Cybersecurity certification requirements for eligible entities

(a) Eligible assessor criteria and publication (1) Development and approval of criteria (A) Development of criteria The Working Group shall determine, and the Assistant Secretary shall approve, criteria for independent third-party cybersecurity assessors. (B) Documentation In developing the criteria under subparagraph (A), the Working Group shall publish the assessment criteria and general methodology to be used by eligible cybersecurity assessors, except for information the Assistant Secretary determines should be withheld to mitigate cybersecurity risks. (2) Publication of eligible cybersecurity assessors The Assistant Secretary shall— (A) establish an evaluation process and assessment standard for designating eligible cybersecurity assessors; (B) publish a list of eligible cybersecurity assessors designated pursuant to subparagraph (A) that a telecommunications carrier, or other eligible entity for which Industry Best Practices were developed, may elect to evaluate the telecommunication carrier’s or eligible entity’s implementation of Industry Best Practices and that may issue a proposed certification; and (C) establish conditions under which to revoke or suspend the designation as an eligible cybersecurity assessor. (3) Prohibition on certain assessors No entity owned or controlled by a telecommunications carrier may be designated as an eligible cybersecurity assessor under this subsection. (b) Certification and Approval Process (1) Approval of certification (A) Submission (i) In general A telecommunications carrier or other eligible entity that elects to have an eligible cybersecurity assessor evaluate the telecommunication carrier or eligible entity and receives a proposed certification may submit the proposed certification to the Assistant Secretary for approval. (ii) Format of submissions The Assistant Secretary may require submissions of the proposed certification under clause (i) to be submitted in machine readable format in the Open Security Controls Assessment Language architecture developed by NIST, or a successor framework. (B) Contents of submission A submission under subparagraph (A) shall include— (i) the full assessment report prepared by the eligible cybersecurity assessor; (ii) documentation of the Industry Best Practices against which the telecommunications carrier or other eligible entity was evaluated; and (iii) the disclosures required under subsection (c)(4). (C) Timeframe for decision Upon receipt of a proposed certification for approval, the Assistant Secretary shall, within 30 days, determine whether the submission is complete and, not later than 90 days after the date of such determination, approve or disapprove the complete proposed certification. (D) Disapproval of certification In the event that the Assistant Secretary disapproves a proposed certification under this paragraph, the Assistant Secretary shall inform the eligible entity of the basis for the disapproval. (E) Right to cure and appeal (i) Right to cure An eligible entity the proposed certification of which was disapproved by the Assistant Secretary shall have 30 days to resubmit the proposed certification, during which period no adverse action shall be taken by the Assistant Secretary against the eligible entity on the basis of lacking a certification. (ii) Right to Appeal (I) In general An eligible entity described in clause (i) may appeal the disapproval to the Assistant Secretary. (II) Process The Assistant Secretary shall establish the manner and form in which appeals under this clause shall be heard and shall render a decision on any such appeal not later than 90 days after the date of the initiation of the appeal. (2) Effect of certification A certified telecommunications carrier or other eligible entity shall, in any Federal or State court, be entitled to an affirmative defense that approval of a certification under paragraph (1) constitutes due care or reasonableness for mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities, unless the telecommunications carrier or other eligible entity is found to have acted with gross negligence, willful misconduct, or have not materially implemented and maintained the Industry Best Practices consistent with the approved certification. (3) Timing; later change The defense under paragraph (2) shall apply if the eligible entity was certified and in compliance with the Industry Best Practices in effect at the time of the incident, notwithstanding— (A) subsequent revisions to Industry Best Practices; or (B) subsequent expiration, subsequent suspension, or non-renewal of the certification. (4) Conflict preemption No State or political subdivision of a State may establish, maintain, prescribe, continue, or enforce any law, rule, regulation, or requirement imposing a duty, standard, requirement, or liability or enforcing standards for cybersecurity that are inconsistent with this Act with respect to a certified eligible entity. (c) Certification requirements Each approved certification under subsection (b)(1) shall— (1) be valid for a period of not more than 2 years; (2) be renewable through comprehensive reassessment; (3) include documentation of implementation and maintenance of the applicable Industry Best Practices at the time of certification; (4) require disclosure of any direct financial interest or material business relationship between the assessor and the entity being assessed; (5) include a description of the assessment methodology and criteria used; and (6) be subject to revocation by the Assistant Secretary if the assessor is found to have issued invalid or false certifications. (d) Whistleblower protection (1) In general No eligible cybersecurity assessor or telecommunications carrier with an approved or pending certification, or any officer, employee, contractor, subcontractor, or agent of such company, may discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee to provide information to, cause information to be provided to, or otherwise assist in an investigation by an agency, entity, or person described in paragraph (2), relating to any conduct that the employee reasonably believes reflects non-compliance with or gross misrepresentation relating to the certification standard established by the Working Group. (2) Agency, entity, or person described An agency, entity, or person described in this paragraph is— (A) a Federal regulatory or law enforcement agency; (B) any Member of Congress or any committee of Congress; or (C) a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct). (e) Routine implementation and maintenance obligation A certified eligible entity shall routinely implement and maintain cybersecurity practices aligned with Industry Best Practices, as updated, during the period of certification. (f) Early reassessment (1) Authority (A) In general Upon any of the grounds described in paragraph (2), the Assistant Secretary may direct an eligible cybersecurity assessor to conduct, or may on the Assistant Secretary’s own initiative commission by an alternative eligible cybersecurity assessor, an early reassessment of a certified eligible entity and may, upon a written finding of credible evidence of material failure to implement or maintain the Industry Best Practices, suspend the approved certification of the eligible entity pending successful completion of the reassessment. (B) Responsibility for costs associated with assessment If an assessment conducted pursuant to subparagraph (A) determines that the eligible entity has materially failed to implement or maintain the Industry Best Practices, the eligible entity shall be responsible for all costs associated with performing the assessment. (2) Grounds for reassessment The grounds described in this paragraph include— (A) a substantial revision to Industry Best Practices; (B) a telecommunications carrier or other eligible entity experiences a significant cyber-incident, as defined by Presidential Policy Directive–41 (July 26, 2016; relating to United States cyber incident coordination); and (C) the Assistant Secretary receives credible information that— (i) any of the contents submitted to the Assistant Secretary under subsection (b)(1) to approve a certification were false or fraudulent; or (ii) an eligible entity has failed to routinely implement and maintain cybersecurity practices in accordance with subsection (e). (3) Good faith protection A certified telecommunications carrier or other eligible entity shall not have its certification under subsection (b) revoked solely due to an early reassessment under this subsection, unless and until the early reassessment produces a final determination that the eligible entity— (A) materially failed to implement or maintain the Industry Best Practices the entity elected to adopt through the certification process; or (B) has engaged in gross negligence or willful misconduct.