Full bill text rendering is coming soon.
In the meantime, read the full text on Congress.gov ↗.
Core Policy Mechanism Top 5
Develop and Publish Voluntary Telecom Cybersecurity Best Practices
Directs the Working Group to create and update voluntary cybersecurity best practices for telecom carriers within 18 months, publish them on the National Telecommunications and Information Administration (NTIA) website, and review them at least every two years. Sensitive implementation guidance may be withheld from public release. Explicitly bars any interpretation of this Act as granting new regulatory authority to federal agencies, expanding existing telecom law obligations, or authorizing federal oversight of carrier cybersecurity operations beyond the voluntary best-practices and certification program. Expressly bars the Federal Communications Commission (FCC) and all other federal agencies from using this Act to expand cybersecurity regulatory authority, require adoption of best practices, or draw adverse inferences against companies that choose not to adopt them. All practices remain strictly voluntary.
- Population Scope Medium Directly affects all telecommunications carriers and eligible entities operating in the U.S. telecom sector — a significant industry-wide class, but not the general public.
- Budgetary Magnitude Low No dollar amounts, appropriations, or funding streams are authorized or obligated by this component.
- Legal / Regulatory Depth High Creates new statutory mandates — an 18-month development deadline, biennial review duty, FOIA exemption, and a binding prohibition on using disclosed information in regulatory proceedings — that collectively restructure the legal framework governing telecom cybersecurity norms.
- Degree of Discretion Granted Medium The Working Group and Assistant Secretary have meaningful discretion in shaping the content of best practices and determining what implementation guidance to withhold, but are bound by mandatory consultation requirements and fixed timelines.
- Implementation & Enforcement Burden Low All practices remain voluntary with no enforcement mechanisms, penalties, or compliance obligations imposed on carriers or agencies.
- Temporal Commitment High The best-practices regime persists indefinitely, with mandatory biennial reviews requiring ongoing agency action until Congress acts to repeal it.
No signal yet
Core Policy Mechanism Top 5
Voluntary Cybersecurity Certification Program for Telecom Carriers
Creates a voluntary program allowing telecom carriers to obtain cybersecurity certification through independent third-party assessors, approved by the Assistant Secretary. Certifications are valid for up to two years, renewable, and subject to revocation. Includes whistleblower protections for employees who report non-compliance. Blocks states and local governments from enforcing cybersecurity laws or rules that conflict with this Act against telecom carriers that have earned federal cybersecurity certification. State laws inconsistent with the Act are preempted for certified entities.
- Population Scope Medium Directly affects all telecom carriers eligible for certification, independent assessors, their employees, and state governments whose laws are preempted — a broad industry-wide class across all U.S. jurisdictions.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth High Creates a new federal certification regime with submission and approval procedures, whistleblower protections, and express state preemption — each a new substantive legal change that overrides existing state law for certified entities.
- Degree of Discretion Granted Medium The Assistant Secretary holds approval and revocation authority over certifications, but is constrained by defined submission requirements, a 90-day decision timeline, and mandatory cure and appeal rights.
- Implementation & Enforcement Burden Medium Requires standing up a recurring adjudicatory process — reviewing submissions, making approval or disapproval decisions within 90 days, managing revocations, and administering whistleblower protections — imposing ongoing federal administrative load.
- Temporal Commitment High The certification program operates indefinitely with no expiry, creating a permanent recurring compliance and renewal cycle until Congress acts to end it.
No signal yet
Carve-outs, Exemptions, Eligibility Top 5
Affirmative Legal Defense for Certified Telecom Entities
Gives telecom carriers that earn cybersecurity certification an affirmative defense in federal and state court against cybersecurity liability claims, treating the certification as evidence of due care. The defense does not apply in cases of gross negligence or willful misconduct.
- Population Scope Low Applies only to the subset of telecom carriers that have obtained an approved certification and face cybersecurity-related civil litigation — a narrow class within an already industry-specific population.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth High Creates a new statutory affirmative defense in both federal and state courts — a new privately enforceable legal right that changes substantive civil liability exposure for certified carriers.
- Degree of Discretion Granted Low The defense is self-executing upon certification approval, leaving no agency discretion in its application; courts determine whether gross negligence or willful misconduct negates it.
- Implementation & Enforcement Burden Low Imposes no new enforcement infrastructure or compliance obligations; the defense is judicially invoked rather than administratively administered.
- Temporal Commitment Medium The defense is tied to the validity period of an approved certification, capped at two years and requiring renewal, creating a forced revisit cycle rather than indefinite persistence.
No signal yet
Core Policy Mechanism Top 5
Establish Telecom Cybersecurity Working Group within NTIA
Creates a new public-private advisory body within the National Telecommunications and Information Administration (NTIA) to develop voluntary cybersecurity best practices and run a third-party assessor network for telecom carriers. Sets detailed membership, conflict-of-interest, and classified-access rules.
- Population Scope Medium Directly affects federal agencies required to participate or coordinate (National Telecommunications and Information Administration (NTIA), Office of the Director of National Intelligence (ODNI), CISA, Federal Communications Commission (FCC), and others) and industry stakeholders appointed as members — a significant multi-agency and multi-sector class, though not the general public.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth Medium Establishes a new advisory body with defined membership, conflict-of-interest, and classified-access rules — a structural procedural change binding agency conduct rather than altering substantive law across the regulated population.
- Degree of Discretion Granted Medium The Assistant Secretary appoints initial members and determines classified-access eligibility, but is constrained by mandatory membership categories, co-chair structure, conflict-of-interest policy requirements, and a 60-day classified-access determination deadline.
- Implementation & Enforcement Burden Medium Requires NTIA to stand up and administer a new advisory body — managing appointments, conflict-of-interest disclosures, classified briefing coordination with ODNI, and closed-session determinations — imposing recurring administrative infrastructure costs.
- Temporal Commitment High The Working Group is established with no expiry, operating on a rolling two-year membership cycle that continues indefinitely until Congress acts to dissolve it.
No signal yet
Carve-outs, Exemptions, Eligibility Top 5
Exemption from disclosure
Detailed implementation guidance withheld under subparagraph (A) is exempt from disclosure under section 552(b)(3) of title 5, United States Code.
- Population Scope Low Affects only entities that submit implementation guidance to National Telecommunications and Information Administration (NTIA) and members of the public who might otherwise seek that guidance under FOIA — an extremely narrow and indirect population.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth Medium Adds a new FOIA exemption for a specific category of withheld implementation guidance, a procedural constraint on disclosure obligations rather than a change to substantive law governing carriers.
- Degree of Discretion Granted Medium The Assistant Secretary retains discretion to determine what implementation guidance warrants withholding, with the FOIA exemption applying only to guidance so designated.
- Implementation & Enforcement Burden Low Creates no new enforcement mechanism; it merely shields designated guidance from mandatory disclosure, placing no affirmative compliance burden on any party.
- Temporal Commitment High The FOIA exemption persists indefinitely as a standing feature of the statute, operative for any guidance withheld under it, until Congress acts to repeal it.
No signal yet
Core Policy Mechanism
Severability Clause
Provides that if any part of this Act is found unconstitutional, the rest of the Act remains in effect. An unconstitutional application to one person or situation does not affect its application to others.
No signal yet
Core Policy Mechanism
Severability Clause
Provides that if any part of this Act is found unconstitutional, the rest of the Act remains in effect. An unconstitutional application to one person or situation does not affect its application to others.
No signal yet
Summary
This bill creates a voluntary cybersecurity program for telecommunications companies. It sets up a public-private advisory group within the National Telecommunications and Information Administration (NTIA) to develop security best practices and run a certification program for companies that want to prove they meet those standards. Among other elements, the bill * establishes a Telecommunications Cybersecurity Working Group within NTIA to develop and maintain voluntary security best practices for telecom carriers; * creates a certification program where companies can get independently assessed and approved, with legal protections for those that earn certification; * grants certified companies an affirmative legal defense in court against cybersecurity liability claims, except in cases of gross negligence or willful misconduct; * preempts state cybersecurity laws that conflict with this Act for companies that earn certification; * and explicitly bars any new regulatory authority over telecom companies' cybersecurity operations, keeping all practices voluntary.
AI-generated summary, pending human review.
| Version | Event | Date | User support | Your vote | Roll calls |
|---|---|---|---|---|---|
| Original |
Initial publication
Sep 24, 2026
|
Sep 24, 2026 | No votes yet | — | — |
Log in or create an account to record your vote on this legislation. Results are visible to all visitors.
Core Policy Mechanism Top 5
Develop and Publish Voluntary Telecom Cybersecurity Best Practices
Directs the Working Group to create and update voluntary cybersecurity best practices for telecom carriers within 18 months, publish them on the National Telecommunications and Information Administration (NTIA) website, and review them at least every two years. Sensitive implementation guidance may be withheld from public release. Explicitly bars any interpretation of this Act as granting new regulatory authority to federal agencies, expanding existing telecom law obligations, or authorizing federal oversight of carrier cybersecurity operations beyond the voluntary best-practices and certification program. Expressly bars the Federal Communications Commission (FCC) and all other federal agencies from using this Act to expand cybersecurity regulatory authority, require adoption of best practices, or draw adverse inferences against companies that choose not to adopt them. All practices remain strictly voluntary.
- Population Scope Medium Directly affects all telecommunications carriers and eligible entities operating in the U.S. telecom sector — a significant industry-wide class, but not the general public.
- Budgetary Magnitude Low No dollar amounts, appropriations, or funding streams are authorized or obligated by this component.
- Legal / Regulatory Depth High Creates new statutory mandates — an 18-month development deadline, biennial review duty, FOIA exemption, and a binding prohibition on using disclosed information in regulatory proceedings — that collectively restructure the legal framework governing telecom cybersecurity norms.
- Degree of Discretion Granted Medium The Working Group and Assistant Secretary have meaningful discretion in shaping the content of best practices and determining what implementation guidance to withhold, but are bound by mandatory consultation requirements and fixed timelines.
- Implementation & Enforcement Burden Low All practices remain voluntary with no enforcement mechanisms, penalties, or compliance obligations imposed on carriers or agencies.
- Temporal Commitment High The best-practices regime persists indefinitely, with mandatory biennial reviews requiring ongoing agency action until Congress acts to repeal it.
No signal yet
Core Policy Mechanism
Develop and Publish Voluntary Telecom Cybersecurity Best Practices
Core Policy Mechanism Top 5
Voluntary Cybersecurity Certification Program for Telecom Carriers
Creates a voluntary program allowing telecom carriers to obtain cybersecurity certification through independent third-party assessors, approved by the Assistant Secretary. Certifications are valid for up to two years, renewable, and subject to revocation. Includes whistleblower protections for employees who report non-compliance. Blocks states and local governments from enforcing cybersecurity laws or rules that conflict with this Act against telecom carriers that have earned federal cybersecurity certification. State laws inconsistent with the Act are preempted for certified entities.
- Population Scope Medium Directly affects all telecom carriers eligible for certification, independent assessors, their employees, and state governments whose laws are preempted — a broad industry-wide class across all U.S. jurisdictions.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth High Creates a new federal certification regime with submission and approval procedures, whistleblower protections, and express state preemption — each a new substantive legal change that overrides existing state law for certified entities.
- Degree of Discretion Granted Medium The Assistant Secretary holds approval and revocation authority over certifications, but is constrained by defined submission requirements, a 90-day decision timeline, and mandatory cure and appeal rights.
- Implementation & Enforcement Burden Medium Requires standing up a recurring adjudicatory process — reviewing submissions, making approval or disapproval decisions within 90 days, managing revocations, and administering whistleblower protections — imposing ongoing federal administrative load.
- Temporal Commitment High The certification program operates indefinitely with no expiry, creating a permanent recurring compliance and renewal cycle until Congress acts to end it.
No signal yet
Core Policy Mechanism
Voluntary Cybersecurity Certification Program for Telecom Carriers
Carve-outs, Exemptions, Eligibility Top 5
Affirmative Legal Defense for Certified Telecom Entities
Gives telecom carriers that earn cybersecurity certification an affirmative defense in federal and state court against cybersecurity liability claims, treating the certification as evidence of due care. The defense does not apply in cases of gross negligence or willful misconduct.
- Population Scope Low Applies only to the subset of telecom carriers that have obtained an approved certification and face cybersecurity-related civil litigation — a narrow class within an already industry-specific population.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth High Creates a new statutory affirmative defense in both federal and state courts — a new privately enforceable legal right that changes substantive civil liability exposure for certified carriers.
- Degree of Discretion Granted Low The defense is self-executing upon certification approval, leaving no agency discretion in its application; courts determine whether gross negligence or willful misconduct negates it.
- Implementation & Enforcement Burden Low Imposes no new enforcement infrastructure or compliance obligations; the defense is judicially invoked rather than administratively administered.
- Temporal Commitment Medium The defense is tied to the validity period of an approved certification, capped at two years and requiring renewal, creating a forced revisit cycle rather than indefinite persistence.
No signal yet
Carve-outs, Exemptions, Eligibility
Affirmative Legal Defense for Certified Telecom Entities
Core Policy Mechanism Top 5
Establish Telecom Cybersecurity Working Group within NTIA
Creates a new public-private advisory body within the National Telecommunications and Information Administration (NTIA) to develop voluntary cybersecurity best practices and run a third-party assessor network for telecom carriers. Sets detailed membership, conflict-of-interest, and classified-access rules.
- Population Scope Medium Directly affects federal agencies required to participate or coordinate (National Telecommunications and Information Administration (NTIA), Office of the Director of National Intelligence (ODNI), CISA, Federal Communications Commission (FCC), and others) and industry stakeholders appointed as members — a significant multi-agency and multi-sector class, though not the general public.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth Medium Establishes a new advisory body with defined membership, conflict-of-interest, and classified-access rules — a structural procedural change binding agency conduct rather than altering substantive law across the regulated population.
- Degree of Discretion Granted Medium The Assistant Secretary appoints initial members and determines classified-access eligibility, but is constrained by mandatory membership categories, co-chair structure, conflict-of-interest policy requirements, and a 60-day classified-access determination deadline.
- Implementation & Enforcement Burden Medium Requires NTIA to stand up and administer a new advisory body — managing appointments, conflict-of-interest disclosures, classified briefing coordination with ODNI, and closed-session determinations — imposing recurring administrative infrastructure costs.
- Temporal Commitment High The Working Group is established with no expiry, operating on a rolling two-year membership cycle that continues indefinitely until Congress acts to dissolve it.
No signal yet
Core Policy Mechanism
Establish Telecom Cybersecurity Working Group within NTIA
Carve-outs, Exemptions, Eligibility Top 5
Exemption from disclosure
Detailed implementation guidance withheld under subparagraph (A) is exempt from disclosure under section 552(b)(3) of title 5, United States Code.
- Population Scope Low Affects only entities that submit implementation guidance to National Telecommunications and Information Administration (NTIA) and members of the public who might otherwise seek that guidance under FOIA — an extremely narrow and indirect population.
- Budgetary Magnitude Low Same as above.
- Legal / Regulatory Depth Medium Adds a new FOIA exemption for a specific category of withheld implementation guidance, a procedural constraint on disclosure obligations rather than a change to substantive law governing carriers.
- Degree of Discretion Granted Medium The Assistant Secretary retains discretion to determine what implementation guidance warrants withholding, with the FOIA exemption applying only to guidance so designated.
- Implementation & Enforcement Burden Low Creates no new enforcement mechanism; it merely shields designated guidance from mandatory disclosure, placing no affirmative compliance burden on any party.
- Temporal Commitment High The FOIA exemption persists indefinitely as a standing feature of the statute, operative for any guidance withheld under it, until Congress acts to repeal it.
No signal yet
Carve-outs, Exemptions, Eligibility
Exemption from disclosure
Incomplete vote
You have not made a selection on all required items:
Choose Neutral if you prefer not to commit. Leaving without completing will remove all your votes for this bill from the totals.
Maximum recommendations reached
You have already recommended the maximum number of components allowed on this bill. To recommend [new component], choose one of your current recommendations to unselect: