Russia-Ukraine Conflict Could Push Major Cybersecurity Legislation Past Finish Line

Potential fallout from Russia’s invasion of Ukraine could help lawmakers overcome timing and jurisdictional hurdles and pass legislation to require private-sector owners of critical infrastructure to report cybersecurity incidents to the government and to update the Federal Information Security Modernization Act.

“With everything that's happening in Ukraine, I think there's more motivation for people to get some legislation passed,” former Federal Chief Information Security Officer Grant Schneider told Nextgov. “It becomes harder for anyone to fall on their sword over the nuances of any given provision.” 

Schneider, now senior director of cybersecurity services at the law firm Venable, was commenting on the prospects in the House for the Strengthening American Cybersecurity Act, which the Senate passed under unanimous consent Tuesday evening.

The Senate-passed legislation combines three bills that have either previously passed the House in similar form or are on their way to doing so.

Most notable among the bill’s provisions are ones that would require private-sector critical infrastructure entities to report qualifying cybersecurity incidents, including ransomware payments, to the Cybersecurity and Infrastructure Security Agency within 72 hours. Ransomware payments would have to be reported within 24 hours. A similar bill passed the House last year, but the Senate couldn’t quite get there, because of timing constraints, lawmakers said. The Federal Bureau of Investigation had also voiced concerns the bill leaves them out of the incident reporting loop.     

Also included in the Strengthening American Cybersecurity Act are provisions to codify and fund a General Services Administration program for certifying the security of the government’s cloud service providers through independent third-party audits. According to a 2019 Government Accountability Office report, most agencies often weren’t going through GSA’s Federal Risk Authorization Management Program, or FedRAMP, before contracting with cloud vendors. The House has repeatedly passed FedRAMP codification legislation with similar language.

Finally, the bill the Senate passed Tuesday includes lengthy provisions to update the Federal Information Security Modernization Act of 2014. Much of those provisions—including those redefining “major incident” for reporting purposes—are mirrored in legislation recently introduced in the House by Rep. Carolyn Maloney, D-NY., although there was one significant difference.

The House bill called for recognition of the federal chief information security officer and for that official to have authorities for shaping agencies’ cybersecurity budgets. The Senate bill, which comes out of the Homeland Security and Governmental Affairs Committee, does not mention the federal CISO, which operates out of the Office of Management and Budget, under Maloney’s jurisdiction. 

“I congratulate Chairman Peters on Senate passage of the Strengthening American Cybersecurity Act, which contains the Federal Information Security Modernization Act—one of my top legislative priorities,” Maloney, who has been particularly alarmed about the possibility of Russian presence in federal networks, told Nextgov.

“The Committee on Oversight and Reform kicked off 2022 with a bipartisan hearing and markup to examine how best to approach FISMA modernization, and we look forward to incorporating those crucial lessons learned as this effort moves through the legislative process," she added. "FISMA reform will determine our federal cybersecurity posture for years to come, and it is essential that the final bill seizes every opportunity to defend our federal networks from the onslaught of attacks they face daily.  Chairman Peters and I are jointly committed to this goal, and we are certain we’ll succeed in getting this bill to the President’s desk soon.”