PRIA Logo™
119-s-1007119th CongressWALLET

9–8–8 Lifeline Cybersecurity Responsibility Act

Sponsored By: Senator Mullin, Markwayne [R-OK-2]

Introduced

Summary

Strengthen cybersecurity for the 9-8-8 National Suicide Prevention Lifeline. This bill would require the Lifeline program to coordinate with the Department of Health and Human Services Chief Information Security Officer to remove known vulnerabilities and tighten incident and vulnerability reporting.

Show full summary
  • Requires the program to report identified cybersecurity vulnerabilities and incidents to the Assistant Secretary within 24 hours of discovery or receipt.
  • Clarifies oversight between local and regional crisis centers and the program network administrator, and requires centers to report to the network administrator unless a network participation agreement assigns oversight to the network administrator.
  • Creates a dedicated cybersecurity reporting subsection that supplements existing federal law and requires a Comptroller General study within 180 days to evaluate 9-8-8 cybersecurity risks and transmit findings to the House Committee on Energy and Commerce and the Senate Committee on Health, Education, Labor, and Pensions.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

1 provisions identified: 0 benefits, 0 costs, 1 mixed.

New cybersecurity rules for 9-8-8 Lifeline

If enacted, the bill would require Lifeline program staff to coordinate with the HHS Chief Information Security Officer. If enacted, local and regional crisis centers would oversee their own technology. A federally funded network administrator would only oversee a center's technology if the network participation agreement says so. If enacted, centers must tell the network administrator about any cybersecurity vulnerability or incident within 24 hours of identification. The network administrator would report to the Assistant Secretary within 24 hours of learning about a problem. Reports would need to protect personal privacy and would supplement other federal cybersecurity reporting rules. These rules would take effect upon enactment.

Sponsors & CoSponsors

Sponsor

Mullin, Markwayne [R-OK-2]

OK • R

Cosponsors

  • Sen. Padilla, Alex [D-CA]

    CA • D

    Sponsored 3/12/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation