Senate Looks to Defense Bill for Key Improvements to Cybersecurity

Senate committee members and action groups are pushing for legislation to increase cybersecurity oversight. The proposals come as reports suggest the U.S. water infrastructure is struuggling with glaring cybersecurity problems and receives insufficient support from federal regulators.

Nov 20, 2021 - 08:00

0 6

Senate Looks to Defense Bill for Key Improvements to Cybersecurity

The Senate is eyeing the annual defense bill as a vehicle to attach critical provisions to improve the nation’s cybersecurity, reports The Hill. Senate Homeland Security and Governmental Affairs Committee ranking member Rob Portman, along with several other Senate committee chairs, introduced an amendment to the 2022 National Defense Authorization Act (NDAA) earlier this month that would give critical infrastructure groups 72 hours to report cyber incidents. The amendment would give critical infrastructure groups, nonprofit organizations, state and local governments, and certain businesses 24 hours to report ransomware attack payments. It also includes language to update the Federal Information Security Modernization Act (FISMA) to clarify the roles of key agencies in responding to cyber incidents, another key bipartisan priority.

In addition, the International Cybercrime Prevention Act is likely to be added to the NDAA, enhancing criminal violations for hackers attacking critical infrastructure, such as power plants and hospitals, along with expanding the Justice Department’s ability to go after botnet groups that pose a violation of the Computer Fraud and Abuse Act. The proposed bills come as the Wall Street Journal reports that U.S. water facilities are struggling with glaring cybersecurity problems and receive insufficient support from federal regulators. A recent report from the Center on Cyber and Technology Innovation, part of The Foundation for Defense of Democracies calls for an increase in the Environmental Protection Agency’s budget for cybersecurity and disaster management to as much as $45 million. The EPA has issued no binding cybersecurity standards for the water sector.