Eshoo pushes for cyber hygiene standards

A new bill would direct the National Institute of Standards and Technology to develop voluntary standards that would help prevent cyber infections on U.S. networks, computer systems and mobile devices.

Rep. Anna Eshoo (D-Calif.), ranking member of the House Energy and Commerce Communications and Technology Subcommittee, reintroduced her legislation aimed at defending U.S. computer networks against common cyberattacks and threats.

The Promoting Good Cyber Hygiene Act would tap NIST, in consultation with the Federal Trade Commission and Department of Homeland Security, to create voluntary standards to protect both private- and public-sector users of information systems and devices against unauthorized access and denials of service.

The bill also directs the three agencies to develop recommendations for networks and systems facing such threats and to conduct a study on the cybersecurity threats facing mobile devices.

The legislation, co-sponsored by Rep. Susan Brooks (R-Ind.), states the recommendations shall be based on President Barack Obama's 2013 executive order entitled "Improving Critical Infrastructure Cybersecurity."

The bill specifically directs NIST to include basic controls agencies can implement and to make use of commercial off-the-shelf products. It  does not "supersede, alter or otherwise affect any cybersecurity requirements applicable to federal agencies."

The standards are to be published and featured prominently on the FTC and Small Business Administration websites and to be reviewed and updated annually by NIST.

A previous iteration of the bill was introduced in the House, but did not gain much legislative traction.

The updated bill text was not immediately available. A spokesperson for Eshoo said her office is "hoping to do a joint release with some members of the Senate side" in the coming days.