II 

115TH CONGRESS 

1ST SESSION S. 536 

To promote transparency in the oversight of cybersecurity risks at publicly 

traded companies. 

IN THE SENATE OF THE UNITED STATES 

MARCH 7, 2017 

Mr. REED (for himself, Ms. COLLINS, and Mr. WARNER) introduced the following bill; which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs 

A BILL 

To promote transparency in the oversight of cybersecurity 

risks at publicly traded companies. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Disclo5 sure Act of 2017’’. 

6 SEC. 2. CYBERSECURITY TRANSPARENCY. 

7 (a) DEFINITIONS.—In this section— 

8 (1) the term ‘‘Commission’’ means the Securi9 ties and Exchange Commission; 

10 (2) the term ‘‘cybersecurity threat’’— 


lotter on DSK5VPTVN1PROD with BILLS
2 

•S 536 IS

1 (A) means an action, not protected by the 

2 First Amendment to the Constitution of the 

3 United States, on or through an information 

4 system that may result in an unauthorized ef5 fort to adversely impact the security, avail6 ability, confidentiality, or integrity of an infor7 mation system or information that is stored on, 

8 processed by, or transiting an information sys9 tem; and 

10 (B) does not include any action that solely 

11 involves a violation of a consumer term of serv12 ice or a consumer licensing agreement; 

13 (3) the term ‘‘information system’’— 

14 (A) has the meaning given the term in sec15 tion 3502 of title 44, United States Code; and 

16 (B) includes industrial control systems, 

17 such as supervisory control and data acquisition 

18 systems, distributed control systems, and pro19 grammable logic controllers; 

20 (4) the term ‘‘issuer’’ has the meaning given 

21 the term in section 3 of the Securities Exchange Act 

22 of 1934 (15 U.S.C. 78c); 

23 (5) the term ‘‘NIST’’ means the National Insti24 tute of Standards and Technology; and 


lotter on DSK5VPTVN1PROD with BILLS
3 

•S 536 IS

1 (6) the term ‘‘reporting company’’ means any 

2 company that is an issuer— 

3 (A) the securities of which are registered 

4 under section 12 of the Securities Exchange 

5 Act of 1934 (15 U.S.C. 78l); or 

6 (B) that is required to file reports under 

7 section 15(d) of such Act (15 U.S.C. 78o(d)). 

8 (b) REQUIREMENT TO ISSUE RULES.—Not later 

9 than 360 days after the date of enactment of this Act, 

10 the Commission shall issue final rules to require each re11 porting company, in the annual report submitted under 

12 section 13 or section 15(d) of the Securities Exchange Act 

13 of 1934 (15 U.S.C. 78m and 78o(d)) or the annual proxy 

14 statement submitted under section 14(a) of such Act (15 

15 U.S.C. 78n(a))— 

16 (1) to disclose whether any member of the gov17 erning body, such as the board of directors or gen18 eral partner, of the reporting company has expertise 

19 or experience in cybersecurity and in such detail as 

20 necessary to fully describe the nature of the exper21 tise or experience; and 

22 (2) if no member of the governing body of the 

23 reporting company has expertise or experience in cy24 bersecurity, to describe what other cybersecurity 

25 steps taken by the reporting company were taken 


lotter on DSK5VPTVN1PROD with BILLS
4 

•S 536 IS

1 into account by such persons responsible for identi2 fying and evaluating nominees for any member of 

3 the governing body, such as a nominating com4 mittee. 

5 (c) CYBERSECURITY EXPERTISE OR EXPERIENCE.— 

6 For purposes of subsection (b), the Commission, in con7 sultation with NIST, shall define what constitutes exper8 tise or experience in cybersecurity, such as professional 

9 qualifications to administer information security program 

10 functions or experience detecting, preventing, mitigating, 

11 or addressing cybersecurity threats, using commonly de12 fined roles, specialities, knowledge, skills, and abilities, 

13 such as those provided in NIST Special Publication 800– 

14 181 entitled ‘‘NICE Cybersecurity Workforce Frame15 work’’, or any successor thereto. 

Æ 


lotter on DSK5VPTVN1PROD with BILLS