Working group on cyber insurance

(a) Establishment Not later than 90 days after the date of enactment of this Act, the Assistant Secretary shall establish a working group on cyber insurance. (b) Composition (1) Membership The working group shall be composed of the following members: (A) Not less than 1 member from each of the following: (i) The Cybersecurity and Infrastructure Security Agency. (ii) The National Institute of Standards and Technology. (iii) The Department of the Treasury. (iv) The Department of Justice. (v) The Federal Trade Commission. (B) Not less than 1 State insurance regulator with expertise regarding cybersecurity and cyber insurance. (2) Chairperson The Assistant Secretary shall be the chairperson of the working group. (c) Activities (1) In general The working group shall carry out the following activities: (A) For the purposes of the activities of the working group, define the term cyber insurance in a manner that is different from the definition of that term under section 2(5), if the working group determines that such a modified definition is necessary. (B) Analyze and explain in a manner understandable to customers the technical and legal terminology commonly used in policies. (C) Analyze and explain in a manner understandable to customers how provisions in policies correspond to common types of cyber incidents, including those involving ransomware. (D) Analyze and explain in a manner understandable to customers how provisions in policies correspond to common customer responses to cyber incidents, including with respect to system recovery and potential ransom payments. (E) Analyze and explain in a manner understandable to customers the terminology used in policies to include or exclude coverage for losses due to cyber incidents. (F) Analyze and explain in a manner understandable to customers the constraints faced by issuers in covering higher amounts of losses and cyber risk areas, such as reputational damage and the loss of intellectual property. (G) Develop information for customers on ways to effectively evaluate the types and levels of coverage offered under a policy. (H) Develop information for issuers, agents, and brokers regarding how to provide and communicate policy provisions that are clear and easy to understand for customers. (I) Gather input from issuers on what measures could improve the ability of those issuers to offer additional coverage under policies, including— (i) improvements to their actuarial data and cyber risk data; (ii) the development of effective information sharing mechanisms; and (iii) accurate measurement of the cybersecurity practices of customers. (J) Identify what measures could reduce the cost of policies and reduce the amount of cyber risk and the number of cyber incidents. (K) Develop recommendations for customers on how best to use cyber insurance and the benefits of doing so. (2) Consultation In carrying out the activities of the working group under paragraph (1), the working group shall consult with the public in an open and transparent manner, including by consulting with the following stakeholders: (A) Issuers. (B) Insurance agents and brokers with experience in the sale and distribution of cyber insurance. (C) Representatives of business customers from multiple sectors and representatives of small businesses. (D) Academia. (E) State insurance regulators with expertise regarding cybersecurity and cyber insurance. (F) Owners and operators of critical infrastructure. (G) Other individuals or entities with cybersecurity and cyber insurance expertise as the Assistant Secretary considers appropriate. (d) Report Not later than 1 year after the date on which the working group first convenes, the working group shall submit to Congress a report regarding the activities of the working group under subsection (c) and any recommendations of the working group. (e) Termination The working group shall terminate upon submission of the report required under subsection (d). (f) Rule of construction Nothing in this section shall be construed to— (1) require adoption of the recommendations of the working group; or (2) provide any authority to any member of the working group or any other individual to regulate the business of insurance that is not already provided under any other provision of law.

(a) Establishment Not later than 90 days after the date of enactment of this Act, the Assistant Secretary shall establish a working group on cyber insurance. (b) Composition (1) Membership The working group shall be composed of the following members: (A) Not less than 1 member from each of the following: (i) The Cybersecurity and Infrastructure Security Agency. (ii) The National Institute of Standards and Technology. (iii) The Department of the Treasury. (iv) The Department of Justice. (v) The Federal Trade Commission. (B) Not less than 1 State insurance regulator with expertise regarding cybersecurity and cyber insurance. (2) Chairperson The Assistant Secretary shall be the chairperson of the working group. (c) Activities (1) In general The working group shall carry out the following activities: (A) For the purposes of the activities of the working group, define the term cyber insurance in a manner that is different from the definition of that term under section 2(5), if the working group determines that such a modified definition is necessary. (B) Analyze and explain in a manner understandable to customers the technical and legal terminology commonly used in policies. (C) Analyze and explain in a manner understandable to customers how provisions in policies correspond to common types of cyber incidents, including those involving ransomware. (D) Analyze and explain in a manner understandable to customers how provisions in policies correspond to common customer responses to cyber incidents, including with respect to system recovery and potential ransom payments. (E) Analyze and explain in a manner understandable to customers the terminology used in policies to include or exclude coverage for losses due to cyber incidents. (F) Analyze and explain in a manner understandable to customers the constraints faced by issuers in covering higher amounts of losses and cyber risk areas, such as reputational damage and the loss of intellectual property. (G) Develop information for customers on ways to effectively evaluate the types and levels of coverage offered under a policy. (H) Develop information for issuers, agents, and brokers regarding how to provide and communicate policy provisions that are clear and easy to understand for customers. (I) Gather input from issuers on what measures could improve the ability of those issuers to offer additional coverage under policies, including— (i) improvements to their actuarial data and cyber risk data; (ii) the development of effective information sharing mechanisms; and (iii) accurate measurement of the cybersecurity practices of customers. (J) Identify what measures could reduce the cost of policies and reduce the amount of cyber risk and the number of cyber incidents. (K) Develop recommendations for customers on how best to use cyber insurance and the benefits of doing so. (2) Consultation In carrying out the activities of the working group under paragraph (1), the working group shall consult with the public in an open and transparent manner, including by consulting with the following stakeholders: (A) Issuers. (B) Insurance agents and brokers with experience in the sale and distribution of cyber insurance. (C) Representatives of business customers from multiple sectors and representatives of small businesses. (D) Academia. (E) State insurance regulators with expertise regarding cybersecurity and cyber insurance. (F) Owners and operators of critical infrastructure. (G) Other individuals or entities with cybersecurity and cyber insurance expertise as the Assistant Secretary considers appropriate. (d) Report Not later than 1 year after the date on which the working group first convenes, the working group shall submit to Congress a report regarding the activities of the working group under subsection (c) and any recommendations of the working group. (e) Termination The working group shall terminate upon submission of the report required under subsection (d). (f) Rule of construction Nothing in this section shall be construed to— (1) require adoption of the recommendations of the working group; or (2) provide any authority to any member of the working group or any other individual to regulate the business of insurance that is not already provided under any other provision of law.