PRIA Logo™
119-s-5508119th CongressWALLET

Telecommunications Cybersecurity and Resilience Act

Sponsored By: Senator Warner, Mark R. [D-VA]

Introduced

Summary

Voluntary industry-led cybersecurity standards and third‑party certification for the telecommunications sector. This bill would create an NTIA-hosted public–private Working Group to develop risk‑based Industry Best Practices and a network of independent assessors to certify telecom carriers and supply‑chain participants.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 2 benefits, 0 costs, 1 mixed.

Voluntary telecom cybersecurity practices

If enacted, a federal working group would publish voluntary, risk-based telecom cybersecurity best practices within 18 months. The practices would be posted on NTIA’s website and updated at least every 2 years. The guidance could list examples like security updates, decommissioning unsupported devices, secure configuration baselines, and stronger sign-in controls. The Assistant Secretary, with CISA, could withhold detailed implementation guidance from public release to reduce risk, but that withheld guidance would be available to eligible companies and certified assessors.

Certification, assessors, and legal rules

If enacted, the bill would create a voluntary third-party certification system and criteria for independent assessors. The Assistant Secretary would approve assessors, publish designated lists, and could bar companies owned by carriers from being assessors. Certification submissions must be checked for completeness within 30 days, and decisions would be due within 90 days. Approved certifications would last up to 2 years and require ongoing implementation of the practices while certified. Certification can give a legal defense if the certified company followed the practices, but certifications can be suspended, reassessed, or revoked for material failures. An early reassessment could be ordered and, if it finds failure, the certified entity would pay reassessment costs. States could not enforce cybersecurity rules that conflict with the Act for certified entities.

Protections for employees who report problems

If enacted, employees of eligible cybersecurity assessors and telecom carriers with approved or pending certification would be protected from firing or other retaliation for lawfully helping an investigation. The protection covers reports the employee reasonably believes show non-compliance or false claims about certification. Covered reports may be made to specified federal agencies, Members or committees of Congress, or a supervisor.

Sponsors & CoSponsors

Sponsor

Warner, Mark R. [D-VA]

VA • D

Cosponsors

  • Sen. Cruz, Ted [R-TX]

    TX • R

    Sponsored 9/24/2026

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation