§1607 Ntia Program for Preventing Future Vulnerabilities

Summary

Creates a program to give federal information about supply-chain security risks to trusted makers and providers of communications gear and services. The Assistant Secretary of Commerce for Communications and Information must set up the program within 120 days after March 12, 2020, working with the Director of National Intelligence, the FBI Director, the Secretary of Homeland Security, and the Federal Communications Commission. The program must run regular briefings and events, reach out to small and rural providers, and—within 180 days after March 12, 2020—send Congress a plan to declassify useful material when possible and to speed up and widen security clearances so more trusted companies can get risk information. The program should be consistent with work at the Department of Homeland Security and the Department of Commerce. The government will only share information to trusted providers and suppliers; those companies are not required to share back. The FCC must add at least one public or consumer representative to the Communications Security, Reliability, and Interoperability Council and each of its subgroups within 180 days after March 12, 2020; these members are extra to the Council’s March 12, 2020 membership. Definitions used: Assistant Secretary means the Assistant Secretary of Commerce for Communications and Information; trusted means not owned, controlled, or influenced by a foreign adversary; foreign adversary means a foreign government or person that repeatedly or seriously harms U.S. national security or safety; supply-chain security risk includes specific risks and vulnerabilities in equipment and software.