Bills Introduced – 04-24-18

Yesterday, with both the House and Senate in session, there were 41 bills introduced. Of these, one may be of specific interest to readers of this blog:

S 2735 A bill to amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and protections for small businesses, and for other purposes. Sen. Risch, James E. [R-ID]

I will be watching this bill for the definitions it uses related to cybersecurity. If the bill specifically includes control system security issues in its coverage, then I will continue reporting on the bill. By the title, it looks like this may be a companion bill to HR 4668 which I am no longer following.

Bills Introduced – 04-13-18

On Friday, with just the House in session, there were 23 bills introduced. Of those, three may be of specific interest to readers of this blog:

HR 4 To reauthorize programs of the Federal Aviation Administration, and for other purposes. Rep. Ryan, Paul D. [R-WI-1]

HR 5515 To authorize appropriations for fiscal year 2019 for military activities of the Department of Defense and for military construction, to prescribe military personnel strengths for such fiscal year, and for other purposes. Rep. Thornberry, Mac [R-TX-13]

HR 5517 To improve assistance provided by the Hollings Manufacturing Extension Partnership to small manufacturers in the defense industrial supply chain on matters relating to cybersecurity, and for other purposes. Rep. Panetta, Jimmy [D-CA-20]

The first two are important authorization bills. The FAA bill has already been printed and includes a title on unmanned aircraft systems that will be looked at here. The NDAA will be watched for cybersecurity provisions. Note that it is odd for Speaker Ryan to introduce the FAA authorization bill and even more so for him to use one of his reserved bill numbers.

I will be looking at HR 5517 for control system security issues. The defense industrial base regulation is always a potential forward indicator of possible congressional action on cybersecurity issues.

Bills Introduced – 03-29-17

Yesterday with both the House and Senate in session there were 54 bills introduced. Of those three may be of specific interest to readers of this blog:

S 763 A bill to improve surface and maritime transportation security. Sen. Thune, John [R-SD]

S 768 A bill to improve the productivity and energy efficiency of the manufacturing sector by directing the Secretary of Energy, in coordination with the National Academies and other appropriate Federal agencies, to develop a national smart manufacturing plan and to provide assistance to small- and medium-sized manufacturers in implementing smart manufacturing programs, and for other purposes. Sen. Shaheen, Jeanne [D-NH] 

S 770 A bill to require the Director of the National Institute of Standards and Technology to disseminate resources to help reduce small business cybersecurity risks, and for other purposes. Sen. Schatz, Brian [D-HI]

I suspect that S 763 will be very similar to S 3379 that was introduced in the closing days of the 114^th Congress. As expected it saw no action.

I will only be looking at S 768 if it provides for cybersecurity measures in support of ‘smart manufacturing’; I’m not holding my breath.

With S 770 I will be looking for specific provisions on, or at least coverage of, control system security issues.

S 3024 Introduced – Small Business Cybersecurity Support

Last week Sen. Vitter (R,LA) introduced S 3024, Small Business Cyber Security Improvements Act of 2016. The bill would amend 15 USC 648 to add cybersecurity services to those currently offered by Small Business Development Centers (SBDCs).

SBDC Changes

Section 2 of the bill would add “providing access to external cyber security specialists to counsel, assist, and inform small business concerns”, to the list of possible services provided by SBDCs under §648(c).

Section 3 of the bill would add a provision to §648(a) that would allow DHS to “provide assistance to small business development centers, through the dissemination of cyber security risk information and other homeland security information, to help small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, and cyber training programs for employees”.

Section 4 would require a GAO study of current GAO cybersecurity resources. It would also require the Administrator of the Small Business Administration (SBA) to develop a cybersecurity strategy for the SBDCs.

Moving Forward

Vitter’s bill was reported out of the Senate Small Business and Entrepreneurship Committee last week without amendment or written report. This is not unexpected since Vitter is the Chair of that Committee. It remains to be seen if Vitter can get this bill before the full Senate before the summer recess in the middle of July. Lacking that I do not expect that the bill would be considered by the Senate.

If the bill does make it to the floor, it will probably be considered under the unanimous consent provisions at the end of a day. There is little or nothing that would bring any objections from the floor.

Commentary

The cybersecurity language in this bill is the most neutral language that I have seen, never mentioning either information technology or control system technology or any of their code words. So the bill would theoretically allow the SBDCs to provide control system security support as part of this program. The difference, however, between allowing such support and actually providing such support is quite large. I really would not expect most centers to provide ICS security support.

S 3024 – Small Business Cybersecurity – Markup Hearing

The Senate’s Daily Digest Committee Meetings/Hearings Schedule web page is currently reporting that the Privacy, Technology and the Law Subcommittee of the Senate Judiciary Committee will be holding a markup hearing tomorrow. One of the bills listed is S 3024, a bill introduced yesterday concerning small business cybersecurity. There is nothing about this hearing currently on the Senate Judiciary web site.

NOTE: As of 7:50 pm EDT this hearing is no longer showing on the Senate web site.

Bills Introduced – 06-06-16

With just the Senate back in session (the House returns to town today) there were eleven bills introduced. Of those three may be of specific interest to readers of this blog:

S 3017 An original bill to authorize appropriations for fiscal year 2017 for intelligence and intelligence-related activities of the United States Government, the Community Management Account, and the Central Intelligence Agency Retirement and Disability System, and for other purposes. Sen. Burr, Richard [R-NC]

S 3018 A bill to provide for the establishment of a pilot program to identify security vulnerabilities of certain entities in the energy sector. Sen. King, Angus S., Jr. [I-ME]

S 3024 A bill to improve cyber security for small businesses. Sen. Vitter, David [R-LA]

I’ll be watching the Intel authorization bill for cybersecurity related provisions. The same holds true for the other two bills as well.