Telecommunications Cybersecurity and Resilience Act

This bill establishes a public-private working group within the National Telecommunications and Information Administration (NTIA) to develop voluntary cybersecurity best practices for telecommunications carriers and related supply chain participants, and creates a voluntary certification program for entities that implement those practices.

Sec. 2, Definitions: Defines key terms used in the bill, including the Assistant Secretary of Commerce for Communications and Information, eligible entities (telecommunications carriers and other stakeholders), CISA, the FCC, NIST, NTIA, and the Working Group.

Sec. 3, Telecommunications Cybersecurity Working Group: Establishes a public-private advisory body within NTIA to develop industry best practices, create a network of independent third-party assessors, and provide technical feedback. The Working Group includes representatives from NTIA, CISA, NIST, ODNI, ONCD, NSA, the FCC, and industry members appointed by the Assistant Secretary from categories such as national carriers, rural carriers, suppliers, software providers, state/local governments, and cybersecurity experts. It has two co-chairs (the Assistant Secretary and an industry-selected member) and must adopt conflict-of-interest policies and operating procedures.

Sec. 4, Development of Industry Best Practices for Cybersecurity: Requires the Working Group, within 18 months, to develop voluntary cybersecurity best practices and implementation guidance for eligible entities. These practices must be risk-based, consistent with federal frameworks like NIST CSF, avoid duplication, and reflect threat intelligence. They may include security updates, decommissioning unsupported devices, configuration management, multi-factor authentication, and other practices. The Working Group must review and update them at least every two years. The Assistant Secretary publishes them on NTIA's website, but may withhold detailed guidance for cybersecurity reasons.

Sec. 5, Cybersecurity Certification Requirements for Eligible Entities: The Working Group develops criteria for independent third-party assessors, and the Assistant Secretary publishes a list of eligible assessors. Entities that elect to be assessed and receive a proposed certification may submit it to the Assistant Secretary for approval within 90 days. Approved certifications are valid for up to 2 years and provide an affirmative defense in court that the entity exercised due care, unless gross negligence or willful misconduct is found. The bill preempts state laws inconsistent with this certification. It also includes whistleblower protections for employees reporting violations.

Sec. 6, Reporting Requirements: The Assistant Secretary must submit an annual report to Congress on the development, adoption, and effectiveness of industry best practices and certification, and publish a public version on NTIA's website. An event-triggered report is required within 90 days after a substantial revision to best practices or a significant cyber incident affecting the telecommunications sector.

Sec. 7, Rules of Construction: Clarifies that the bill does not grant regulatory authority to any federal agency, expand obligations under existing laws, require adoption of best practices, or authorize federal oversight of cybersecurity operations beyond the voluntary development and certification program.

Sec. 8, Severability: If any provision of the bill is held unconstitutional, the remainder of the bill continues in effect.