Responsibilities of the department of commerce

(a) Small business concern defined In this section, the term small business concern has the meaning given the term in section 3 of the Small Business Act (15 U.S.C. 632). (b) Establishment of commercial satellite system cybersecurity clearinghouse (1) In general Not later than 180 days after the date of enactment of this Act, the Secretary, in coordination with the Chair of the Federal Communications Commission and the Director of the Cybersecurity and Infrastructure Security Agency, shall develop and maintain a commercial satellite system cybersecurity clearinghouse. (2) Requirements The clearinghouse— (A) shall be publicly available online; (B) shall contain publicly available commercial satellite system cybersecurity resources, including the voluntary recommendations consolidated under subsection (c)(1); (C) shall contain appropriate materials for reference by entities that develop, operate, or maintain commercial satellite systems; (D) shall contain materials specifically aimed at assisting small business concerns with the secure development, operation, and maintenance of commercial satellite systems; and (E) may contain controlled unclassified information distributed to commercial entities through a process determined appropriate by the Secretary. (3) Content maintenance The Secretary shall maintain current and relevant cybersecurity information on the clearinghouse. (4) Existing platform or website To the extent practicable, the Secretary shall establish and maintain the clearinghouse using an online platform, a website, or a capability in existence as of the date of enactment of this Act. (c) Consolidation of commercial satellite system cybersecurity recommendations (1) In general The Secretary, in coordination with the Secretary of Homeland Security, shall consolidate voluntary cybersecurity recommendations designed to assist in the development, maintenance, and operation of commercial satellite systems. (2) Requirements The recommendations consolidated under paragraph (1) shall include materials appropriate for a public resource addressing, to the greatest extent practicable, the following: (A) Risk-based, cybersecurity-informed engineering, including continuous monitoring and resiliency. (B) Planning for retention or recovery of positive control of commercial satellite systems in the event of a cybersecurity incident. (C) Protection against unauthorized access to vital commercial satellite system functions. (D) Physical protection measures designed to reduce the vulnerabilities of a commercial satellite system’s command, control, and telemetry receiver systems. (E) Protection against jamming, eavesdropping, hijacking, computer network exploitation, spoofing, threats to optical satellite communications, and electromagnetic pulse. (F) Security against threats throughout a commercial satellite system’s mission lifetime. (G) Management of supply chain risks that affect the cybersecurity of commercial satellite systems. (H) Protection against vulnerabilities posed by ownership of commercial satellite systems or commercial satellite system companies by foreign entities. (I) Protection against vulnerabilities posed by locating physical infrastructure, such as satellite ground control systems, in foreign countries. (J) As appropriate, and as applicable pursuant to the maintenance requirement under subsection (b)(3), relevant findings and recommendations from the study conducted by the Comptroller General of the United States under section 3(a). (K) Any other recommendations to ensure the confidentiality, availability, and integrity of data residing on or in transit through commercial satellite systems. (d) Implementation In implementing this section, the Secretary shall— (1) to the extent practicable, carry out the implementation in partnership with the private sector; (2) coordinate with— (A) the Secretary of Homeland Security, the Office of the National Cyber Director, the National Space Council, the Chair of the Federal Communications Commission, and the head of any other agency determined appropriate by the Office of the National Cyber Director or the National Space Council; and (B) the heads of appropriate Federal agencies with expertise and experience in satellite operations, including the entities described in section 3(c) to enable the alignment of Federal efforts on commercial satellite system cybersecurity and, to the extent practicable, consistency in Federal recommendations relating to commercial satellite system cybersecurity; and (3) consult with non-Federal entities developing commercial satellite systems or otherwise supporting the cybersecurity of commercial satellite systems, including private, consensus organizations that develop relevant standards. (e) Report Not later than 1 year after the date of enactment of this Act, and every 2 years thereafter until the date that is 9 years after the date of enactment of this Act, the Secretary shall submit to the appropriate congressional committees a report summarizing— (1) any partnership with the private sector described in subsection (d)(1); (2) any consultation with a non-Federal entity described in subsection (d)(3); (3) the coordination carried out pursuant to subsection (d)(2); (4) the establishment and maintenance of the clearinghouse pursuant to subsection (b); (5) the recommendations consolidated pursuant to subsection (c)(1); and (6) any feedback received by the Secretary on the clearinghouse from non-Federal entities.

(a) Small business concern defined In this section, the term small business concern has the meaning given the term in section 3 of the Small Business Act (15 U.S.C. 632). (b) Establishment of commercial satellite system cybersecurity clearinghouse (1) In general Not later than 180 days after the date of enactment of this Act, the Secretary, in coordination with the Chair of the Federal Communications Commission and the Director of the Cybersecurity and Infrastructure Security Agency, shall develop and maintain a commercial satellite system cybersecurity clearinghouse. (2) Requirements The clearinghouse— (A) shall be publicly available online; (B) shall contain publicly available commercial satellite system cybersecurity resources, including the voluntary recommendations consolidated under subsection (c)(1); (C) shall contain appropriate materials for reference by entities that develop, operate, or maintain commercial satellite systems; (D) shall contain materials specifically aimed at assisting small business concerns with the secure development, operation, and maintenance of commercial satellite systems; and (E) may contain controlled unclassified information distributed to commercial entities through a process determined appropriate by the Secretary. (3) Content maintenance The Secretary shall maintain current and relevant cybersecurity information on the clearinghouse. (4) Existing platform or website To the extent practicable, the Secretary shall establish and maintain the clearinghouse using an online platform, a website, or a capability in existence as of the date of enactment of this Act. (c) Consolidation of commercial satellite system cybersecurity recommendations (1) In general The Secretary, in coordination with the Secretary of Homeland Security, shall consolidate voluntary cybersecurity recommendations designed to assist in the development, maintenance, and operation of commercial satellite systems. (2) Requirements The recommendations consolidated under paragraph (1) shall include materials appropriate for a public resource addressing, to the greatest extent practicable, the following: (A) Risk-based, cybersecurity-informed engineering, including continuous monitoring and resiliency. (B) Planning for retention or recovery of positive control of commercial satellite systems in the event of a cybersecurity incident. (C) Protection against unauthorized access to vital commercial satellite system functions. (D) Physical protection measures designed to reduce the vulnerabilities of a commercial satellite system’s command, control, and telemetry receiver systems. (E) Protection against jamming, eavesdropping, hijacking, computer network exploitation, spoofing, threats to optical satellite communications, and electromagnetic pulse. (F) Security against threats throughout a commercial satellite system’s mission lifetime. (G) Management of supply chain risks that affect the cybersecurity of commercial satellite systems. (H) Protection against vulnerabilities posed by ownership of commercial satellite systems or commercial satellite system companies by foreign entities. (I) Protection against vulnerabilities posed by locating physical infrastructure, such as satellite ground control systems, in foreign countries. (J) As appropriate, and as applicable pursuant to the maintenance requirement under subsection (b)(3), relevant findings and recommendations from the study conducted by the Comptroller General of the United States under section 3(a). (K) Any other recommendations to ensure the confidentiality, availability, and integrity of data residing on or in transit through commercial satellite systems. (d) Implementation In implementing this section, the Secretary shall— (1) to the extent practicable, carry out the implementation in partnership with the private sector; (2) coordinate with— (A) the Secretary of Homeland Security, the Office of the National Cyber Director, the National Space Council, the Chair of the Federal Communications Commission, and the head of any other agency determined appropriate by the Office of the National Cyber Director or the National Space Council; and (B) the heads of appropriate Federal agencies with expertise and experience in satellite operations, including the entities described in section 3(c) to enable the alignment of Federal efforts on commercial satellite system cybersecurity and, to the extent practicable, consistency in Federal recommendations relating to commercial satellite system cybersecurity; and (3) consult with non-Federal entities developing commercial satellite systems or otherwise supporting the cybersecurity of commercial satellite systems, including private, consensus organizations that develop relevant standards. (e) Report Not later than 1 year after the date of enactment of this Act, and every 2 years thereafter until the date that is 9 years after the date of enactment of this Act, the Secretary shall submit to the appropriate congressional committees a report summarizing— (1) any partnership with the private sector described in subsection (d)(1); (2) any consultation with a non-Federal entity described in subsection (d)(3); (3) the coordination carried out pursuant to subsection (d)(2); (4) the establishment and maintenance of the clearinghouse pursuant to subsection (b); (5) the recommendations consolidated pursuant to subsection (c)(1); and (6) any feedback received by the Secretary on the clearinghouse from non-Federal entities.