Telecommunications Cybersecurity and Resilience Act

The bill would establish a public-private group within NTIA, with federal agencies and representatives from telecommunications carriers, suppliers, software providers, state and local communications operators, cybersecurity experts, and academia. The group would develop voluntary practices, guidance, and a network of independent assessors.

Within 18 months after enactment, the group would develop risk-based practices for telecom carriers and eligible supply-chain participants to choose whether to adopt. Topics could include security updates, handling devices that no longer receive security updates, configuration management, and access controls; the practices would be reviewed at least every two years.

Eligible organizations could have an independent assessor evaluate their practices and submit a proposed certification for federal approval. An approved certification could provide an affirmative defense in court and limit state or local cybersecurity requirements that conflict with the bill, subject to exceptions including gross negligence, willful misconduct, or failure to maintain the practices.

NTIA would publish annual information on certification participation, adoption, reassessments, and effectiveness, and report to Congress after certain major revisions or significant cyber incidents. The bill would also protect employees who report suspected certification noncompliance or misrepresentation from workplace retaliation.