II 

118TH CONGRESS 

1ST SESSION S. 513 

To require the Assistant Secretary of Commerce for Communications and 

Information to establish a working group on cyber insurance, to require 

dissemination of informative resources for issuers and customers of cyber 

insurance, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 16, 2023 

Mr. HICKENLOOPER (for himself and Mrs. CAPITO) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require the Assistant Secretary of Commerce for Communications and Information to establish a working group 

on cyber insurance, to require dissemination of informative resources for issuers and customers of cyber insurance, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Insure Cybersecurity 

5 Act of 2023’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 513 IS

1 (1) ASSISTANT SECRETARY.—The term ‘‘Assist2 ant Secretary’’ means the Assistant Secretary of 

3 Commerce for Communications and Information. 

4 (2) CUSTOMER.—The term ‘‘customer’’ means 

5 an individual or organization that purchases cyber 

6 insurance from an issuer. 

7 (3) CYBER INCIDENT.—The term ‘‘cyber inci8 dent’’ has the meaning given the term ‘‘incident’’ in 

9 section 3552(b) of title 44, United States Code. 

10 (4) CYBER INSURANCE.—Subject to section 

11 3(c)(1)(A), the term ‘‘cyber insurance’’ means an in12 surance policy that, whether by explicit inclusion or 

13 by lack of exclusion, offers coverage for losses, dam14 ages, and costs incurred due to cyber incidents. 

15 (5) ISSUER.—The term ‘‘issuer’’ means an or16 ganization that issues cyber insurance. 

17 (6) POLICY.—The term ‘‘policy’’ means a policy 

18 for cyber insurance. 

19 (7) SMALL BUSINESS.—The term ‘‘small busi20 ness’’ has the meaning given the term ‘‘small busi21 ness concern’’ in section 3 of the Small Business Act 

22 (15 U.S.C. 632). 

23 (8) WORKING GROUP.—The term ‘‘working 

24 group’’ means the working group established under 

25 section 3(a). 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 513 IS

1 SEC. 3. WORKING GROUP ON CYBER INSURANCE. 

2 (a) ESTABLISHMENT.—Not later than 90 days after 

3 the date of enactment of this Act, the Assistant Secretary 

4 shall establish a working group on cyber insurance. 

5 (b) COMPOSITION.— 

6 (1) MEMBERSHIP.—The working group shall be 

7 composed of not less than 1 member from each of 

8 the following: 

9 (A) The Cybersecurity and Infrastructure 

10 Security Agency. 

11 (B) The National Institute of Standards 

12 and Technology. 

13 (C) The Department of the Treasury. 

14 (D) The Department of Justice. 

15 (2) CHAIRPERSON.—The Assistant Secretary 

16 shall be the chairperson of the working group. 

17 (c) ACTIVITIES.— 

18 (1) IN GENERAL.—The working group shall 

19 carry out the following activities: 

20 (A) For the purposes of the activities of 

21 the working group, define the term ‘‘cyber in22 surance’’ in a manner that is different from the 

23 definition of that term under section 2(4), if the 

24 working group determines that such a modified 

25 definition is necessary. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 513 IS

1 (B) Analyze and explain in a manner most 

2 understandable to customers the technical and 

3 legal terminology commonly used in policies. 

4 (C) Analyze, and develop recommendations 

5 regarding, provisions in policies that relate to 

6 ransomware and ransom payments made in re7 sponse to ransomware. 

8 (D) Analyze and explain in a manner most 

9 understandable to customers the terminology 

10 used in policies to include or exclude coverage 

11 for losses due to cyber incidents that are caused 

12 by cyberterrorism or acts of war. 

13 (E) Develop recommendations for prospec14 tive customers on ways to effectively evaluate 

15 the types and levels of coverage offered under 

16 a policy. 

17 (F) Develop recommendations for issuers, 

18 agents, and brokers regarding how to provide 

19 and communicate policy provisions that are 

20 clear and easy to understand for customers. 

21 (G) Identify the constraints of issuers in 

22 covering higher amounts of losses and new 

23 cyber risk areas currently not covered, including 

24 reputational damage and intellectual property 

25 lost. 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 513 IS

1 (H) Gather input from issuers on what 

2 measures would improve the ability of those 

3 issuers to offer additional coverage under poli4 cies, including improvements to their actuarial 

5 data, cyber risk data, and information sharing 

6 mechanisms and effective measurement of the 

7 cybersecurity practices of consumers. 

8 (I) Identify the constraints of the market 

9 and why more organizations do not use cyber 

10 insurance as a risk response mechanism. 

11 (J) Develop recommendations for cus12 tomers on how best to use cyber insurance as 

13 a risk response mechanism for cyber risk and 

14 incentives for doing so. 

15 (2) CONSULTATION.—In carrying out the activi16 ties of the working group under paragraph (1), the 

17 working group shall consult with the public in an 

18 open and transparent manner, including by con19 sulting with the following stakeholders: 

20 (A) Issuers. 

21 (B) Insurance agents and brokers with ex22 perience in the sale and distribution of cyber in23 surance. 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 513 IS

1 (C) Representatives of business customers 

2 from multiple sectors and representatives of 

3 small businesses. 

4 (D) Academia. 

5 (E) State insurance regulators with exper6 tise regarding cybersecurity and cyber insur7 ance. 

8 (F) Other individuals or entities with cy9 bersecurity and cyber insurance expertise as the 

10 Assistant Secretary considers appropriate. 

11 (d) REPORT.—Not later than 1 year after the date 

12 on which the working group first convenes, the working 

13 group shall submit to Congress a report regarding the ac14 tivities of the working group under subsection (c) and any 

15 recommendations of the working group. 

16 (e) TERMINATION.—The working group shall termi17 nate upon submission of the report required under sub18 section (d). 

19 (f) RULE OF CONSTRUCTION.—Nothing in this sec20 tion shall be construed to— 

21 (1) require adoption of the recommendations of 

22 the working group; or 

23 (2) provide any authority to any member of the 

24 working group or any other individual to regulate 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 513 IS

1 the business of insurance that is not already pro2 vided under any other provision of law. 

3 SEC. 4. DISSEMINATION OF INFORMATIVE RESOURCES FOR 

4 CYBER INSURANCE STAKEHOLDERS. 

5 (a) IN GENERAL.—Not later than 90 days after the 

6 date on which the working group submits the report re7 quired under section 3(d), the Assistant Secretary shall 

8 disseminate and make publicly available informative re9 sources for cyber insurance stakeholders. 

10 (b) REQUIREMENTS.—The Assistant Secretary shall 

11 ensure that the resources disseminated under subsection 

12 (a)— 

13 (1) incorporate the recommendations included 

14 in the report submitted under section 3(d); 

15 (2) are generally applicable and usable by a 

16 wide range of cyber insurance stakeholders, includ17 ing issuers, agents, brokers, and customers; and 

18 (3) include case studies and specific examples, 

19 where appropriate. 

20 (c) PUBLICATION.—The resources disseminated 

21 under subsection (a) shall be published on the public 

22 website of the National Telecommunications and Informa23 tion Administration. 

24 (d) OUTREACH.—The Assistant Secretary shall con25 duct outreach and coordination activities to promote the 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 513 IS

1 availability of the resources disseminated under subsection 

2 (a) to relevant industry stakeholders and the general pub3 lic. 

4 (e) VOLUNTARY USE.—Nothing in this section may 

5 be construed to require the use of the resources dissemi6 nated under subsection (a). 

Æ 


kjohnson on DSK79L0C42PROD with BILLS