Telecommunications Cybersecurity and Resilience Act
- Sponsor
- Sen. Warner, Mark R. [D-VA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Sep 24, 2026
Bottom line
This bill aims to enhance the cybersecurity posture of the U.S. telecommunications sector through voluntary industry-led best practices and a federal certification program that provides legal protections.
What it actually does
This bill establishes a public-private working group within the National Telecommunications and Information Administration (NTIA) to develop voluntary cybersecurity best practices for telecommunications carriers and their supply chain participants. It creates a federal certification process for entities that implement these practices, offering an affirmative defense in court against cybersecurity incidents, and preempts inconsistent state cybersecurity laws for certified entities.
Proponents argue
Proponents argue that the bill provides a crucial framework for improving the resilience of critical telecommunications infrastructure against escalating cyber threats. They emphasize the voluntary, industry-led approach ensures practical and adaptable best practices, while the certification and affirmative defense incentivize adoption and provide legal clarity for companies investing in cybersecurity. The preemption clause is seen as preventing a patchwork of potentially conflicting state regulations.
Opponents contend
Opponents might argue that the voluntary nature of the best practices may not be sufficient to address systemic cybersecurity risks, potentially leaving critical infrastructure vulnerable if adoption is not widespread. Concerns could also be raised about the preemption of state laws, potentially limiting states' abilities to protect their citizens, and the scope of the affirmative defense, which might be seen as shielding companies from accountability in certain circumstances.
The bill is moderately complex but its structure allows for a clear understanding of its core provisions within a reasonable reading time.
Section 3(a)
Establishment of Telecommunications Cybersecurity Working Group
This section establishes a public-private advisory body within the National Telecommunications and Information Administration (NTIA) called the "Telecommunications Cybersecurity Working Group." This group is tasked with developing voluntary cybersecurity best practices, creating a network of third-party assessors for certification, and providing technical feedback on these practices.
Supporters argue
Supporters argue that a public-private working group is essential to leverage both government expertise in threat intelligence and industry knowledge in operational realities, ensuring that developed best practices are both effective and practical for implementation.
Critics contend
Some might argue that establishing another working group could lead to bureaucratic inefficiencies or duplication of efforts with existing advisory bodies like CSRIC, potentially slowing down the development of urgently needed cybersecurity measures.
Tradeoffs
Balances the need for government oversight and coordination with the desire for industry-led, practical solutions, potentially creating tension between regulatory impulses and voluntary adoption.
Section 3(b)
Working Group Membership and Leadership Structure
This provision details the composition of the Working Group, including representatives from key federal agencies (NTIA, CISA, NIST, ODNI, ONCD, NSA, FCC) and industry members from various telecommunications sectors and cybersecurity experts. It also specifies that the Assistant Secretary of Commerce for Communications and Information (NTIA) and an industry-selected member will co-chair the group.
Section 3(c)
Operational Procedures and Classified Information Handling
This section outlines the procedural rules for the Working Group, including the designation of a Federal Officer, establishment of bylaws, and operating procedures consistent with the Federal Advisory Committee Act. Crucially, it mandates a conflict-of-interest policy and allows for closed sessions to discuss classified information, sensitive cybersecurity vulnerabilities, or proprietary business information, with provisions for members to access classified data.
Section 4(a)
Mandate for Developing Voluntary Industry Best Practices
This section directs the Working Group to develop and maintain voluntary, risk-based cybersecurity best practices and implementation guidance for telecommunications carriers and supply chain entities within 18 months. These practices must align with existing federal frameworks (like NIST CSF) and focus on incident response, mitigation, prevention, and remediation, while avoiding duplication and considering international standards.
Section 5(b)(2)
Affirmative Defense for Certified Entities
This provision states that a telecommunications carrier or eligible entity with an approved certification of implementing Industry Best Practices shall be entitled to an affirmative defense in any Federal or State court, demonstrating due care or reasonableness in mitigating cybersecurity incidents, unless found to have acted with gross negligence, willful misconduct, or material failure to implement practices.
Section 5(b)(4)
Preemption of Inconsistent State Cybersecurity Laws
This provision prohibits any State or political subdivision from establishing, maintaining, prescribing, continuing, or enforcing any law, rule, regulation, or requirement imposing a duty, standard, requirement, or liability for cybersecurity that is inconsistent with this Act with respect to a certified eligible entity.
Section 5(f)
Authority for Early Reassessment and Certification Suspension
This section grants the Assistant Secretary authority to direct an early reassessment of a certified entity or commission one by an alternative assessor under specific grounds, such as a substantial revision to best practices, a significant cyber-incident affecting the entity, or credible information of false certification or failure to maintain practices. The Assistant Secretary can suspend certification pending reassessment.
States that no information disclosed by an eligible entity for the purposes of informing guidance published or disclosed under this paragraph may be used in any regulatory proceeding or enforcement action.
Section 4(e)(2)(C)
Why it matters:Likely standard legislative practice to provide assurances to industry participants, but its placement might make it less obvious to a casual reader.
Case for: Proponents would argue this is essential to encourage full and honest disclosure from industry participants, as they would be hesitant to share sensitive information if it could be used against them in future enforcement actions. This fosters trust and better guidance.
Case against: Critics might argue that this provision could limit accountability, as information that might reveal systemic issues or non-compliance cannot be used for regulatory enforcement, potentially hindering agencies' ability to act on critical data.
Estimated impact: Significant for industry participation and regulatory oversight, creating a protected channel for information sharing.
Explicitly states that nothing in this Act shall be construed to expand the authority of the Commission (FCC) to promulgate or enforce cybersecurity regulations, or to require adoption of Industry Best Practices.
Section 4(e)(2)(D)
Why it matters:This is a crucial clarification to assuage concerns from industry or other agencies about the FCC gaining new regulatory powers through this Act. Its placement ensures it's part of the guidance context.
Case for: Proponents would argue this is vital to maintain the voluntary nature of the program and prevent mission creep by the FCC, ensuring that the Act focuses on collaborative best practices rather than expanding regulatory mandates. It provides certainty to industry.
Case against: Critics might argue that explicitly limiting the FCC's authority could hinder a coordinated federal response to cybersecurity threats if future circumstances necessitate broader regulatory action from the Commission.
Estimated impact: Significant for the balance of power among federal agencies and the regulatory landscape for telecommunications cybersecurity.
Prohibits retaliation against employees of eligible cybersecurity assessors or telecommunications carriers who report non-compliance or gross misrepresentation related to the certification standard to federal agencies, Congress, or supervisory personnel.
Section 5(d)
Why it matters:Standard practice to include whistleblower protections in acts involving compliance and certification, often placed in a general provisions section or towards the end of a relevant title.
Case for: Proponents argue that whistleblower protections are essential for ensuring the integrity of the certification process, as they empower employees to report potential fraud or non-compliance without fear of reprisal, thereby strengthening the overall effectiveness of the cybersecurity standards.
Case against: No specific organized opposition typically arises against whistleblower protections, though some businesses might privately express concerns about potential for frivolous complaints or internal disruption, but these are rarely voiced publicly.
Estimated impact: Moderate, provides a critical safeguard for the integrity of the certification program.