Bill would offer voluntary cybersecurity certification to telecommunications companies

A public-private working group would develop, publish, and maintain voluntary cybersecurity practices and guidance. The group would cover telecommunications carriers, communications suppliers, and other related supply-chain participants for whom it develops practices. Companies could choose whether to follow the practices, and regulators could not treat nonparticipation as evidence against them. Detailed guidance could remain private to reduce cybersecurity risks, but eligible companies and assessors would receive access for certification. The group would first meet within 120 days after enactment and develop the practices within 18 months, then review them at least every two years.

Eligible companies could voluntarily seek an independent review and federal certification. Certification would cover telecommunications carriers and other suppliers addressed by the voluntary practices. The court defense would not cover gross negligence, willful misconduct, or material failure to follow the practices. Renewal would require a full reassessment, and only inconsistent state cybersecurity rules would be blocked. Certification could last up to two years. The court defense would depend on compliance with the practices in effect when the cybersecurity incident occurred.

Covered employers could not punish workers for certain lawful reports about certification problems. The protection would cover employees of eligible assessors and telecommunications carriers with pending or approved certifications. The worker must reasonably believe the conduct shows noncompliance with, or a serious misrepresentation of, the certification standard. The report must assist a regulator, law enforcement agency, Congress, a supervisor, or another authorized workplace investigator.