House Passes HR 1766 – NTIA Cybersecurity Office

This afternoon the House took up HR 1766, the NTIA Policy and Cybersecurity Coordination Act, under the suspension of the rules process. After five minutes of debate the House passed the bill by a voice vote.

The bill would transform the current NTIA Office of Policy Analysis and Development (OPAD) into the Office of Policy and Cybersecurity Coordination.

The bill now moves to the Senate where its future is uncertain at best. While there should also be bipartisan support in that body, the bill is not politically important enough to be considered under regular order, a time-consuming process at best. This leaves two paths to passage in the Senate; considering under the unanimous consent process (but that process is fraught with potential opposition due to political issues unrelated to this bill) or adding the language of the bill to another bill that would be important enough to take up under regular order.

Additional NEPA Implementation Rules Sent to OMB – 6-10-25

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced (EO Review Search Criteria: Agencies=All;   Review Status=Pending Review;   Received from 06/09/2025) that it had received six additional National Environmental Policy Act (NEPA) implementation rules from agencies in the Department of Commerce and Department of Energy. This is in addition to the rules that I reported yesterday.

Yesterday’s rulemakings include:

• National Oceanic and Atmospheric Administration - NOAA NEPA Procedures,

• National Telecommunications and Information Administration - FirstNet Authority NEPA Procedures,

• National Telecommunications and Information Administration - NTIA NEPA Procedures,

• Economic Development Administration - EDA NEPA Procedures,

• National Institute of Standards and Technology - NIST NEPA Procedures, and

• DOE Office of the General Counsel - National Environmental Policy Act Implementing Procedures

One major difference from yesterday’s report, none of these rulemakings were listed in the Fall 2024 Unified Agenda, making these uniquely Trumpian NEPA rules. While you might be able to question Trumps commitment to environmental quality, there is no doubt that his Administration is ‘taking action’ to a whole new level. This is almost certainly attributable to the actions of Russel Voight, Director of the Office of Management and Budget and the primary author of Project 2025.

Again, I will probably not be covering any of these rulemakings in detail when published, but I do intend to mark that publication with notices in the appropriate Short Takes post.

HR 2482 Reported in House – NTIA Reauthorization

Earlier this month the House Energy and Commerce Committee took up HR 2482, the NTIA Reauthorization Act of 2025, in a business meeting that considered 26 bills. They adopted the bill without amendment. The Committee’s report (H Rept 119-63) was published (the GPO does not yet have a copy printed) on Friday along with the reported version of the bill. HR 2482 is scheduled to be considered by the full House on Monday under the suspension of the rules process.

This bill is the latest attempt to reauthorization process for the National Telecommunications and Information Administration (NTIA). The bill would authorize $57 million in spending (down from $62 million in last year’s bill) for NTIA for FY 2025 and FY 2026. There are no cybersecurity provisions included in this year's version of the bill.

HR 2482 Introduced – NTIA Reauthorization

Last month Rep Latta (R,OH) introduced HR 2482, the NTIA Reauthorization Act of 2025. This bill is the latest attempt to reauthorization process for the National Telecommunications and Information Administration (NTIA). The bill would authorize $57 million in spending (down from $62 million in last year’s bill) for NTIA for FY 2025 and FY 2026. The House Energy and Commerce Committee considered the bill in a business meeting (along with 23 other bills) and approved the bill by a voice vote without amendments.

Last session Latta also introduced an NTIA reauthorization bill, HR 4510. That bill was considered in a business meeting of the House Energy and Commerce Committee and adopted the bill by a vote of 48 to 0. The Committee Report was published on October 25^th, 2023. The full House took up HR 4510 on May 14^th, 2024 and passed the legislation by a vote of 374 to 36. No action was taken on this legislation in Senate the 118^th Congress.

HR 2482 is very different from last session’s bill. Whole titles are missing, and titles that are included are missing a substantial number of sections. Of importance here, Title IV that would have established within NTIA an Office of Policy Development and Cybersecurity has not been included in this bill. This means that there are no cybersecurity provisions within the current legislation.

Review – HR 1495 Introduced – Digital Economy Board

Back in February Rep Pfluger (R,TX) introduced HR 1495, the Digital Economy Cybersecurity Advisory Act of 2025. The bill would formally authorize the DOC’s current Digital Economy Board of Advisors and expand the coverage of the Board to cover cybersecurity activities. It would amend the National Telecommunications and Information Administration Organization Act, by adding a new §106, Digital Economy and Cybersecurity Board of Advisors. No funding is authorized by this legislation.

The bill is essentially identical to HR 4512, the Digital Economy Cybersecurity Advisory Act of 2023, that was introduced by Pfluger in July 2023. No action was taken on that bill in the 118^th Congress.

Moving Forward

Pfluger is a member of the House Energy and Commerce Committee to which this bill was assigned for consideration. This means that there should be sufficient influence to see this bill considered in Committee. I see nothing in this bill that would engender any organized opposition. I suspect that there will be some level of bipartisan support for this bill. I do not know if there would be sufficient support to see the bill considered under the House’s suspension of the rules process.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-1495-introduced - subscription required.

Review - NTIA Publishes Data Center Growth, Resilience, and Security RFI

Today the DOC’s National Telecommunications and Information Administration (NTIA) published a request for information (RFI) notice in the Federal Register (89 FR 71890-71893) on “Request for Comments on Bolstering Data Center Growth, Resilience, and Security”.  The Summary notes that:

“The National Telecommunications and Information Administration (NTIA) hereby requests comments on the challenges surrounding data center growth, resilience and security in the United States amidst a surge of computing power demand due to the development of critical and emerging technologies. This request focuses on identifying opportunities for the U.S. government to improve data centers' market development, supply chain resilience, and data security. NTIA will rely on these comments, along with other public engagements on this topic, to draft and issue a public report capturing economic and security policy considerations and policy recommendations for fostering safe, secure, and sustainable data center growth.”

Public Comments

NTIA is soliciting public comments on these questions. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # NTIA-2024-0002). Comments should be submitted by November 4^th, 2024.

 

For more information on this RFI, including a list of supply chain security and cybersecurity related questions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ntia-publishes-data-center-growth - subscription required.

 

HR 4510 Reported in House – NTIA Reauthorization

Last month, the House Energy and Commerce Committee published their Report on HR 4510, the NTIA Reauthorization Act of 2023. The Committee held conducted a markup of the bill during their July 2023 Business meeting. Substitute language was adopted and the Committee approved the amended bill by a strongly bipartisan vote of 48 to 0. The bill would upgrade the importance of NTIA’s position within the Department of Commerce.

The revised language included a minor change to the proposed §110 for the NTIA Organization Act that I briefly discussed [removed from paywall] earlier.

The bipartisan vote and the lack of an ‘Opposing Views’ section in the Report confirm my earlier assertion that the bill would have strong bipartisan support. This means that the bill will likely move to the floor of the House under the Suspension of the Rules process with limited debate, no floor amendments, and would require a supermajority to pass. This consideration could come at any time.

Committee Hearings – Week of 12-3-23

As Congress heads into its last two scheduled weeks in Washington for 2023 without a funding shutdown immediately hanging over its head, we see a relatively light committee hearing schedule. There are two hearings of tangential interest here, one oversight hiring and a military cyber hearing.

NTIA Oversight

On Tuesday, the Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold a hearing on “Oversight of the National Telecommunications and Information Administration”. No witness list is currently available, but I expect that DOC Assistant Secretary Lawrence E. Strickling who heads the NTIA will be the principal (probably sole) witness.

Internet cybersecurity is a major focus of the NTIA. According to their ‘Cybersecurity’ page the agencies work in this area has included:

• Software component transparency -- creating guidance for the use of a “Software Bill of Materials,” which functions as a list of ingredients that make up software components

• Internet of Things security  – addressing key aspects of IoT security, including upgradability and patchability of connected devices

• Cybersecurity vulnerability disclosures – increasing collaboration between security researchers and software and system developers and owners

Military Cyber Innovation

On Wednesday, the Cyber, Information Technologies, and Innovation (CITI) Subcommittee of the House Armed Services Committee will hold a hearing “on using military advancements of the past to guide the Department of Defense’s technological advancements in the future.” (Catchy ‘Back to the Future’ title). No witness list is currently available, other than noting that it will consist of ‘outside experts’.

On the Floor

Nothing of particular interest on the schedule for the House this week. What is missing is the consideration of the Senate version of HR 4366. The Senate passed their version of this spending bill back on November 1^st, and officially notified the House of the result on November 6^th (had to get the revised bill printed). The Senate expanded the Military Construction spending bill passed by the House by adding their version of the ARD and THUD spending bills to make HR 4366 the Consolidated Appropriations Act, 2024.

Typically, the Senate substantially amends spending bills, sending the bill back to the House (so far, so good). The House then takes up the bill under a closed rule and rejects the Senate amendment. The Senate then formally insists on their version and the two houses of Congress form a conference Committee to work out a compromise version of the bill that both Houses could accept.

The three-vote Republican majority in the House makes this a potential problem this year. If the Senate version of the bill is considered under a rule, then a simple majority would be required to accept the moderate Senate language. The Republican fringe that still has an effective veto in the House Rules Committee, cannot risk having a handful of Republican moderates joining a united Democratic caucus in passing the Senate language. They have backed themselves into a political corner and have no real way to get out.

S 1526 Introduced – NTIA Cybersecurity

Last month, Sen Hickenlooper (D,CO) introduced S 1526, the NTIA Policy and Cybersecurity Coordination Act. The bill would transform the current NTIA Office of Policy Analysis and Development (OPAD) into the Office of Policy and Cybersecurity Coordination. No new funding is authorized by this legislation.

This bill is very nearly identical to HR 1345 that was introduced in March by Rep Curtis (R,UT). Two minor wording changes are the only differences. Neither change would materially change the provisions of the bill. The two differences are:

• On Page 2, line 22, the Senate bill changes ‘the Associate Administrator shall’ to read ‘the Office shall’

• On page 6, line 18, the Senate bill changes ‘date of the enactment’ to read ‘date of enactment’.

Moving Forward

Hickenlooper is a member (Subcommittee Chair), as is his sole cosponsor {Sen Capito (R,WV)} of the Senate Commerce, Science, and Technology Subcommittee to which this bill was assigned. This means that there should be sufficient influence to see this bill considered in Committee. I do not see anything in the language of the bill that would engender any organized opposition. I suspect that there would be some level of bipartisan support for this bill going forward. As with most legislation in the Senate, the question ultimately becomes is the bill important enough to take up the limited time in the Senate for consideration under regular order; I do not think so in this case. I will have to see how the Committee votes on this bill before I can make a reasonable attempt at predicting the chances for consideration under the unanimous consent process.

Committee Hearings – Week of 5-21-23

This week, with just the House in Washington, there is a full slate of hearings scheduled. In this space, an oversight hearing on the NTIA and a markup of the DHS spending bill are of potential interest.

NTIA Oversight

On Tuesday, the Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold a hearing on “Oversight and Reauthorization of the National Telecommunications and Information Administration”. No witness list is currently available, but it will almost certainly include the NTIA Director. The hearing notice lists 18 pieces of legislation (only two of which have been introduced to date) upon which the hearing will focus. Legislation of potential interest here (links to committee drafts) are:

HR___, the National Telecommunication and Information Administration Reauthorization Act

of 2023,

H Res___, To express the sense of Congress with respect to WHOIS information accessibility, and for other purposes,

HR___, the Digital Economy Cybersecurity Advisory Act of 2023, and

HR___, the Artificial Intelligence Accountability Act.

DHS Spending Bill

On Wednesday, the House Appropriations Committee will hold a markup hearing on “Fiscal Year 2024 Homeland Security and Agriculture, Rural Development, Food and Drug Administration, and Related Agencies Bills”. No word is publicly available on what changes may have been made last week by the DHS Subcommittee to the Committee Draft.

On the Floor

The House has a fairly lite schedule this week, with nothing of particular note here. Interesting that there is not a note on the bottom of the schedule about a potential vote on a budget ceiling bill. With a June 1^st deadline for action, the House would need to complete action this week since they are not scheduled to be in Washington next week.

HR 1345 Introduced – NTIA Cybersecurity Office

Earlier this month, Rep Curtis (R,UT) introduced HR 1345, the NTIA Policy and Cybersecurity Coordination Act. The bill would amend the NTIA Organization Act, adding a new §106, Office of Policy Development and Cybersecurity. The current Associate Administrator for Policy Analysis and Development at the NTIA would be redesignated as the position of Associate Administrator for Policy Development and Cybersecurity. The new organization would be responsible for overseeing and conducting “national communications and information policy analysis and development for the internet and communications technologies.”

While NTIA is generally considered to be have more of an IT focus on communication technology, it is clear that communications technology is as much about control of systems as it is about the information that transits those systems. This is reflected in the duties for the proposed new Associate Administrator which includes the following more operationally-focused cybersecurity responsibilities:

Advocate for policies that promote the security and resilience to cybersecurity incidents of communications networks while fostering innovation, including policies that promote secure communications network supply chains,

Present security of the digital economy and infrastructure and cybersecurity policy efforts before the Commission, Congress, and elsewhere,

Develop policies to accelerate innovation and commercialization with respect to advances in technological understanding of communications technologies, and

Provide public access to relevant data, research, and technical assistance on innovation and commercialization with respect to communications technologies, consistent with the protection of classified information.

Moving Forward

Curtis is a member of the House Energy and Commerce Committee to which this bill was assigned for consideration. This means that there should be enough influence to see the bill considered in Committee. I do not see anything in the language of the bill that would engender any organized opposition. I suspect that there would be some level of bipartisan support for this bill going forward. It will be interesting to see how this bill fairs in the current anti-government focus of the Republican majority in the House.

Review - S 2979 Introduced - NTIA Policy and Cybersecurity Coordination

Earlier this month, Sen Hickenlooper (D,CO) introduced S 2979, the NTIA Policy and Cybersecurity Coordination Act. The bill would amend 47 USC Chapter 8, National Telecommunications and Information Administration, adding a new §106, Office of Policy Development and Cybersecurity. The bill includes some specific cybersecurity support requirements for NTIA. The bill does not authorize any additional funds for NTIA.

Both Hickenlooper and his sole cosponsor {Sen Capito (R,WV)} are members of the Senate Commerce, Science, and Transportation to which this bill was assigned for consideration. This means that there should be sufficient influence to see the bill considered in Committee. I see nothing in the bill that would engender any specific opposition. I suspect that the Committee would approve the bill with significant bipartisan support. This bill is unlikely to make to the floor of the Senate as a stand alone bill, but it could be added to a spending or authorization bill as an amendment.

For more details on the cybersecurity taskings for the new Office, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2979-introduced - subscription required.

Review - HR 4046 Introduced - NTIA Policy and Cybersecurity Coordination

Last month, Rep Duncan (R,SC) introduced HR 4046, the NTIA Policy and Cybersecurity Coordination Act. The bill would establish within the National Telecommunications and Information Administration (NTIA) the Office of Policy Development and Cybersecurity. The current Associate Administrator for Policy Analysis and Development would become the first Associate Administrator for Policy Development and Cybersecurity, heading the new Office.

Duncan and one of his two cosponsor {Rep Curtis (R,UT)} are members of the House Energy and Commerce Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see the bill considered in Committee. I do not see anything here that would engender any specific opposition, since this would essentially acknowledge and codify actions that are being undertaken at NTIA in any case. I suspect that the bill would receive significant bipartisan support and could be moved to the floor of the House using the suspension of the rules process; limited debate, no floor amendments and a super majority to pass.

I was surprised not to see the language in this bill as a proposed amendment to HR 4046, the FY 2022 CJS spending bill, on the House Rules Committee site. That Committee will be formulating the rule for the consideration of the spending bill on Tuesday. Since NTIA is a component of the Commerce Department, this would have been an ideal place to move this bill forward. This may mean that Duncan has not place a high priority on this bill.

For more details about the duties of this new Office, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-4046-introduced - subscription required.

Review - NTIA Releases Minimum Elements for SBOM

Yesterday the DOC’s National Telecommunications and Information Administration (NTIA) published their report on the minimum elements for a software bill of materials (SBOM) as required by President Biden’s EO 14028. The report outlines three broadly defined minimum elements, explains how they can currently be implemented and used and points the way forward for expanding the usefulness of SBOM. NTIA had solicited public input on the development of these minimum elements last month, but has been working on the topic with an open work group since 2018.

The announcement lists the three minimum elements as required by EO 14028:

• Data Fields: Documenting baseline information about each component that should be tracked,

• Automation Support: Allowing for scaling across the software ecosystem through automatic generation and machine-readability, and

• Practices and Processes: Defining the operations of SBOM requests, generation and use.

The report goes into more detail about each of the elements.

NTIA acknowledges that these three minimum requirements are just that, MINIMUM. They outline much of the near term works that needs to be done.

For a more detailed look at the report, see my report at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/ntia-releases-minimum-elements-for - subscription required.

Review - EO 14028 – NTIA Publishes SBOM Request for Comments

Today, the DOC’s National Telecommunications and Information Administration (NTIA) published a notice in the Federal Register (86 FR 29568-29571) requesting public comments on “Software Bill of Materials Elements and Considerations”. This action is being taken in support of the requirements of EO 14028 for NTIA to “publish minimum elements for an SBOM” {§4(f)}.

Public comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket #210527-0117). Due to the short response requirements of EO 14028, NTIA is requesting that comments be submitted by June 17^th, 2021.

Commentary

One point that is not discussed here (and admittedly it was not part of the presidential mandate) that needs to be discussed before any SBOM process becomes operational is the information sharing aspect of the SBOM. Let’s face it, and SBOM is going to provide an adversary with a software blueprint that will help guide the development of an attack process. Any discussion of an effective SBOM process is going to have to address how widely the detailed information in an SBOM is shared.

For a more detailed look at the information that NTIA is looking for, see my post at - https://patrickcoyle.substack.com/p/eo-14028-ntia-publishes-sbom-request. Subscription Required

NTIA Publishes SBOM Meeting Notice – 4-29-21

Today the DOC’s National Telecommunications and Information Administration (NTIA) published a meeting notice in the Federal Register (86 FR 17139-17140) for a virtual meeting of a multistakeholder process on promoting software component transparency on April 29, 2021. The agenda and slide deck will be posted on the NTIA Software Transparency web site. Background material can be found on the NTIA Software Bill of Materials (SBOM) web site.

NTIA Software Component Transparency Meeting – 7-9-10

The DOC National Telecommunications and Information Administration (NTIA) published a meeting notice in the Federal Register (85 FR 36837-36838) for the next meeting of the “Multistakeholder Process on Promoting Software Component Transparency”. The virtual meeting will be held on July 9^th, 2020 and will be open to the public.

The purpose of the July meeting is to share progress from the working groups; to give feedback on the ongoing work around technical challenges, tooling, demonstrations, and awareness and adoption; and to continue discussions around potential guidance or playbook documents. The Working Groups include:

• Framing,

• Awareness and adoption,

• Formats & tooling, and

• Healthcare proof of concept

Information on online slide share and dial-in details will be available on the Software Transparency web site.

NTIA to Host Meeting on Software Component Transparency – 4-15-20

Today the Department of Commerce’ National Telecommunications and Information Administration (NTIA) published a meeting notice the Federal Register (85 FR 15435-15436) concerning the “Multistakeholder Process on Promoting Software Component Transparency”. This will be a virtual meeting on April 15^th, 2020 from 10:00 am to 4:00 pm EDT.

NTIA acts as the host for the Multistakeholder process that is looking at the security issues related to the use of third-party components in software development. The process kicked off in July 2018. The “NTIA Software Component Transparency” web site provides a good overview of the multiple meetings that have been held since that date as well as a look at the ongoing activities of the various working groups.

According to today’s notice:

“The main objectives of the April 15, 2020, meeting are to share progress from the working groups; to give feedback on the ongoing work around technical challenges, tooling, demonstrations, and awareness and adoption; and to begin discussions around potential guidance or playbook documents.”

Details on how to participate in the virtual meeting will be published on the Software Component Transparency web site closer to the meeting date. The meeting will be open to the public on a first-com-first-serve basis.

NTIA Software Component Transparency Meeting – 11-18-19

Today the DOC’s National Telecommunications and Information Administration (NTIA) published a meeting notice in the Federal Register (84 FR 56446-56447) for a “Multistakeholder Process on Promoting Software Component Transparency” meeting to be held on November 18^th, 2019 in Washington, DC.

According to the notice:

“The main objectives of the November 18, 2019, meeting are to finalize and identify next steps in this effort, including how progress can be made on extending and refining the basic model, cataloging tooling needs and resources, and promoting awareness and adoption of stakeholder work.”

The Stakeholders and a number of working groups have been conducting meetings on this topic since the first meeting was announced in 2018. The NTIA Software Component Transparency web page contains detailed information and presentations from those meetings.

The meeting will be open to the public on a first-come seating basis. It does not appear that the meeting will be web cast.

Committee Hearings – Week of 06-24-18

With both the House and Senate in session this week it looks to be a busy week for Committee work. We are still seeing spending bills being marked-up and we have three cybersecurity related authorization bills. There will also be a Senate mark-up of the TWIC Reader Delay bill in that body.

Spending Bills

Monday – House Rules Committee – HR 6157 DOD;

Tuesday – House Rules Committee – HR 6157 DOD;

Tuesday – House Committee – LHHS;

Tuesday – Senate Sub-Committee – DOD;

Tuesday – Senate Sub-Committee – LHHS;

Thursday – Senate Committee – DOD;

Thursday – Senate Committee – LHHS

The Senate will finish work on HR 5895, the FY 2019 EWR spending bill Monday evening. The House will take up HR 6157, the FY 2019 DOD spending bill, either late Tuesday or on Wednesday.

Cybersecurity Authorization Bills

The three authorization bills with a cybersecurity nexus are for the National Telecommunications and Information Administration (NTIA), the National Institute of Science and Technology (NIST) and the intelligence community.

On Tuesday the Communications and Technology Subcommittee of the House Energy and Commerce Committee will hold a hearing on their draft of an authorization bill for NTIA. The witness list includes:

• Michael D. Gallagher, Entertainment Software Association;

• John Kneuer, JKC Consulting; and

• Joanne S. Hovis, CTC Technology and Energy

The draft bill includes two ‘Sense of Congress’ sections on cybersecurity threats and supply chain vulnerabilities, and on preservation of domain name system and WHOIS service.

On Wednesday the House Science, Space, and Technology Committee will hold a mark-up hearing for three as of yet unintroduced bills. One of those is the draft of the NIST authorization bill. The draft includes a section on general cybersecurity and a separate section on IoT with cybersecurity language included.

On Thursday the House Intelligence Committee will hold the inevitably closed-hearing on their mark-up of the as of yet unpublished FY 2019 Intelligence Authorization Act. The draft is not publicly available and, of course, the good stuff will be in the classified annex to the bill.

TWIC Reader Rule

On Wednesday the Senate Commerce, Science, and Transportation Committee will hold a mark-up hearing on eight bills, including S 3094. The text of that bill has not yet been published by the GAO, but it sounds like it should be a companion bill to HR 5729, the Transportation Worker Identification Credential Accountability Act of 2018. After having reviewed the Coast Guard NPRM on their proposed selective delay of the implementation of the TWIC Reader Rule, it seems unlikely that the two legislative delay attempts and the CG delay are very closely related to the same issues.

On the Floor

In addition to the two spending bills on the floor this week, we will also see the House take up two bills of potential interest to readers of this blog. Later today the House will consider HR 5081, the Surface Transportation Security and Technology Accountability Act of 2018, and HR 5733, the DHS Industrial Control Systems Capabilities Enhancement Act of 2018. Both bills will be taken up under the suspension of the rules provisions. This means limited debate and no floor amendments. It also means that the leadership expects serious bipartisan support for both bills since a super-majority is required for passage.

The House is also scheduled to take up a motion to go to conference on HR 5515, the FY 2019 DOD authorization bill, that passed in the Senate last week.