guidance relat+ to ,indu/ry ,be/ ,practices develop$ pursuant to p>agraph 7#a74 7b7 ,memb]%ip 7#a7 ,9 g5]al ,! ,work+ ,gr\p %all include repres5tatives f ,,ntia1 ,,cisa1 ,,ni/1 ,,odni1 ,,oncd1 ,,nsa1 ! ,commission1 & indu/ry memb]s appo9t$ 9 accordance ) p>agraph 7#b74 7#b7 ,initial appo9tm5t ( indu/ry memb]s ,! ,assi/ant ,secret>y %all appo9t initial memb]s ( ! ,work+ ,gr\p t1 to ! ext5t practicable1 repres5t ! foll[+ /akehold] categories3 7,a7 ,national telecommunications c>ri]s4 7,b7 ,regional & rural telecommunications c>ri]s1 includ+ small & m$ium-siz$ telecommunications provid]s4 7,c7 ,communications sector suppli]s1 includ+ network infra/ructure & equipm5t manufactur]s4 7,d7 ,s(tw>e & sy/ems provid]s t (f] cl\d s]vices1 network managem5t1 or cyb]security tools4 7,e7 ,/ate & local gov]nm5t communications or em]g5cy network op]ators4 7,f7 ,indep5d5t cyb]security exp]ts & repres5tatives ( academia4 7,g7 ,o!r relevant supply *a9 /akehold]s1 z jo9tly det]m9$ by ! co-*airs4 7#c7 ,t]ms & vacancies ( indu/ry memb]s 7,a7 ,t]ms ,ea* indu/ry memb] ( ! ,work+ ,gr\p %all s]ve #a t]m ( n long] ?an #b ye>s & may be reappo9t$ = #a successive t]m4 7,b7 ,vacancy replacem5t ,! ,work+ ,gr\p %all develop a vacancy replacem5t proc$ure t includes-- 7i7 = vacancies occurr+ due to ! end ( an indu/ry memb]'s t]m1 a vote n lat] ?an #ij days be=e ! la/ day ( ! indu/ry memb]'s t]m2 & 7ii7 = vacancies occurr+ "u p>agraph 7#d7 or = any o!r reason1 jo9t nom9ation ( a replacem5t by ! co-*airs f ! same /akehold] category "u p>agraph 7#b71 to ! ext5t practicable1 z ! indu/ry memb] creat+ ! vacancy1 subject to approval by a majority vote ( ! memb]s ( ! ,work+ ,gr\p4 7#d7 ,removal ,any memb] t fails to comply ) ! conflict ( int]e/ policy adopt$ pursuant to subsection 7c77#d7 %all be remov$ f ! ,work+ ,gr\p4 7#e7 ,co-*airs ,! ,work+ ,gr\p %all h #b co-*airs1 ( :i*-- 7,a7 #a %all be ! ,assi/ant ,secret>y2 & 7,b7 #a %all be select$ by a majority vote among a quorum ( ! indu/ry memb]s appo9t$ 9 accordance ) p>agraph 7#b74 7#f7 ,memb] access to classifi$ in=mation 7,a7 ,access 7i7 ,9 g5]al ,n lat] ?an #fj days aft] ! date on :i* a memb] is fir/ select$ to ! ,work+ ,gr\p & be=e ! memb] is grant$ access to any classifi$ in=mation necess>y to p>ticipate 9 a clos$ session pursuant to subsection 7c77#f71 ! ,assi/ant ,secret>y %all det]m9e1 = ! purposes ( ! ,work+ ,gr\p1 if ! memb] %\ld be re/rict$ f review+1 discuss+1 or possess+ classifi$ in=mation4 7ii7 ,managem5t ,access to classifi$ mat]ials %all be manag$ 9 accordance ) ,executive ,ord] #acebf 7#ej ,u4,s4,c4 #cafa note2 relat+ to classifi$ national security in=mation71 or any subsequ5t correspond+ ,executive ord]4 7,b7 ,protection ( in=mation ,a memb] ( ! ,work+ ,gr\p grant$ access to classifi$ in=mation %all protect ! classifi$ in=mation 9 accordance ) ! applicable requirem5ts = ! p>ticul> level ( classification ( ! in=mation4 7,c7 ,rule ( con/ruction ,no?+ 9 ?is p>agraph %all be con/ru$ to affect ! security cle>ance ( a memb] ( ! ,work+ ,gr\p or ! au?ority ( a ,f$]al ag5cy to provide a memb] ( ! ,work+ ,gr\p access to classifi$ in=mation4 7c7 ,proc$ures 7#a7 ,designat$ ,f$]al ,(fic] ,! ,assi/ant ,secret>y %all designate a ,f$]al (fic] or employee to s]ve z ! ,designat$ ,f$]al ,(fic] ( ! ,work+ ,gr\p1 consi/5t ) ! requirem5ts ( *apt] #aj ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,f$]al ,advisory ,committee ,act74 7#b7 ,initial meet+ & bylaws ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,work+ ,gr\p %all conv5e & e/abli% bylaws t-- 7,a7 gov]n quorum & vot+ rules2 7,b7 set deliv]able timel9es & meet+ s*$ules2 & 7,c7 create proc$ures = recomm5d+ ?ird-p>ty c]tification assessors1 includ+ conflict-(-int]e/ protocols4 7#c7 ,op]at+ proc$ures ,unless o!rwise specifi$1 ! ,work+ ,gr\p %all adopt writt5 proc$ures gov]n+ its meet+s1 consi/5t ) *apt] #aj ( title #e1 ,unit$ ,/ates ,code1 t include-- 7,a7 requirem5ts = public notice ( meet+s & ! ma9t5ance ( records & m9utes2 7,b7 decision mak+ by majority vote ( ^? pres5t & vot+1 or 9 accordance ) ! vot+ rules e/abli%$ 9 ! bylaws2 7,c7 au?orization = ! e/abli%m5t ( subgr\ps z necess>y1 subject to ! approval ( ! co-*airs2 & 7,d7 approval ( ! meet+ ag5das by ! co-*air describ$ 9 subsection 7b77#e77;,a71 9 consultation ) ! co-*air describ$ 9 subsection 7b77#e77;,b7 & ! ,designat$ ,f$]al ,(fic] ( ! ,work+ ,gr\p to ensure compliance ) applicable laws4 7#d7 ,conflict-(-int]e/ policy 7,a7 ,9 g5]al ,! ,work+ ,gr\p %all adopt & en=ce a writt5 conflict ( int]e/ policy to ensure t memb]s h a fiduci>y responsibility to ! ,work+ ,gr\p1 a duty to report conflicts ( int]e/1 includ+ ! appe>ance ( a conflict ( int]e/1 & d n p>ticipate 9 delib]ations or votes f :i* !y p]sonally or _! employ] w\ld directly & mat]ially b5efit4 7,b7 ,requir$ disclosures ,! policy "u subp>agraph 7,a7 %all require ea* memb] to publicly disclose all relevant f9ancial & employm5t relation%ips & include recusal proc$ures 9 ! ev5t ( a conflict4 7,c7 ,records ,! ,designat$ ,f$]al ,(fic] ( ! ,work+ ,gr\p %all ma9ta9 records ( disclosures "u subp>agraph 7,b7 & make summ>ies ( ! disclosures available to ,,ntia4 7#e7 ,?reat in=mation access ,,odni1 9 coord9ation ) o!r appropriate ,f$]al entities1 %all ensure t ! ,work+ ,gr\p has access to relevant cyb]security ?reat in=mation1 includ+ ?r\gh clos$ or classifi$ brief+s = memb]s eligible to receive su* in=mation1 :5 appropriate4 7#f7 ,clos$ sessions ,not)/&+ section #ajji ( title #e1 ,unit$ ,/ates ,code1 ! ,work+ ,gr\p may hold clos$ or re/rict$-access sessions :5 ! ,assi/ant ,secret>y det]m9es t ! matt]s to be discuss$ involve any ( ! foll[+3 7,a7 ,classifi$ in=mation4 7,b7 ,s5sitive cyb]security vuln]abilities4 7,c7 ,?reat in=mation4 7,d7 ,propriet>y bus9ess in=mation4 7,e7 ,o!r in=mation exempt f public disclosure "u section #eeb ( title #e1 ,unit$ ,/ates ,code4 7d7 ,transp>5cy & communication ,! ,assi/ant ,secret>y %all-- 7#a7 publi% ,indu/ry ,be/ ,practices1 implem5tation guidance1 & crit]ia = ?ird-p>ty assessors2 7#b7 publi% on ! website ( ,,ntia & submit to ! relevant congressional committees ! bylaws1 memb]%ip1 & proc$ures ( ! ,work+ ,gr\p2 & 7#c7 publi% a memor&um ( und]/&+ 7or equival5t writt5 coord9ation in/rum5t7 among ,,ntia1 ,,cisa 7act+ ?r\gh ! ,,csrma71 ,,ni/1 & ! ,commission describ+ roles1 coord9ation1 & non-duplication proc$ures "u ?is ,act4 7e7 ,t]m9ation ( ,advisory ,committee ,section #ajac7;a7 ( title #e1 ,unit$ ,/ates ,code1 %all n apply ) respect to ! ,work+ ,gr\p4 #d4 ,developm5t ( ,indu/ry ,be/ ,practices = cyb]security 7a7 ,9 g5]al ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,work+ ,gr\p %all1 9 consultation ) ! heads ( ,,ntia1 ,,cisa1 ,,ni/1 ,,odni1 ,,oncd1 ,,nsa1 & ! ,commission1 develop & ma9ta9 cyb]security be/ practices 7& correspond+ implem5tation guidance71 ref]r$ to 9 ?is ,act z ,indu/ry ,be/ ,practices1 = telecommunications c>ri]s & o!r eligible entities t-- 7#a7 are = c>ri]s & communications sector suppli]s & ! telecommunications sector to elect to implem5t & ma9ta92 7#b7 are issu$ & ma9ta9$ by ,,cisa1 act+ ?r\gh ! ,,csrma1 ) ,,ntia s]v+ z ! conv5] & adm9i/rative home = ! ,work+ ,gr\p2 7#c7 apply1 z appropriate1 to communications sector suppli]s & o!r supply *a9 p>ticipants1 :i* may p>ticipate z eligible entities = purposes ( c]tification "u section #e2 7#d7 focus solely on id5tify+1 respond+ to1 mitigat+1 prev5t+1 & rem$iat+ cyb]security incid5ts & vuln]abilities2 7#e7 are risk-bas$ & consi/5t ) o!r ,f$]al cyb]security risk managem5t frameworks1 includ+ ,,cisa sector guidance1 ! ,,ni/ ,cyb]security ,framework1 ! ,,ni/ ,risk ,managem5t ,framework1 & relevant cyb]security guidance develop$ pursuant to ,executive ,ord] #adjbh 7#dd ,u4,s4,c4 #ceea note2 relat+ to improv+ ! nation's cyb]security71 includ+ ^? = communications subsectors1 & any relevant successor guidance2 7#f7 may acc\nt =1 z appropriate1 relevant cyb]security requirem5ts & c]tifications ( a curr5t memb] ( ! ,nor? ,atlantic ,treaty ,organization1 a major non-,,nato ally 7z designat$ "u section #eag ( ! ,=eign ,assi/ance ,act ( #aifa 7#bb ,u4,s4,c4 #bcbak771 or a memb] ( ! ,five ,eyes c\ntries 7z def9$ 9 section #afjf7;c7 ( ! ,james ,m4 ,inh(e ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjbc 7#aj ,u4,s4,c4 #bbga note771 includ+ z relevant to int]op]ability or avoid+ unnecess>y duplication2 7#g7 avoid duplication ( exi/+ cyb]security risk managem5t processes2 & 7#h7 reflect available ?reat intellig5ce1 ,f$]al cyb]security advisories1 & te*nological developm5ts at ! "t ( developm5t or update4 7b7 ,indu/ry ,be/ ,practices cont5ts ,! ,indu/ry ,be/ ,practices may include-- 7#a7 application ( security updates to network devices1 z available2 7#b7 ! timely decommission+1 or implem5tation ( secure alt]native mitigations1 ( network devices own$ by & "u ! control & managem5t ( ! telecommunications c>ri] t no long] receive updates by ! orig9al equipm5t manufactur] to address id5tifi$ security vuln]abilities 9 ! network device2 7#c7 ! creation & ma9t5ance ( configuration managem5t practices = ! h>dw>e1 s(tw>e1 or firmw>e1 or a comb9ation !re(1 ( network devices own$ by or "u ! control & managem5t ( ! telecommunications c>ri] includ+1 at a m9imum1 a basel9e configuration & configuration managem5t plan t align ) int]nal security policies & ,,ni/ ,,csf #b4j indu/ry be/ practices2 7#d7 implem5tation ( appropriate multi-factor au!ntication1 or id5tity control & access managem5t measures2 & 7#e7 o!r su* practices z e/abli%$ by ! ,work+ ,gr\p4 7c7 ,review & update ,! ,work+ ,gr\p %all review & update ,indu/ry ,be/ ,practices 7& correspond+ implem5tation guidance7 n less frequ5tly ?an once e #b ye>s1 & int]im updates may be made 9 response to significant cyb]security incid5ts or mat]ial *anges 9 ?reat conditions if det]m9$ necess>y by ! ,work+ ,gr\p1 to reflect evolv+ cyb]security risks & te*nologies4 7d7 ,use ( exi/+ bodies ,9 c>ry+ out ?is section1 ! ,work+ ,gr\p may consult ) o!r public-private advisory c\ncils & relevant in=mation-%>+ organizations1 z well z any ,f$]al entities1 includ+ ! ,commission1 ,,ntia1 & ,,cisa1 t ! ,work+ ,gr\p det]m9es may be capable ( provid+ mean+ful insight ) respect to ! developm5t ( ,indu/ry ,be/ ,practices 7& correspond+ implem5tation guidance74 7e7 ,publication & guidance access 7#a7 ,9 g5]al ,! ,assi/ant ,secret>y %all publi% ,indu/ry ,be/ ,practices 7& correspond+ implem5tation guidance7 on ! website ( ,,ntia1 to promote transp>5cy & enc\rage volunt>y alignm5t across ! telecommunications sector4 7#b7 ,guidance 7,a7 ,)hold+ = cyb]security ,! ,assi/ant ,secret>y1 9 consultation ) ! head ( ,,cisa1 may )hold detail$ implem5tation guidance f public release to mitigate cyb]security risks1 provid$ t ! implem5tation guidance is made available to eligible entities & eligible cyb]security assessors = purposes ( c]tification "u section #e4 7,b7 ,exemption f disclosure ,detail$ implem5tation guidance )held "u subp>agraph 7,a7 is exempt f disclosure "u section #eeb7;b77#c7 ( title #e1 ,unit$ ,/ates ,code4 7,c7 ,no use = regulatory en=cem5t ,no in=mation disclos$ by an eligible entity = ! purposes ( in=m+ guidance publi%$ or disclos$ pursuant to ?is p>agraph may be us$ 9 any regulatory proce$+ or en=cem5t action4 7,d7 ,rule ( ,con/ruction 7no new ,commission au?ority7 ,no?+ 9 ?is ,act %all be con/ru$ to exp& ! au?ority ( ! ,commission to promulgate or en=ce cyb]security regulations1 or to require adoption ( ,indu/ry ,be/ ,practices1 :i* eligible entities may elect to adopt4 7,e7 ,no adv]se inf]5ce ,no regulatory ag5cy may draw any inf]5ces f an eligible entity *oos+ n to adopt ,indu/ry ,be/ ,practices or implem5tation guidance4 #e4 ,cyb]security c]tification requirem5ts = eligible entities 7a7 ,eligible assessor crit]ia & publication 7#a7 ,developm5t & approval ( crit]ia 7,a7 ,developm5t ( crit]ia ,! ,work+ ,gr\p %all det]m9e1 & ! ,assi/ant ,secret>y %all approve1 crit]ia = indep5d5t ?ird-p>ty cyb]security assessors4 7,b7 ,docum5tation ,9 develop+ ! crit]ia "u subp>agraph 7,a71 ! ,work+ ,gr\p %all publi% ! assessm5t crit]ia & g5]al me?odology to be us$ by eligible cyb]security assessors1 except = in=mation ! ,assi/ant ,secret>y det]m9es %\ld be )held to mitigate cyb]security risks4 7#b7 ,publication ( eligible cyb]security assessors ,! ,assi/ant ,secret>y %all-- 7,a7 e/abli% an evaluation process & assessm5t /&>d = designat+ eligible cyb]security assessors2 7,b7 publi% a li/ ( eligible cyb]security assessors designat$ pursuant to subp>agraph 7,a7 t a telecommunications c>ri]1 or o!r eligible entity = :i* ,indu/ry ,be/ ,practices 7 develop$1 may elect to evaluate ! telecommunication c>ri]'s or eligible entity's implem5tation ( ,indu/ry ,be/ ,practices & t may issue a propos$ c]tification2 & 7,c7 e/abli% conditions "u :i* to revoke or susp5d ! designation z an eligible cyb]security assessor4 7#c7 ,prohibition on c]ta9 assessors ,no entity own$ or controll$ by a telecommunications c>ri] may be designat$ z an eligible cyb]security assessor "u ?is subsection4 7b7 ,c]tification & ,approval ,process 7#a7 ,approval ( c]tification 7,a7 ,submission 7i7 ,9 g5]al ,a telecommunications c>ri] or o!r eligible entity t elects to h an eligible cyb]security assessor evaluate ! telecommunication c>ri] or eligible entity & receives a propos$ c]tification may submit ! propos$ c]tification to ! ,assi/ant ,secret>y = approval4 7ii7 ,=mat ( submissions ,! ,assi/ant ,secret>y may require submissions ( ! propos$ c]tification "u clause 7i7 to be submitt$ 9 ma*9e readable =mat 9 ! ,op5 ,security ,controls ,assessm5t ,language ar*itecture develop$ by ,,ni/1 or a successor framework4 7,b7 ,cont5ts ( submission ,a submission "u subp>agraph 7,a7 %all include-- 7i7 ! full assessm5t report prep>$ by ! eligible cyb]security assessor2 7ii7 docum5tation ( ! ,indu/ry ,be/ ,practices aga9/ :i* ! telecommunications c>ri] or o!r eligible entity 0 evaluat$2 & 7iii7 ! disclosures requir$ "u subsection 7c77#d74 7,c7 ,timeframe = decision ,^u receipt ( a propos$ c]tification = approval1 ! ,assi/ant ,secret>y %all1 )9 #cj days1 det]m9e :e!r ! submission is complete &1 n lat] ?an #ij days aft] ! date ( su* det]m9ation1 approve or disapprove ! complete propos$ c]tification4 7,d7 ,disapproval ( c]tification ,9 ! ev5t t ! ,assi/ant ,secret>y disapproves a propos$ c]tification "u ?is p>agraph1 ! ,assi/ant ,secret>y %all in=m ! eligible entity ( ! basis = ! disapproval4 7,e7 ,"r to cure & appeal 7i7 ,"r to cure ,an eligible entity ! propos$ c]tification ( :i* 0 disapprov$ by ! ,assi/ant ,secret>y %all h #cj days to resubmit ! propos$ c]tification1 dur+ :i* p]iod no adv]se action %all be tak5 by ! ,assi/ant ,secret>y aga9/ ! eligible entity on ! basis ( lack+ a c]tification4 7ii7 ,"r to ,appeal 7,i7 ,9 g5]al ,an eligible entity describ$ 9 clause 7i7 may appeal ! disapproval to ! ,assi/ant ,secret>y4 7,,ii7 ,process ,! ,assi/ant ,secret>y %all e/abli% ! mann] & =m 9 :i* appeals "u ?is clause %all be he>d & %all r5d] a decision on any su* appeal n lat] ?an #ij days aft] ! date ( ! initiation ( ! appeal4 7#b7 ,effect ( c]tification ,a c]tifi$ telecommunications c>ri] or o!r eligible entity %all1 9 any ,f$]al or ,/ate c\rt1 be entitl$ to an affirmative def5se t approval ( a c]tification "u p>agraph 7#a7 con/itutes due c>e or reasonabl5ess = mitigat+1 prev5t+1 & rem$iat+ cyb]security incid5ts & vuln]abilities1 unless ! telecommunications c>ri] or o!r eligible entity is f\nd to h act$ ) gross neglig5ce1 willful misconduct1 or h n mat]ially implem5t$ & ma9ta9$ ! ,indu/ry ,be/ ,practices consi/5t ) ! approv$ c]tification4 7#c7 ,tim+2 lat] *ange ,! def5se "u p>agraph 7#b7 %all apply if ! eligible entity 0 c]tifi$ & 9 compliance ) ! ,indu/ry ,be/ ,practices 9 effect at ! "t ( ! incid5t1 not)/&+-- 7,a7 subsequ5t revisions to ,indu/ry ,be/ ,practices2 or 7,b7 subsequ5t expiration1 subsequ5t susp5sion1 or non-r5ewal ( ! c]tification4 7#d7 ,conflict preemption ,no ,/ate or political subdivision ( a ,/ate may e/abli%1 ma9ta91 prescribe1 cont9ue1 or en=ce any law1 rule1 regulation1 or requirem5t impos+ a duty1 /&>d1 requirem5t1 or liability or en=c+ /&>ds = cyb]security t are inconsi/5t ) ?is ,act ) respect to a c]tifi$ eligible entity4 7c7 ,c]tification requirem5ts ,ea* approv$ c]tification "u subsection 7b77#a7 %all-- 7#a7 be valid = a p]iod ( n m ?an #b ye>s2 7#b7 be r5ewable ?r\gh compreh5sive reassessm5t2 7#c7 include docum5tation ( implem5tation & ma9t5ance ( ! applicable ,indu/ry ,be/ ,practices at ! "t ( c]tification2 7#d7 require disclosure ( any direct f9ancial int]e/ or mat]ial bus9ess relation%ip betwe5 ! assessor & ! entity be+ assess$2 7#e7 include a description ( ! assessm5t me?odology & crit]ia us$2 & 7#f7 be subject to revocation by ! ,assi/ant ,secret>y if ! assessor is f\nd to h issu$ invalid or false c]tifications4 7d7 ,:i/lebl[] protection 7#a7 ,9 g5]al ,no eligible cyb]security assessor or telecommunications c>ri] ) an approv$ or p5d+ c]tification1 or any (fic]1 employee1 contractor1 subcontractor1 or ag5t ( su* company1 may dis*>ge1 demote1 susp5d1 ?reat51 h>ass1 or 9 any o!r mann] discrim9ate aga9/ an employee 9 ! t]ms & conditions ( employm5t because ( any lawful act done by ! employee to provide in=mation to1 cause in=mation to be provid$ to1 or o!rwise assi/ 9 an inve/igation by an ag5cy1 entity1 or p]son describ$ 9 p>agraph 7#b71 relat+ to any conduct t ! employee reasonably believes reflects non-compliance ) or gross misrepres5tation relat+ to ! c]tification /&>d e/abli%$ by ! ,work+ ,gr\p4 7#b7 ,ag5cy1 entity1 or p]son describ$ ,an ag5cy1 entity1 or p]son describ$ 9 ?is p>agraph is-- 7,a7 a ,f$]al regulatory or law en=cem5t ag5cy2 7,b7 any ,memb] ( ,congress or any committee ( ,congress2 or 7,c7 a p]son ) sup]visory au?ority ov] ! employee 7or su* o!r p]son work+ = ! employ] :o has ! au?ority to inve/igate1 discov]1 or t]m9ate misconduct74 7e7 ,r\t9e implem5tation & ma9t5ance obligation ,a c]tifi$ eligible entity %all r\t9ely implem5t & ma9ta9 cyb]security practices align$ ) ,indu/ry ,be/ ,practices1 z updat$1 dur+ ! p]iod ( c]tification4 7f7 ,e>ly reassessm5t 7#a7 ,au?ority 7,a7 ,9 g5]al ,^u any ( ! gr\nds describ$ 9 p>agraph 7#b71 ! ,assi/ant ,secret>y may direct an eligible cyb]security assessor to conduct1 or may on ! ,assi/ant ,secret>y's own initiative commission by an alt]native eligible cyb]security assessor1 an e>ly reassessm5t ( a c]tifi$ eligible entity & may1 ^u a writt5 f9d+ ( cr$ible evid5ce ( mat]ial failure to implem5t or ma9ta9 ! ,indu/ry ,be/ ,practices1 susp5d ! approv$ c]tification ( ! eligible entity p5d+ successful completion ( ! reassessm5t4 7,b7 ,responsibility = co/s associat$ ) assessm5t ,if an assessm5t conduct$ pursuant to subp>agraph 7,a7 det]m9es t ! eligible entity has mat]ially fail$ to implem5t or ma9ta9 ! ,indu/ry ,be/ ,practices1 ! eligible entity %all be responsible = all co/s associat$ ) p]=m+ ! assessm5t4 7#b7 ,gr\nds = reassessm5t ,! gr\nds describ$ 9 ?is p>agraph include-- 7,a7 a sub/antial revision to ,indu/ry ,be/ ,practices2 7,b7 a telecommunications c>ri] or o!r eligible entity exp]i5ces a significant cyb]-incid5t1 z def9$ by ,presid5tial ,policy ,directive-#da 7,july #bf1 #bjaf2 relat+ to ,unit$ ,/ates cyb] incid5t coord9ation72 & 7,c7 ! ,assi/ant ,secret>y receives cr$ible in=mation t-- 7i7 any ( ! cont5ts submitt$ to ! ,assi/ant ,secret>y "u subsection 7b77#a7 to approve a c]tification 7 false or fraudul5t2 or 7ii7 an eligible entity has fail$ to r\t9ely implem5t & ma9ta9 cyb]security practices 9 accordance ) subsection 7e74 7#c7 ,good fai? protection ,a c]tifi$ telecommunications c>ri] or o!r eligible entity %all n h its c]tification "u subsection 7b7 revok$ solely due to an e>ly reassessm5t "u ?is subsection1 unless & until ! e>ly reassessm5t produces a f9al det]m9ation t ! eligible entity-- 7,a7 mat]ially fail$ to implem5t or ma9ta9 ! ,indu/ry ,be/ ,practices ! entity elect$ to adopt ?r\gh ! c]tification process2 or 7,b7 has engag$ 9 gross neglig5ce or willful misconduct4 #f4 ,report+ requirem5ts 7a7 ,annual report ,n lat] ?an #a ye> aft] ! publication ( any ,indu/ry ,be/ ,practices develop$ "u section #d1 & annually !reaft]1 ! ,assi/ant ,secret>y1 9 consultation ) ! ,work+ ,gr\p1 %all submit to ! relevant congressional committees & publi% a public v]sion on ! website ( ,,ntia a report t includes-- 7#a7 an ov]view ( ! developm5t ( ,indu/ry ,be/ ,practices1 & any updates or modifications ( ,indu/ry ,be/ ,practices2 7#b7 data on p>ticipation ( eligible entities 9 ! c]tification process2 7#c7 a summ>y ( e>ly reassessm5t activity1 if any2 7#d7 an assessm5t ( ! adoption ( ,indu/ry ,be/ ,practices2 & 7#e7 ! effectiv5ess ( ,indu/ry ,be/ ,practices & c]tification 9 enhanc+ cyb]security across ! telecommunications sector4 7b7 ,ev5t-,trigg]$ report ,n lat] ?an #ij days aft] a sub/antial revision to ,indu/ry ,be/ ,practices or a significant cyb]-incid5t1 z def9$ 9 ,presid5tial ,policy ,directive-#da 7,july #bf1 #bjaf2 relat+ to ,unit$ ,/ates cyb] incid5t coord9ation71 affect+ ! telecommunications sector1 ! ,assi/ant ,secret>y1 9 consultation ) ! ,work+ ,gr\p1 %all submit to ,congress a report t includes1 to ! greate/ ext5t practicable1 ! cons5sus views & recomm5dations ( ! ,work+ ,gr\p to improve cyb]security across ! telecommunications sector4 #g4 ,rules ( con/ruction ,no?+ 9 ?is ,act %all be con/ru$ to-- 7#a7 grant any regulatory au?ority to any ,f$]al ag5cy2 7#b7 exp& or o!rwise alt] obligations or au?orities "u ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq471 ! ,secure & ,tru/$ ,communications ,networks ,act ( #bjai 7#dg ,u4,s4,c4 #afja et seq471 ! ,secure ,equipm5t ,act ( #bjba 7#dg ,u4,s4,c4 #afja note71 or any o!r ,f$]al law2 7#c7 prohibit ! ,work+ ,gr\p f consult+ ) or ref]5c+ ! "w product ( ,f$]al advisory committees subject to *apt] #aj ( title #e1 ,unit$ ,/ates ,code1 includ+ ! ,presid5t's ,national ,security ,telecommunications ,advisory ,committee1 ,,csric1 & ! ,commission's ,te*nological ,advisory ,c\ncil2 7#d7 require adoption ( ,indu/ry ,be/ ,practices or implem5tation guidance1 or au?orize any regulatory requirem5t ( adoption2 7#e7 displace or replace ! functions ( any ,f$]al advisory c\ncil or in=mation-%>+ agreem5t2 7#f7 grant regulatory au?ority to ! ,commission1 or any o!r ,f$]al body2 or 7#g7 au?orize1 exp&1 or imply any ,f$]al au?ority to sup]vise1 direct1 m&ate1 regulate1 audit1 or o!rwise ov]see ! cyb]security op]ations1 risk-managem5t programs1 te*nical controls1 or network security practices ( any telecommunications c>ri] or o!r eligible entity1 except z expressly p]mitt$ = ! developm5t1 publication1 & volunt>y c]tification ( ,indu/ry ,be/ ,practices "u ?is ,act4 #h4 ,sev]ability ,if any provision ( ?is ,act1 or its application to any p]son or circum/ance1 is held to be uncon/itutional1 ! rema9d] ( ?is ,act1 & ! application ( ! provision to any o!r p]son or circum/ance1 %all n be affect$4