Section 1 Short title
This Act may be cited as the “Cyber Shield Act of 2017”.
Cyber Shield Act of 2017
A BILL
To establish a voluntary program to identify and promote Internet-connected products that meet industry-leading cybersecurity and data security standards, guidelines, best practices, methodologies, procedures, and processes.
Sec. 2 Definitions
In this Act—
the term Advisory Committee means the Cyber Shield Advisory Committee established under section 3(a);
the term benchmarks means standards, guidelines, best practices, methodologies, procedures, and processes;
the term covered product means a consumer-facing physical object that can—
connect to the Internet; and
collect, send, or receive data;
the term Cyber Shield program means the voluntary program established under section 4(a)(1); and
the term Secretary means the Secretary of Commerce.
Sec. 3 Cyber Shield Advisory Committee
Establishment— Not later than 90 days after the date of enactment of this Act, the Secretary shall establish a Cyber Shield Advisory Committee.
Duties—
In general— Not later than 1 year after the date of enactment of this Act, the Advisory Committee shall provide recommendations to the Secretary regarding—
the format and content of the Cyber Shield labels required to be established under section 4; and
the process for identifying, establishing, reporting on, adopting, maintaining, and promoting compliance with the voluntary cybersecurity and data security benchmarks required to be established under section 4.
Public availability of recommendations— The Advisory Committee shall publish, and provide the public with an opportunity to comment on, the recommendations provided to the Secretary under paragraph (1).
Members, chairman, and duties—
Appointment—
In general— The Advisory Committee shall be composed of members appointed by the Secretary from among individuals who are specially qualified to serve on the Advisory Committee based on their education, training, or experience.
Representation— Members appointed under subparagraph (A) shall include—
representatives of the covered products industry, including small, medium, and large businesses;
cybersecurity experts;
public interest advocates; and
Federal employees with expertise in certification, covered devices, or cybersecurity, including employees of the Department of Commerce, the Federal Trade Commission, and the Federal Communications Commission.
Limitation— In appointing members under subparagraph (A), the Secretary shall ensure that—
each interest group described in clauses (i) through (iv) of subparagraph (B) is proportionally represented on the Advisory Committee, including—
businesses of each size described in such clause (i);
Federal employees with expertise in each subject described in such clause (iv); and
Federal employees from each agency described in such clause (iv); and
no single interest group is represented by a majority of the members of the Advisory Committee.
Chair— The Secretary shall designate a member of the Advisory Committee to serve as Chair.
Pay— Members of the Advisory Committee shall serve without pay, except that the Secretary may allow a member, while attending meetings of the Advisory Committee or a subcommittee of the Advisory Committee, expenses authorized under section 5703 of title 5, United States Code, relating to per diem, travel, and transportation.
Support staff; administrative services—
Support staff— The Secretary shall provide support staff for the Advisory Committee.
Administrative services— Upon request by the Advisory Committee, the Secretary shall provide any information, administrative services, and supplies that the Secretary considers necessary for the Advisory Committee to carry out its duties and powers.
No termination— Section 14 of the Federal Advisory Committee Act (5 U.S.C. App.) shall not apply to the Advisory Committee.
Sec. 4 Cyber Shield program
Establishment of program—
In general— The Secretary shall establish a voluntary program to identify and certify covered products with superior cybersecurity and data security through voluntary certification and labeling of, and other forms of communication about, covered products and subsets of covered products that meet industry-leading cybersecurity and data security benchmarks to enhance cybersecurity and protect data.
Grades— Labels applied to products under the Cyber Shield program—
may be digital; and
may be in the form of different grades that display the extent to which a product meets the industry-leading cybersecurity and data security benchmarks.
Consultation— Not later than 90 days after the date of enactment of this Act, the Secretary shall establish a process for consulting interested parties, the Secretary of Health and Human Services, the Commissioner of Food and Drugs, the Secretary of Homeland Security, and other Federal agencies in carrying out the Cyber Shield program.
Duties— In carrying out the Cyber Shield program, the Secretary—
shall—
establish and maintain cybersecurity and data security benchmarks, by convening and consulting interested parties and other Federal agencies, for products with the Cyber Shield label to ensure that those products perform better than their less secure counterparts; and
in carrying out subparagraph (A)—
engage in an open public review and comment process;
in consultation with the Advisory Committee, identify and apply cybersecurity and data security benchmarks to different subsets of covered products based on—
cybersecurity and data security risk;
the sensitivity of the information collected, transmitted, or stored by the product; and
product functionality; and
to the extent possible, incorporate existing benchmarks when establishing and maintaining cybersecurity and data security benchmarks;
may not establish benchmarks under paragraph (1) that are—
arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law; or
unsupported by evidence;
shall permit a manufacturer or distributor of a covered product to display a Cyber Shield label reflecting the extent to which the product meets the industry-leading cybersecurity and data security benchmarks established under paragraph (1);
shall promote technologies that are compliant with the cybersecurity and data security benchmarks established by the Secretary as the preferred technologies in the marketplace for—
enhancing cybersecurity; and
protecting data;
shall work to enhance public awareness of the Cyber Shield label, including through public outreach, education, research and development, and other means;
shall preserve the integrity of the Cyber Shield label;
if helpful in fulfilling the obligation under paragraph (6), may elect to not treat a covered product as a Cyber Shield-certified product until the product meets appropriate conformity standards, which may include—
testing by an accredited third-party certifying laboratory or other entity in accordance with the Cyber Shield program; and
certification by the laboratory or entity described in subparagraph (A) as meeting the applicable cybersecurity and data security benchmarks established by the Secretary;
not less frequently than once every 2 years after establishing cybersecurity and data security benchmarks for a product category under paragraph (1), shall review and, if appropriate, update the cybersecurity and data security benchmarks for that product category;
shall solicit comments from interested parties and the Advisory Committee prior to establishing or revising a Cyber Shield product category or benchmark (or prior to the effective date of the establishment or revision of a product category or benchmark);
upon adoption of a new or revised product category or benchmark, shall provide reasonable notice to interested parties of any changes (including effective dates) to product categories or benchmarks, along with—
an explanation of the changes; and
as appropriate, responses to comments submitted by interested parties; and
shall provide appropriate lead time prior to the applicable effective date for a new or a significant revision to a product category or benchmark, taking into account the timing requirements of the manufacturing, product marketing, and distribution process for the product or products addressed.
Deadlines— Not later than 2 years after the date of enactment of this Act, the Secretary shall establish cybersecurity and data security benchmarks for covered products under subsection (c)(1), which shall take effect not later than 60 days after the date on which the benchmarks are established.
Administration— The Secretary, in consultation with the Advisory Committee, may enter into a contract with a third party to administer the Cyber Shield program if—
the third party is an impartial administrator; and
entering into the contract improves the cybersecurity and data security of covered products.
Program evaluation—
In general— Not later than 4 years after the date of enactment of this Act, and not less frequently than every 2 years thereafter, the Inspector General of the Department of Commerce shall evaluate the Cyber Shield program.
Requirements— In conducting an evaluation under paragraph (1), the Inspector General of the Department of Commerce shall—
evaluate the extent to which the cybersecurity and data security benchmarks established under the Cyber Shield program address cybersecurity and data security threats;
assess how the benchmarks have evolved to meet emerging cybersecurity and data security threats;
conduct covert testing to evaluate the integrity of certification testing; and
assess the costs to businesses of participating in the Cyber Shield program.
Sec. 5 Cyber shield digital product portal
In general— The Secretary shall make publicly available on the website of the Department of Commerce in a searchable format—
a web page providing information about the Cyber Shield program; and
a database of covered products certified under the Cyber Shield program.
Requirements— The database established under subsection (a) shall include—
the cybersecurity and data security benchmarks for each product category; and
for each covered product certified under the Cyber Shield program—
the certification for the product;
the name and manufacturer of the product;
the contact information for the manufacturer;
the functionality of the product;
the location of any applicable privacy policy; and
any other information the Secretary determines necessary and appropriate.
Sec. 6 Rule of construction
The decision of a manufacturer of a covered product not to participate in the Cyber Shield program shall not affect the liability of the manufacturer for a cybersecurity or data security breach of that covered product.