Review – Bills Introduced – 12-11-25

Yesterday, with both the House and Senate in Washington, there were 128 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 6630 To direct the Department of Defense to carry out an initiative to understand and address occupational resiliency challenges of the Cyber Mission Force. Elfreth, Sarah [Rep.-D-MD-3]

HR 6631 To require the Secretary of Defense to establish a program for the development of cybersecurity education at academic institutions, and for other purposes. Elfreth, Sarah [Rep.-D-MD-3]

Space Geek Legislation

I would like to mention one bill under my limited Space Geek coverage in this blog:

HR 6638 To require a report on merits and options for establishing an institute relating to space resources, and for other purposes. Foushee, Valerie P. [Rep.-D-NC-4]

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-12-11-25 - subscription required.

S 592 Introduced – Cybersecurity Reporting

Last month Sen. Reed (D,RI) introduced S 592, the Cybersecurity Disclosure Act of 2019. The bill would require the Securities and Exchange Commission to establish rules requiring the reporting of whether there was cybersecurity expertise on the board of directors or other governing body of each company required to file annual reports. The bill is very similar to HR 6638 that was introduced last summer in the 115^th Congress. No action was taken on that earlier bill. It looks like Rep. Himes reintroduced that bill in the House earlier this week but it will be a week or two until the bill is printed.

Differences Between Bills

The main difference between S 592 and the earlier House bill is that this bill amends the Securities Exchange Act of 1934 by adding a new §14C which would become 15 USC 78n-3 if the bill becomes law. The earlier bill made essentially the same requirements as a stand alone measure.

The new bill also takes a little bit of puffery out of the final paragraph of the bill. The change is shown below:

“(c) CYBERSECURITY EXPERTISE OR EXPERIENCE.— For purposes of subsection (b), the Commission, in consultation with NIST, shall define what constitutes expertise or experience in cybersecurity, such as professional qualifications to administer information security program functions or experience detecting, preventing, mitigating, or addressing cybersecurity threats, using commonly defined roles, specialities, knowledge, skills, and abilities, such as those provided in NIST Special Publication 800–181 entitled ‘‘NICE Cybersecurity Workforce Framework’’, or any successor thereto.”

Interestingly, this language deletion removes the final faint traces for the need for the definition of the term ‘information system’ that remains in the bill. The control system friendly definition of ‘information system’ was used to support the use of that term in the definition of ‘cybersecurity threat’ that was only used in the phrase deleted above. Both definitions remain in the new bill.

Moving Forward

Reed is a member of the Senate Banking, Housing and Urban Affairs Committee to which this bill was assigned for consideration. Additionally, his cosponsors include Sen. Warner (D,VA), the Ranking Member of the Security, Insurance, and Investment Subcommittee and two Republican members of the Committee. This means that it is very likely that the bill will be considered in Committee.

There is nothing in the bill that would seem to draw any obvious opposition, so it should pass in Committee. Whether or not it will make it to the floor for consideration is very difficult to determine. This bill would normally be considered under the unanimous consent process and a single voice in opposition would prevent it from being considered under that process. And the voice could be raised in ire over something the SEC had done and have nothing to do with this bill.

Commentary

This is all and good to call for cybersecurity experience on corporate boards, but there are not that many people that would fit the probable description to go around to all of the corporate boards in the country.

The bigger question would be is it really necessary? While it would be hard to find a corporation that did not have at least some level of cybersecurity exposure, do all of them have enough that require board level oversight? With the relative scarcity of board-level qualified cybersecurity experts available, there should probably be mandatory cybersecurity representation on some specific subset of corporations, either size limits or in specific sectors (banking, insurance, energy sector, etc). Of course, that bill would be much harder to write.

HR 6638 Introduced – Cybersecurity Governance

Back in July Rep. Himes (D,CT) introduced HR 6638, the Cybersecurity Disclosure Act of 2018. The bill directs the Security and Exchange Commission to require reporting companies to include in annual reports a listing of senior personnel with expertise or experience in cybersecurity.

The bill gives the gives the Commission 360 days to issue final rules requiring reporting companies “disclose whether any member of the governing body, such as the board of directors or general partner, of the reporting company has expertise or experience in cybersecurity and in such detail as necessary to fully describe the nature of the expertise or experience” {2(b)(1)}.

Moving Forward

Himes and his two Democratic cosponsors {Rep. Meeks (D,NY) and Rep. Heck (D,WA)} are members of the House Financial Affairs Committee two which this bill was assigned for consideration. Normally, this could provide them with sufficient influence to have the bill considered in Committee. This late in the session, however, such consideration is unlikely.

Business interests with no cybersecurity representation (probably a large majority of middle size and smaller businesses) would be expected to oppose such reporting requirements. Since this is a major Republican constituency, I expect that there will be little or no support from Republicans on this bill.

Commentary

There is something odd about the way this bill was written. It includes a list of definitions in §2(a), two of which are never used in the bill. Those two definitions are the only reason that I am discussing the bill. The two terms? “Cybersecurity Threat” and “Information System”.

The first term is defined in two parts. The first {§2(a)(2)(A)}:

An action, not protected by the First Amendment to the Constitution of the United States, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.”

The second part of the definition is the now obligatory {§2(a)(2)(B)}:

Does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement.

Nothing new or interesting here; it is a now standard IT-centric cybersecurity definition. The next term would normally also fall within that description, but the crafters of this bill included an addendum to one of the standard ‘information system’ definitions {§2(a)(3)(B)}:

Includes industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers.

We have seen both of these in other pieces of legislation, but the odd thing here is that neither definition has anything to do with the requirements of the bill. The definition of the key term in the bill; ‘expertise or experience in cybersecurity’ is left for the Commission to define; in consultation with NIST.

The best that I can figure is that Hines is using these two definitions to establish congressional intent that cybersecurity (for the purposes of this particular Commission regulation) includes control system security. Whether or not this would encourage reporting companies to include people with an ICS background in their governing bodies remains to be seen, but it might (should?) encourage the SEC to allow for such eventuality in their definition of ‘expertise or experience in cybersecurity’.

Bills Introduced – 07-27-18

With just the House meeting in pro forma session yesterday there were four bills introduced. Of those, one may be of specific interest to readers of this blog:

HR 6638 To promote transparency in the oversight of cybersecurity risks at publicly traded companies. Rep. Himes, James A. [D-CT-4]

I will be watching this bill to see if it includes language that specifically addresses reporting of control system security issues; it probably will not.