Madam Chair, I have an amendment at the desk. Madam Chair, the amendment that I offer today addresses a topic that is of the utmost importance to our national defense, that is, cybersecurity. Before I go into the particulars, I would like…
Madam Chair, I have an amendment at the desk.
Madam Chair, the amendment that I offer today addresses a topic that is of the utmost importance to our national defense, that is, cybersecurity.
Before I go into the particulars, I would like to first acknowledge the important work of my colleague, Chairman Wolf, on this vital issue. Although he is retiring at the end of the year, he has certainly left a legacy of support for cybersecurity funding which he and Ranking Member Fattah have continued in this bill. I thank them both for their important work.
Madam Chair, bad actors in cyberspace are growing in number and in sophistication, and as policymakers we have an imperative to act in the public interest. When Congress came up short in its efforts to enact comprehensive cybersecurity legislation in the 112th Congress, the administration rightly acted as best it could to advance the ball on cybersecurity. The President issued an executive order on this topic, and among the many things it did, it charged the National Institute for Standards and Technology with the creation of a framework for cybersecurity, and it ensured an open process, engaging all parties from across the spectrum of industry, government, and academia.
Madam Chair, my simple amendment endorses the use of routine Department of Commerce surveys in order to measure the extent to which businesses have adopted the NIST voluntary cybersecurity framework. In fact, my amendment will ensure that the Bureau of Industry and Security's Office of Technology Evaluation uses its Defense Production Act authority to conduct a survey about use of the NIST framework.
While I applaud the President's focus on cybersecurity, and the NIST process has been widely regarded as a laudable example of public- private partnership, much more needs to be done, and the administration cannot go it alone. It will take congressional action to address issues such as incentives, liability protections, information sharing, and breach notification.
However, while we continue to work toward passage of bipartisan cybersecurity legislation, it is important that we measure how well the NIST framework is faring. Our routine Commerce Department survey, using existing authority under the Defense Production Act, will enable an assessment of the NIST framework's adoption rate, a key component of its effectiveness.
Information sharing is also an important part of the framework, so the survey will also allow BIS to ask companies what, if any, information from the government they have used and how they have used it. This brief survey should be designed in a way to minimize the burden on companies: determining if their using the framework or information shared from the government does not require an exhaustive survey of their cybersecurity practices.
The NIST framework is a model for cybersecurity. It doesn't demand adherence to a particular set of standards, nor does it proscribe certain activities. Instead, it describes processes that entities can adopt to help them decide which standards and risk levels are appropriate for their own situations.
I believe that this framework is a useful tool for companies to help them navigate new threats in the information age. I know that some of my colleagues believe otherwise, but without hard data, these sentiments would be just that: beliefs. Measuring adoption of the framework is a concrete step in the right direction that we can take to help develop our own best practices for what works in the realm of cyber policy.
So with that, Madam Chair, we have all heard about major cyber attacks in the news, including the Target breach and the Heartbleed security vulnerability. Just this month alone we have seen the Department of Justice indict Chinese soldiers for hacks of American companies. We have seen the breach of up to 145 million emails, birth dates, and passwords from a major Internet commerce site. We have even seen the Department of Homeland Security warned about a successful attack on a public utility that compromised the utility's control system network.
My amendment will not solve all of these problems at once, but it will help policymakers here and in the administration take effective and informed steps to protect our networks from cyber attacks.
So with that, let me again congratulate Chairman Wolf and thank him for his distinguished service to this body.
I urge my colleagues to support this amendment, and I yield back the balance of my time.