Telecommunications cybersecurity working group

(a) Establishment There is established, within NTIA, a public-private advisory body to be known as the Telecommunications Cybersecurity Working Group that shall— (1) develop Industry Best Practices, including associated adoption instructions and materials as outlined in section 4; (2) create a network of independent third-party assessors eligible to certify implementation and maintenance of best practices under section 5, including criteria for such assessors; and (3) provide and advise on technical feedback and implementation guidance relating to Industry Best Practices developed pursuant to paragraph (1). (b) Membership (1) In general The Working Group shall include representatives from NTIA, CISA, NIST, ODNI, ONCD, NSA, the Commission, and industry members appointed in accordance with paragraph (2). (2) Initial appointment of industry members The Assistant Secretary shall appoint initial members of the Working Group that, to the extent practicable, represent the following stakeholder categories: (A) National telecommunications carriers. (B) Regional and rural telecommunications carriers, including small and medium-sized telecommunications providers. (C) Communications sector suppliers, including network infrastructure and equipment manufacturers. (D) Software and systems providers that offer cloud services, network management, or cybersecurity tools. (E) State and local government communications or emergency network operators. (F) Independent cybersecurity experts and representatives of academia. (G) Other relevant supply chain stakeholders, as jointly determined by the co-chairs. (3) Terms and vacancies of industry members (A) Terms Each industry member of the Working Group shall serve 1 term of not longer than 2 years and may be reappointed for 1 successive term. (B) Vacancy replacement The Working Group shall develop a vacancy replacement procedure that includes— (i) for vacancies occurring due to the end of an industry member’s term, a vote not later than 90 days before the last day of the industry member’s term; and (ii) for vacancies occurring under paragraph (4) or for any other reason, joint nomination of a replacement by the co-chairs from the same stakeholder category under paragraph (2), to the extent practicable, as the industry member creating the vacancy, subject to approval by a majority vote of the members of the Working Group. (4) Removal Any member that fails to comply with the conflict of interest policy adopted pursuant to subsection (c)(4) shall be removed from the Working Group. (5) Co-chairs The Working Group shall have 2 co-chairs, of which— (A) 1 shall be the Assistant Secretary; and (B) 1 shall be selected by a majority vote among a quorum of the industry members appointed in accordance with paragraph (2). (6) Member access to classified information (A) Access (i) In general Not later than 60 days after the date on which a member is first selected to the Working Group and before the member is granted access to any classified information necessary to participate in a closed session pursuant to subsection (c)(6), the Assistant Secretary shall determine, for the purposes of the Working Group, if the member should be restricted from reviewing, discussing, or possessing classified information. (ii) Management Access to classified materials shall be managed in accordance with Executive Order 13526 (50 U.S.C. 3161 note; relating to classified national security information), or any subsequent corresponding Executive order. (B) Protection of information A member of the Working Group granted access to classified information shall protect the classified information in accordance with the applicable requirements for the particular level of classification of the information. (C) Rule of construction Nothing in this paragraph shall be construed to affect the security clearance of a member of the Working Group or the authority of a Federal agency to provide a member of the Working Group access to classified information. (c) Procedures (1) Designated Federal Officer The Assistant Secretary shall designate a Federal officer or employee to serve as the Designated Federal Officer of the Working Group, consistent with the requirements of chapter 10 of title 5, United States Code (commonly known as the Federal Advisory Committee Act). (2) Initial meeting and bylaws Not later than 120 days after the date of enactment of this Act, the Working Group shall convene and establish bylaws that— (A) govern quorum and voting rules; (B) set deliverable timelines and meeting schedules; and (C) create procedures for recommending third-party certification assessors, including conflict-of-interest protocols. (3) Operating procedures Unless otherwise specified, the Working Group shall adopt written procedures governing its meetings, consistent with chapter 10 of title 5, United States Code, that include— (A) requirements for public notice of meetings and the maintenance of records and minutes; (B) decision making by majority vote of those present and voting, or in accordance with the voting rules established in the bylaws; (C) authorization for the establishment of subgroups as necessary, subject to the approval of the co-chairs; and (D) approval of the meeting agendas by the co-chair described in subsection (b)(5)(A), in consultation with the co-chair described in subsection (b)(5)(B) and the Designated Federal Officer of the Working Group to ensure compliance with applicable laws. (4) Conflict-of-interest policy (A) In general The Working Group shall adopt and enforce a written conflict of interest policy to ensure that members have a fiduciary responsibility to the Working Group, a duty to report conflicts of interest, including the appearance of a conflict of interest, and do not participate in deliberations or votes from which they personally or their employer would directly and materially benefit. (B) Required disclosures The policy under subparagraph (A) shall require each member to publicly disclose all relevant financial and employment relationships and include recusal procedures in the event of a conflict. (C) Records The Designated Federal Officer of the Working Group shall maintain records of disclosures under subparagraph (B) and make summaries of the disclosures available to NTIA. (5) Threat information access ODNI, in coordination with other appropriate Federal entities, shall ensure that the Working Group has access to relevant cybersecurity threat information, including through closed or classified briefings for members eligible to receive such information, when appropriate. (6) Closed sessions Notwithstanding section 1009 of title 5, United States Code, the Working Group may hold closed or restricted-access sessions when the Assistant Secretary determines that the matters to be discussed involve any of the following: (A) Classified information. (B) Sensitive cybersecurity vulnerabilities. (C) Threat information. (D) Proprietary business information. (E) Other information exempt from public disclosure under section 552 of title 5, United States Code. (d) Transparency and communication The Assistant Secretary shall— (1) publish Industry Best Practices, implementation guidance, and criteria for third-party assessors; (2) publish on the website of NTIA and submit to the relevant congressional committees the bylaws, membership, and procedures of the Working Group; and (3) publish a memorandum of understanding (or equivalent written coordination instrument) among NTIA, CISA (acting through the CSRMA), NIST, and the Commission describing roles, coordination, and non-duplication procedures under this Act. (e) Termination of Advisory Committee Section 1013(a) of title 5, United States Code, shall not apply with respect to the Working Group.