Review - Senate Passes S 3600 – Cybersecurity

Yesterday, the Senate took up S 3600, the Strengthening American Cybersecurity Act of 2022, which was introduced last week. The Senate considered the bill under the unanimous consent process. After adopting two amendments, the Senate passed S 3600 without debate or vote. The bill contains FISMA modifications similar to those found in S 2902, cybersecurity incident reporting requirements similar to those found in S 2875, as well as federal cloud security requirements.

Moving Forward

This strongly bipartisan action by the Senate would seem to grease the skids for this to pass quickly through the House and land on the President’s desk. Unfortunately, there are competing versions of portions of this bill in the House and this bill will have to overcome the ‘my bill first’ claims from at least two different House committees, Homeland Security and Science, Space, and technology. The current concerns about the Russian/Ukrainian related cybersecurity threats, may provide sufficient impetus to bring this bill to the floor of the House. If it gets by the two Chairs, this bill could easily be considered under the House suspension of the rules process and it could be on the President’s desk before the end of the month, or it could still be sitting on the Clerk’s desk at the end of the year.

Commentary:

This bill reflects a great deal of behind the scenes bargaining in the Senate. This will probably be the premier cybersecurity legislation for this Congress. My review today was done quickly to get it out and I am going to have to take a very detailed look at the cyber incident reporting requirements of §203. That post will come out later this week.

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/senate-passes-s-3600 - subscription.

Review - S 2902 Introduced – FISMA Update

Last month, Sen Peters (D,MI) introduced S 2902, the Federal Information Security Modernization Act of 2021. This is an update of the FISMA program that was initiated in 2002. While not technically a reauthorization bill, this is part of periodic update process for that program. The actions required in this bill apply to Federal government agencies, not private sector entities.

There are, however, three sections of this bill that may be of interest to private sector cybersecurity managers and cybersecurity researchers:

§204. Data and logging retention for incident response.

§208. Codifying vulnerability disclosure programs.

§303. Security operations center as a service pilot.

This bill will be considered by the Senate Homeland Security and Governmental Affairs Committee later today. The bill, probably after amendment, will be approved by the Committee with substantial bipartisan support. This bill will likely be passed in the Senate.

For more details about the sections identified above, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2902-introduced - subscription required.

 

Bills Introduced – 9-29-21

Yesterday, with both the House and Senate in session, there were 52 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 5412 To authorize appropriations for fiscal year 2022 for intelligence and intelligence-related activities of the United States Government, the Community Management Account, and the Central Intelligence Agency Retirement and Disability System, and for other purposes. Rep. Schiff, Adam B. [D-CA-28]

S 2902 A bill to modernize Federal information security management, and for other purposes. Sen. Peters, Gary [D-MI] 

I will be covering HR 5412.

The title for S 2902 is more vague than normal. If this is a cybersecurity bill, I will be watching for definitions and language that would include control system security within its coverage. If this bill addresses classified or sensitive but unclassified information protection, then I will be watching for language or definitions that would impact programs affecting chemical, transportation, or critical infrastructure information sharing processes.