S 808 Introduced - Cybersecurity Disclosure Act of 2021

Last month Sen Reed (D,RI) introduced S 808, the Cybersecurity Disclosure Act of 2021. The bill would require the Securities and Exchange Commission to establish rules requiring the reporting of whether there was cybersecurity expertise on the board of directors or other governing body of each company required to file annual reports. The bill is nearly identical to S 592 that was introduced last session. No action was taken on the earlier bill.

Moving Forward

Reed is a member of the Senate Banking, Housing, and Urban Affairs Committee to which this bill was assigned for consideration as are three of his cosponsors {Cortez-Masto (D,NV), Cramer (R,ND), and Warner (D,VA)}. This means that there should be enough influence to see the bill considered in Committee. I would expect there to be some resistance to this bill from business supporters in the Republican conference. With the increasing concern, however, in Congress about cybersecurity issues, there should be somewhat reduced opposition to this bill. That means that the bill could pass in Committee with some bipartisan support.

This bill will not make it directly to the floor of the Senate. The bill is not important enough to take the time required for the normal debate and amendment process. That would leave just the unanimous consent process as the means for this bill to make it to the floor; there will be at least one Republican Senator that would object to the consideration of the bill. The bill could make it to the floor as an amendment to a must pass spending or authorization bill.

Commentary

I would like to reiterate a point I made in my discussion of S 592 back in 2019, is this realistic? Does every corporation in the United States (no matter the size) need to have a cybersecurity expert on their Board? According to Scott A Hodge, at the TaxFoundation.org, in 2014 there were 1.7 million C corporations and 7.4 million partnerships and S Corporations in the United States. Where are all of the cybersecurity experts going to come from?

HR 1731 Introduced – Cybersecurity Reporting

Last month Rep. Hines (D,CT) introduced HR 1731, Cybersecurity Disclosure Act of 2019. The bill would require the Securities and Exchange Commission to establish rules requiring the reporting of whether there was cybersecurity expertise on the board of directors or other governing body of each company required to file annual reports. This is a companion bill to S 592.

Hines and both of his two cosponsors {Rep. Heck (D,WA) and Rep. Meeks (D,NY)} are members of the House Financial Services Committee to which this bill was assigned for consideration. This means that the bill can probably be expected to receive consideration. I see nothing in the bill that would cause any serious opposition; it would probably receive bipartisan support.

Hines introduced a similar bill last session (HR 6638) that died without action. Part of the reason was it’s relatively late introduction in the session, but it was also unlikely to receive active support from the more business friendly Republican leadership of the Committee. When (if) this bill is considered in Committee, the vote will provide a better view of how much bipartisan support the bill would actually receive on the floor. The bill is only likely to get House action if it can draw the super-majority support necessary for passage under the suspension of the rules process.

S 592 Introduced – Cybersecurity Reporting

Last month Sen. Reed (D,RI) introduced S 592, the Cybersecurity Disclosure Act of 2019. The bill would require the Securities and Exchange Commission to establish rules requiring the reporting of whether there was cybersecurity expertise on the board of directors or other governing body of each company required to file annual reports. The bill is very similar to HR 6638 that was introduced last summer in the 115^th Congress. No action was taken on that earlier bill. It looks like Rep. Himes reintroduced that bill in the House earlier this week but it will be a week or two until the bill is printed.

Differences Between Bills

The main difference between S 592 and the earlier House bill is that this bill amends the Securities Exchange Act of 1934 by adding a new §14C which would become 15 USC 78n-3 if the bill becomes law. The earlier bill made essentially the same requirements as a stand alone measure.

The new bill also takes a little bit of puffery out of the final paragraph of the bill. The change is shown below:

“(c) CYBERSECURITY EXPERTISE OR EXPERIENCE.— For purposes of subsection (b), the Commission, in consultation with NIST, shall define what constitutes expertise or experience in cybersecurity, such as professional qualifications to administer information security program functions or experience detecting, preventing, mitigating, or addressing cybersecurity threats, using commonly defined roles, specialities, knowledge, skills, and abilities, such as those provided in NIST Special Publication 800–181 entitled ‘‘NICE Cybersecurity Workforce Framework’’, or any successor thereto.”

Interestingly, this language deletion removes the final faint traces for the need for the definition of the term ‘information system’ that remains in the bill. The control system friendly definition of ‘information system’ was used to support the use of that term in the definition of ‘cybersecurity threat’ that was only used in the phrase deleted above. Both definitions remain in the new bill.

Moving Forward

Reed is a member of the Senate Banking, Housing and Urban Affairs Committee to which this bill was assigned for consideration. Additionally, his cosponsors include Sen. Warner (D,VA), the Ranking Member of the Security, Insurance, and Investment Subcommittee and two Republican members of the Committee. This means that it is very likely that the bill will be considered in Committee.

There is nothing in the bill that would seem to draw any obvious opposition, so it should pass in Committee. Whether or not it will make it to the floor for consideration is very difficult to determine. This bill would normally be considered under the unanimous consent process and a single voice in opposition would prevent it from being considered under that process. And the voice could be raised in ire over something the SEC had done and have nothing to do with this bill.

Commentary

This is all and good to call for cybersecurity experience on corporate boards, but there are not that many people that would fit the probable description to go around to all of the corporate boards in the country.

The bigger question would be is it really necessary? While it would be hard to find a corporation that did not have at least some level of cybersecurity exposure, do all of them have enough that require board level oversight? With the relative scarcity of board-level qualified cybersecurity experts available, there should probably be mandatory cybersecurity representation on some specific subset of corporations, either size limits or in specific sectors (banking, insurance, energy sector, etc). Of course, that bill would be much harder to write.

Bills Introduced – 03-01-19

Yesterday with the House and Senate preparing to leave for the weekend there were 135 bills introduced. Four of these bills may be receiving future attention in this blog:

HR 1420 To amend the Energy Independence and Security Act of 2007 to promote energy efficiency via information and computing technologies, and for other purposes. Rep. Eshoo, Anna G. [D-CA-18]

HR 1437 To amend the Homeland Security Act of 2002 to require the Under Secretary for Management of the Department of Homeland Security to achieve security of sensitive assets among the components of the Department of Homeland Security, and for other purposes. Rep. Correa, J. Luis [D-CA-46]

S 592 A bill to amend the Securities and Exchange Act of 1934 to promote transparency in the oversight of cybersecurity risks at publicly traded companies. Sen. Reed, Jack [D-RI]

S 602 A bill to address state-sponsored cyber activities against the United States, and for other purposes. Sen. Gardner, Cory [R-CO] 

All of these cybersecurity bills will be watched to see if they contain specific language addressing industrial control systems. Okay, two of these bills may not actually be cybersecurity related (HR 1420 and HR 1437), so I will be watching to see if they actually address cybersecurity issues.

Bills Introduced – 03-09-17

With both the House and Senate in session, there were 78 bills introduced yesterday. Of those, three may be of specific interest to readers of this blog:

HR 1465 To authorize the Secretary of Homeland Security to work with cybersecurity consortia for training, and for other purposes. Rep. Castro, Joaquin [D-TX-20]

S 592 A bill to amend title 10, United States Code, to support meeting the increasing needs of the United States for a cybersecurity and information assurance workforce by reinvigorating and modifying the Information Assurance Scholarship Program of the Department of Defense, and for other purposes. Sen. Kaine, Tim [D-VA]

S 594 National Cybersecurity Preparedness Consortium Act of 2017. Sen. Cornyn, John [R-TX]

HR 1465 and S 594 are almost certainly companion bills. I suspect that they will be very similar to HR 4743 and S 3295 that were introduced in the 114^th Congress. HR 4743 passed with a strongly bipartisan vote in the House, but neither bill was taken up in the Senate.

On S 592 it will be interesting to see if there is specific mention of control system security and to see if there are funds authorized for the program.