Development of Industry Best Practices for cybersecurity

(a) In general Not later than 18 months after the date of enactment of this Act, the Working Group shall, in consultation with the heads of NTIA, CISA, NIST, ODNI, ONCD, NSA, and the Commission, develop and maintain cybersecurity best practices (and corresponding implementation guidance), referred to in this Act as Industry Best Practices, for telecommunications carriers and other eligible entities that— (1) are for carriers and communications sector suppliers and the telecommunications sector to elect to implement and maintain; (2) are issued and maintained by CISA, acting through the CSRMA, with NTIA serving as the convener and administrative home for the Working Group; (3) apply, as appropriate, to communications sector suppliers and other supply chain participants, which may participate as eligible entities for purposes of certification under section 5; (4) focus solely on identifying, responding to, mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities; (5) are risk-based and consistent with other Federal cybersecurity risk management frameworks, including CISA sector guidance, the NIST Cybersecurity Framework, the NIST Risk Management Framework, and relevant cybersecurity guidance developed pursuant to Executive Order 14028 (44 U.S.C. 3551 note; relating to improving the nation's cybersecurity), including those for communications subsectors, and any relevant successor guidance; (6) may account for, as appropriate, relevant cybersecurity requirements and certifications of a current member of the North Atlantic Treaty Organization, a major non-NATO ally (as designated under section 517 of the Foreign Assistance Act of 1961 (22 U.S.C. 2321k)), or a member of the Five Eyes countries (as defined in section 1606(c) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (10 U.S.C. 2271 note)), including as relevant to interoperability or avoiding unnecessary duplication; (7) avoid duplication of existing cybersecurity risk management processes; and (8) reflect available threat intelligence, Federal cybersecurity advisories, and technological developments at the time of development or update. (b) Industry Best Practices contents The Industry Best Practices may include— (1) application of security updates to network devices, as available; (2) the timely decommissioning, or implementation of secure alternative mitigations, of network devices owned by and under the control and management of the telecommunications carrier that no longer receive updates by the original equipment manufacturer to address identified security vulnerabilities in the network device; (3) the creation and maintenance of configuration management practices for the hardware, software, or firmware, or a combination thereof, of network devices owned by or under the control and management of the telecommunications carrier including, at a minimum, a baseline configuration and configuration management plan that align with internal security policies and NIST CSF 2.0 industry best practices; (4) implementation of appropriate multi-factor authentication, or identity control and access management measures; and (5) other such practices as established by the Working Group. (c) Review and update The Working Group shall review and update Industry Best Practices (and corresponding implementation guidance) not less frequently than once every 2 years, and interim updates may be made in response to significant cybersecurity incidents or material changes in threat conditions if determined necessary by the Working Group, to reflect evolving cybersecurity risks and technologies. (d) Use of existing bodies In carrying out this section, the Working Group may consult with other public-private advisory councils and relevant information-sharing organizations, as well as any Federal entities, including the Commission, NTIA, and CISA, that the Working Group determines may be capable of providing meaningful insight with respect to the development of Industry Best Practices (and corresponding implementation guidance). (e) Publication and guidance access (1) In general The Assistant Secretary shall publish Industry Best Practices (and corresponding implementation guidance) on the website of NTIA, to promote transparency and encourage voluntary alignment across the telecommunications sector. (2) Guidance (A) Withholding for cybersecurity The Assistant Secretary, in consultation with the head of CISA, may withhold detailed implementation guidance from public release to mitigate cybersecurity risks, provided that the implementation guidance is made available to eligible entities and eligible cybersecurity assessors for purposes of certification under section 5. (B) Exemption from disclosure Detailed implementation guidance withheld under subparagraph (A) is exempt from disclosure under section 552(b)(3) of title 5, United States Code. (C) No use for regulatory enforcement No information disclosed by an eligible entity for the purposes of informing guidance published or disclosed pursuant to this paragraph may be used in any regulatory proceeding or enforcement action. (D) Rule of Construction (no new Commission authority) Nothing in this Act shall be construed to expand the authority of the Commission to promulgate or enforce cybersecurity regulations, or to require adoption of Industry Best Practices, which eligible entities may elect to adopt. (E) No adverse inference No regulatory agency may draw any inferences from an eligible entity choosing not to adopt Industry Best Practices or implementation guidance.