II 

119TH CONGRESS 

1ST SESSION S. 245 

To require the Assistant Secretary of Commerce for Communications and 

Information to establish a working group on cyber insurance, to require 

dissemination of informative resources for issuers and customers of cyber 

insurance, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 24, 2025 

Mr. HICKENLOOPER (for himself and Mrs. CAPITO) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require the Assistant Secretary of Commerce for Communications and Information to establish a working group 

on cyber insurance, to require dissemination of informative resources for issuers and customers of cyber insurance, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Insure Cybersecurity 

5 Act of 2025’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 245 IS

1 (1) ASSISTANT SECRETARY.—The term ‘‘Assist2 ant Secretary’’ means the Assistant Secretary of 

3 Commerce for Communications and Information. 

4 (2) CRITICAL INFRASTRUCTURE.—The term 

5 ‘‘critical infrastructure’’ has the meaning given the 

6 term in subsection (e) of the Critical Infrastructures 

7 Protection Act of 2001 (42 U.S.C. 5195c). 

8 (3) CUSTOMER.—The term ‘‘customer’’ means 

9 an individual or organization that purchases cyber 

10 insurance from an issuer. 

11 (4) CYBER INCIDENT.—The term ‘‘cyber inci12 dent’’ has the meaning given the term ‘‘incident’’ in 

13 section 3552(b) of title 44, United States Code. 

14 (5) CYBER INSURANCE.—Subject to section 

15 3(c)(1)(A), the term ‘‘cyber insurance’’ means an in16 surance policy that includes coverage for losses, 

17 damages, and costs incurred due to cyber incidents. 

18 (6) ISSUER.—The term ‘‘issuer’’ means an or19 ganization that issues cyber insurance. 

20 (7) POLICY.—The term ‘‘policy’’ means a policy 

21 for cyber insurance. 

22 (8) SMALL BUSINESS.—The term ‘‘small busi23 ness’’ has the meaning given the term ‘‘small busi24 ness concern’’ in section 3 of the Small Business Act 

25 (15 U.S.C. 632). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 245 IS

1 (9) WORKING GROUP.—The term ‘‘working 

2 group’’ means the working group established under 

3 section 3(a). 

4 SEC. 3. WORKING GROUP ON CYBER INSURANCE. 

5 (a) ESTABLISHMENT.—Not later than 90 days after 

6 the date of enactment of this Act, the Assistant Secretary 

7 shall establish a working group on cyber insurance. 

8 (b) COMPOSITION.— 

9 (1) MEMBERSHIP.—The working group shall be 

10 composed of the following members: 

11 (A) Not less than 1 member from each of 

12 the following: 

13 (i) The Cybersecurity and Infrastruc14 ture Security Agency. 

15 (ii) The National Institute of Stand16 ards and Technology. 

17 (iii) The Department of the Treasury. 

18 (iv) The Department of Justice. 

19 (v) The Federal Trade Commission. 

20 (B) Not less than 1 State insurance regu21 lator with expertise regarding cybersecurity and 

22 cyber insurance. 

23 (2) CHAIRPERSON.—The Assistant Secretary 

24 shall be the chairperson of the working group. 

25 (c) ACTIVITIES.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 245 IS

1 (1) IN GENERAL.—The working group shall 

2 carry out the following activities: 

3 (A) For the purposes of the activities of 

4 the working group, define the term ‘‘cyber in5 surance’’ in a manner that is different from the 

6 definition of that term under section 2(5), if the 

7 working group determines that such a modified 

8 definition is necessary. 

9 (B) Analyze and explain in a manner un10 derstandable to customers the technical and 

11 legal terminology commonly used in policies. 

12 (C) Analyze and explain in a manner un13 derstandable to customers how provisions in 

14 policies correspond to common types of cyber 

15 incidents, including those involving ransomware. 

16 (D) Analyze and explain in a manner un17 derstandable to customers how provisions in 

18 policies correspond to common customer re19 sponses to cyber incidents, including with re20 spect to system recovery and potential ransom 

21 payments. 

22 (E) Analyze and explain in a manner un23 derstandable to customers the terminology used 

24 in policies to include or exclude coverage for 

25 losses due to cyber incidents. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 245 IS

1 (F) Analyze and explain in a manner un2 derstandable to customers the constraints faced 

3 by issuers in covering higher amounts of losses 

4 and cyber risk areas, such as reputational dam5 age and the loss of intellectual property. 

6 (G) Develop information for customers on 

7 ways to effectively evaluate the types and levels 

8 of coverage offered under a policy. 

9 (H) Develop information for issuers, 

10 agents, and brokers regarding how to provide 

11 and communicate policy provisions that are 

12 clear and easy to understand for customers. 

13 (I) Gather input from issuers on what 

14 measures could improve the ability of those 

15 issuers to offer additional coverage under poli16 cies, including— 

17 (i) improvements to their actuarial 

18 data and cyber risk data; 

19 (ii) the development of effective infor20 mation sharing mechanisms; and 

21 (iii) accurate measurement of the cy22 bersecurity practices of customers. 

23 (J) Identify what measures could reduce 

24 the cost of policies and reduce the amount of 

25 cyber risk and the number of cyber incidents. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 245 IS

1 (K) Develop recommendations for cus2 tomers on how best to use cyber insurance and 

3 the benefits of doing so. 

4 (2) CONSULTATION.—In carrying out the activi5 ties of the working group under paragraph (1), the 

6 working group shall consult with the public in an 

7 open and transparent manner, including by con8 sulting with the following stakeholders: 

9 (A) Issuers. 

10 (B) Insurance agents and brokers with ex11 perience in the sale and distribution of cyber in12 surance. 

13 (C) Representatives of business customers 

14 from multiple sectors and representatives of 

15 small businesses. 

16 (D) Academia. 

17 (E) State insurance regulators with exper18 tise regarding cybersecurity and cyber insur19 ance. 

20 (F) Owners and operators of critical infra21 structure. 

22 (G) Other individuals or entities with cy23 bersecurity and cyber insurance expertise as the 

24 Assistant Secretary considers appropriate. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 245 IS

1 (d) REPORT.—Not later than 1 year after the date 

2 on which the working group first convenes, the working 

3 group shall submit to Congress a report regarding the ac4 tivities of the working group under subsection (c) and any 

5 recommendations of the working group. 

6 (e) TERMINATION.—The working group shall termi7 nate upon submission of the report required under sub8 section (d). 

9 (f) RULE OF CONSTRUCTION.—Nothing in this sec10 tion shall be construed to— 

11 (1) require adoption of the recommendations of 

12 the working group; or 

13 (2) provide any authority to any member of the 

14 working group or any other individual to regulate 

15 the business of insurance that is not already pro16 vided under any other provision of law. 

17 SEC. 4. DISSEMINATION OF INFORMATIVE RESOURCES FOR 

18 CYBER INSURANCE STAKEHOLDERS. 

19 (a) IN GENERAL.—Not later than 90 days after the 

20 date on which the working group submits the report re21 quired under section 3(d), the Assistant Secretary shall 

22 disseminate and make publicly available informative re23 sources for cyber insurance stakeholders. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 245 IS

1 (b) REQUIREMENTS.—The Assistant Secretary shall 

2 ensure that the resources disseminated under subsection 

3 (a)— 

4 (1) incorporate the recommendations included 

5 in the report submitted under section 3(d); 

6 (2) are generally applicable and usable by a 

7 wide range of cyber insurance stakeholders, includ8 ing issuers, agents, brokers, and customers; and 

9 (3) include case studies and specific examples, 

10 where appropriate. 

11 (c) PUBLICATION.—The resources disseminated 

12 under subsection (a) shall be published on the public 

13 website of the National Telecommunications and Informa14 tion Administration. 

15 (d) OUTREACH.—The Assistant Secretary shall con16 duct outreach and coordination activities to promote the 

17 availability of the resources disseminated under subsection 

18 (a) to relevant industry stakeholders and the general pub19 lic. 

20 (e) VOLUNTARY USE.—Nothing in this section may 

21 be construed to require the use of the resources dissemi22 nated under subsection (a). 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB