II 

117TH CONGRESS 

1ST SESSION S. 965 

To establish a voluntary program to identify and promote internet-connected 

products that meet industry-leading cybersecurity and data security 

standards, guidelines, best practices, methodologies, procedures, and processes, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 25, 2021 

Mr. MARKEY introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To establish a voluntary program to identify and promote 

internet-connected products that meet industry-leading 

cybersecurity and data security standards, guidelines, 

best practices, methodologies, procedures, and processes, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cyber Shield Act of 

5 2021’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act— 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 965 IS

1 (1) the term ‘‘Advisory Committee’’ means the 

2 Cyber Shield Advisory Committee established by the 

3 Secretary under section 3(a); 

4 (2) the term ‘‘benchmarks’’ means standards, 

5 guidelines, best practices, methodologies, procedures, 

6 and processes; 

7 (3) the term ‘‘covered product’’ means a con8 sumer-facing physical object that can— 

9 (A) connect to the internet or other net10 work; and 

11 (B)(i) collect, send, or receive data; or 

12 (ii) control the actions of a physical object 

13 or system; 

14 (4) the term ‘‘Cyber Shield program’’ means 

15 the voluntary program established by the Secretary 

16 under section 4(a)(1); and 

17 (5) the term ‘‘Secretary’’ means the Secretary 

18 of Commerce. 

19 SEC. 3. CYBER SHIELD ADVISORY COMMITTEE. 

20 (a) ESTABLISHMENT.—Not later than 90 days after 

21 the date of enactment of this Act, the Secretary shall es22 tablish the Cyber Shield Advisory Committee. 

23 (b) DUTIES.— 

24 (1) IN GENERAL.—Not later than 1 year after 

25 the date of enactment of this Act, the Advisory 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 965 IS

1 Committee shall provide recommendations to the 

2 Secretary regarding— 

3 (A) the format and content of the Cyber 

4 Shield labels required to be established under 

5 section 4; and 

6 (B) the process for identifying, estab7 lishing, reporting on, adopting, maintaining, 

8 and promoting compliance with the voluntary 

9 cybersecurity and data security benchmarks re10 quired to be established under section 4. 

11 (2) PUBLIC AVAILABILITY OF RECOMMENDA12 TIONS.—The Advisory Committee shall publish, and 

13 provide the public with an opportunity to comment 

14 on, the recommendations provided to the Secretary 

15 under paragraph (1). 

16 (c) MEMBERS, CHAIR, AND DUTIES.— 

17 (1) APPOINTMENT.— 

18 (A) IN GENERAL.—The Advisory Com19 mittee shall be composed of members appointed 

20 by the Secretary from among individuals who 

21 are specially qualified to serve on the Advisory 

22 Committee based on the education, training, or 

23 experience of those individuals. 

24 (B) REPRESENTATION.—Members ap25 pointed under subparagraph (A) shall include— 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 965 IS

1 (i) representatives of the covered 

2 products industry, including small, me3 dium, and large businesses; 

4 (ii) cybersecurity experts, including 

5 independent cybersecurity researchers that 

6 specialize in areas such as cryptanalysis, 

7 hardware and software security, wireless 

8 and network security, cloud security, and 

9 data privacy; 

10 (iii) public interest advocates; 

11 (iv) a liaison from the Information Se12 curity and Privacy Advisory Board estab13 lished under section 21(a) of the National 

14 Institute of Standards and Technology Act 

15 (15 U.S.C. 278g–4(a)) who is a member of 

16 that Board as described in paragraph (3) 

17 of such section 21(a); 

18 (v) Federal employees with expertise 

19 in certification, covered devices, or cyberse20 curity, including employees of— 

21 (I) the Department of Commerce; 

22 (II) the National Institute of 

23 Standards and Technology; 

24 (III) the Federal Trade Commis25 sion; 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 965 IS

1 (IV) the Federal Communications 

2 Commission; and 

3 (V) the Consumer Product Safety 

4 Commission; and 

5 (vi) an expert who shall ensure that, 

6 subject to subsection (e), the Advisory 

7 Committee conforms to and complies with 

8 the requirements under the Federal Advi9 sory Committee Act (5 U.S.C. App.). 

10 (C) LIMITATION.—In appointing members 

11 under subparagraph (A), the Secretary shall en12 sure that— 

13 (i) each interest group described in 

14 clauses (i), (ii), (iii), and (v) of subpara15 graph (B) is proportionally represented on 

16 the Advisory Committee, including— 

17 (I) businesses of each size de18 scribed in clause (i) of that subpara19 graph; 

20 (II) Federal employees with ex21 pertise in each subject described in 

22 clause (v) of that subparagraph; and 

23 (III) Federal employees from 

24 each agency described in subclauses 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 965 IS

1 (I) through (V) of clause (v) of that 

2 subparagraph; and 

3 (ii) no single interest group described 

4 in clause (i), (ii), (iii), or (v) of subpara5 graph (B) is represented by a majority of 

6 the members of the Advisory Committee. 

7 (2) CHAIR.—The Secretary shall designate a 

8 member of the Advisory Committee to serve as 

9 Chair. 

10 (3) PAY.—Members of the Advisory Committee 

11 shall serve without pay, except that the Secretary 

12 may allow a member, while attending meetings of 

13 the Advisory Committee or a subcommittee of the 

14 Advisory Committee, per diem, travel, and transpor15 tation expenses authorized under section 5703 of 

16 title 5, United States Code. 

17 (d) SUPPORT STAFF; ADMINISTRATIVE SERVICES.— 

18 (1) SUPPORT STAFF.—The Secretary shall pro19 vide support staff for the Advisory Committee. 

20 (2) ADMINISTRATIVE SERVICES.—Upon the re21 quest of the Advisory Committee, the Secretary shall 

22 provide any information, administrative services, and 

23 supplies that the Secretary considers necessary for 

24 the Advisory Committee to carry out the duties and 

25 powers of the Advisory Committee. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 965 IS

1 (e) NO TERMINATION.—Section 14 of the Federal 

2 Advisory Committee Act (5 U.S.C. App.) shall not apply 

3 to the Advisory Committee. 

4 (f) AUTHORIZATION OF APPROPRIATIONS.—There 

5 are authorized to be appropriated such sums as may be 

6 necessary to carry out this section. 

7 SEC. 4. CYBER SHIELD PROGRAM. 

8 (a) ESTABLISHMENT OF PROGRAM.— 

9 (1) IN GENERAL.—The Secretary shall establish 

10 a voluntary program to identify and certify covered 

11 products through voluntary certification and labeling 

12 of, and other forms of communication about, covered 

13 products and subsets of covered products that meet 

14 industry-leading cybersecurity and data security 

15 benchmarks to enhance cybersecurity and protect 

16 data. 

17 (2) LABELS.—Labels applied to covered prod18 ucts under the Cyber Shield program— 

19 (A) shall be digital and, if feasible, phys20 ical and affixed to the covered product or pack21 aging; and 

22 (B) may be in the form of different grades 

23 that display the extent to which a covered prod24 uct meets the industry-leading cybersecurity 

25 and data security benchmarks. 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 965 IS

1 (b) CONSULTATION.—Not later than 90 days after 

2 the date of enactment of this Act, the Secretary shall es3 tablish a process for consulting interested parties, the Sec4 retary of Health and Human Services, the Commissioner 

5 of Food and Drugs, the Secretary of Homeland Security, 

6 and the heads of other Federal agencies in carrying out 

7 the Cyber Shield program. 

8 (c) DUTIES.—In carrying out the Cyber Shield pro9 gram, the Secretary— 

10 (1) shall— 

11 (A) by convening and consulting interested 

12 parties and the heads of other Federal agencies, 

13 establish and maintain cybersecurity and data 

14 security benchmarks for covered products with 

15 the Cyber Shield label to ensure that those cov16 ered products perform better than counterparts 

17 of those covered products that do not have the 

18 Cyber Shield label; and 

19 (B) in carrying out subparagraph (A)— 

20 (i) engage in an open public review 

21 and comment process; 

22 (ii) in consultation with the Advisory 

23 Committee, identify and apply cybersecu24 rity and data security benchmarks to difVerDate Sep 11 2014 22:03 Apr 18, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S965.IS S965

kjohnson on DSK79L0C42PROD with BILLS
9 

•S 965 IS

1 ferent subsets of covered products based 

2 on, with respect to each such subset— 

3 (I) any cybersecurity and data 

4 security risk relating to covered prod5 ucts in the subset; 

6 (II) the sensitivity of the infor7 mation collected, transmitted, or 

8 stored by covered products in the sub9 set; 

10 (III) the functionality of covered 

11 products in the subset; 

12 (IV) the security practices and 

13 testing procedures used in developing 

14 and manufacturing covered products 

15 in the subset; 

16 (V) the level of expertise, quali17 fications, and professional accredita18 tion of the staff employed by the man19 ufacturers of covered products in the 

20 subset who are responsible for cyber21 security of the covered products; and 

22 (VI) any other criteria the Advi23 sory Committee and Secretary deter24 mine is necessary and appropriate; 

25 and 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 965 IS

1 (iii) to the extent possible, incorporate 

2 existing cybersecurity and data security 

3 benchmarks, such as the baseline of cyber4 security features defined in the document 

5 entitled ‘‘Core Cybersecurity Feature Base6 line for Securable IoT Devices: A Starting 

7 Point for IoT Device Manufacturers’’, pub8 lished by the National Institute of Stand9 ards and Technology in July 2019, or any 

10 successor thereto; 

11 (2) may not establish any cybersecurity and 

12 data security benchmark under paragraph (1) that 

13 is arbitrary, capricious, an abuse of discretion, or 

14 otherwise not in accordance with law; 

15 (3) shall permit a manufacturer or distributor 

16 of a covered product to display a Cyber Shield label 

17 reflecting the extent to which the covered product 

18 meets the cybersecurity and data security bench19 marks established under paragraph (1); 

20 (4) shall promote technologies, practices, and 

21 policies that— 

22 (A) are compliant with the cybersecurity 

23 and data security benchmarks established under 

24 paragraph (1); and 


kjohnson on DSK79L0C42PROD with BILLS
11 

•S 965 IS

1 (B) the Secretary determines are the pre2 ferred technologies, practices, and policies in 

3 the marketplace for— 

4 (i) enhancing cybersecurity; 

5 (ii) ensuring that cybersecurity is in6 corporated in all aspects of the life cycle of 

7 a covered product; and 

8 (iii) protecting data; 

9 (5) shall work to enhance public awareness of 

10 the Cyber Shield label, including through public out11 reach, education, research and development, and 

12 other means; 

13 (6) shall preserve the integrity of the Cyber 

14 Shield label; 

15 (7) if helpful in fulfilling the obligation under 

16 paragraph (6), may elect to not treat a covered 

17 product as a covered product certified under the 

18 Cyber Shield program until the covered product 

19 meets appropriate conformity standards, which may 

20 include— 

21 (A) standards relating to testing by an ac22 credited third-party certifying laboratory or 

23 other entity in accordance with the Cyber 

24 Shield program; and 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 965 IS

1 (B) certification by the laboratory or entity 

2 described in subparagraph (A) that the covered 

3 product meets the applicable cybersecurity and 

4 data security benchmarks established under 

5 paragraph (1); 

6 (8) not less frequently than annually after the 

7 date on which the Secretary establishes cybersecurity 

8 and data security benchmarks for a covered product 

9 category under paragraph (1), shall review, and, if 

10 appropriate, update the cybersecurity and data secu11 rity benchmarks for, that covered product category; 

12 (9) shall solicit comments from interested par13 ties and the Advisory Committee before establishing 

14 or revising a Cyber Shield covered product category 

15 or cybersecurity and data security benchmark (or be16 fore the effective date of the establishment or revi17 sion of a covered product category or cybersecurity 

18 and data security benchmark); 

19 (10) upon adoption of a new or revised covered 

20 product category or cybersecurity and data security 

21 benchmark, shall provide reasonable notice to inter22 ested parties of any changes (including effective 

23 dates) to covered product categories or cybersecurity 

24 and data security benchmarks, along with— 

25 (A) an explanation of the changes; and 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 965 IS

1 (B) as appropriate, responses to comments 

2 submitted by interested parties; 

3 (11) shall provide appropriate lead time before 

4 the applicable effective date for a new or a signifi5 cant revision to a covered product category or cyber6 security and data security benchmark, taking into 

7 account the timing requirements of the manufac8 turing, marketing, and distribution process for any 

9 covered product addressed; and 

10 (12) may remove the certification of a covered 

11 product as a covered product certified under the 

12 Cyber Shield program if the manufacturer of the 

13 certified covered product falls out of conformity with 

14 the benchmarks established under paragraph (1) for 

15 the covered product, as determined by the Secretary. 

16 (d) DEADLINES.—Not later than 2 years after the 

17 date of enactment of this Act, the Secretary shall establish 

18 cybersecurity and data security benchmarks for covered 

19 products under subsection (c)(1), which shall take effect 

20 not later than 60 days after the date on which the Sec21 retary establishes the cybersecurity and data security 

22 benchmarks. 

23 (e) ADMINISTRATION.—The Secretary, in consulta24 tion with the Advisory Committee, may enter into a conVerDate Sep 11 2014 22:03 Apr 18, 2021 Jkt 019200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S965.IS S965

kjohnson on DSK79L0C42PROD with BILLS
14 

•S 965 IS

1 tract with a third party to administer the Cyber Shield 

2 program if— 

3 (1) the third party is an impartial adminis4 trator; and 

5 (2) entering into the contract improves the cy6 bersecurity and data security of covered products. 

7 (f) PROGRAM EVALUATION.— 

8 (1) IN GENERAL.—Not later than 3 years after 

9 the date on which the Secretary establishes cyberse10 curity and data security benchmarks for covered 

11 products under subsection (c)(1), and not less fre12 quently than every 3 years thereafter, the Inspector 

13 General of the Department of Commerce shall— 

14 (A) evaluate the Cyber Shield program; 

15 and 

16 (B) submit a report on the results of the 

17 evaluation carried out under subparagraph (A) 

18 to— 

19 (i) the Committee on Commerce, 

20 Science, and Transportation of the Senate; 

21 and 

22 (ii) the Committee on Energy and 

23 Commerce of the House of Representa24 tives. 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 965 IS

1 (2) REQUIREMENTS.—In conducting an evalua2 tion under paragraph (1)(A), the Inspector General 

3 of the Department of Commerce shall— 

4 (A) with respect to the cybersecurity and 

5 data security benchmarks established under 

6 subsection (c)(1)— 

7 (i) evaluate the extent to which the 

8 cybersecurity and data security bench9 marks address cybersecurity and data se10 curity threats; and 

11 (ii) assess how the cybersecurity and 

12 data security benchmarks have evolved to 

13 meet emerging cybersecurity and data se14 curity threats; 

15 (B) conduct covert testing of covered prod16 ucts to evaluate the integrity of certification 

17 testing under the Cyber Shield program; 

18 (C) assess the costs to businesses that 

19 manufacture covered products participating in 

20 the Cyber Shield program; 

21 (D) evaluate the level of participation in 

22 the Cyber Shield program by businesses that 

23 manufacture covered products; 


kjohnson on DSK79L0C42PROD with BILLS
16 

•S 965 IS

1 (E) assess the level of public awareness 

2 and consumer awareness of the Cyber Shield 

3 label; 

4 (F) determine whether any private sector 

5 or international cybersecurity certification pro6 grams comparable to the Cyber Shield program 

7 exist; and 

8 (G) if any private sector or international 

9 cybersecurity certification programs described 

10 in subparagraph (F) exist, evaluate how each 

11 such private sector or international cybersecu12 rity certification program interacts with and 

13 compares to the Cyber Shield program. 

14 (g) AUTHORIZATION OF APPROPRIATIONS.—There 

15 are authorized to be appropriated such sums as may be 

16 necessary to carry out this section. 

17 SEC. 5. CYBER SHIELD DIGITAL COVERED PRODUCT POR18 TAL. 

19 (a) IN GENERAL.—The Secretary shall make publicly 

20 available on the website of the Department of Commerce 

21 in a searchable format— 

22 (1) a web page providing information about the 

23 Cyber Shield program; 

24 (2) a database of covered products certified 

25 under the Cyber Shield program; and 


kjohnson on DSK79L0C42PROD with BILLS
17 

•S 965 IS

1 (3) contact information for each manufacturer 

2 of a covered product certified under the Cyber 

3 Shield program that may be used by consumers to 

4 contact the manufacturer regarding questions or 

5 complaints. 

6 (b) REQUIREMENTS.—The database established 

7 under subsection (a)(2) shall include— 

8 (1) the cybersecurity and data security bench9 marks established under section 4(c)(1) for each 

10 covered product category; and 

11 (2) for each covered product certified under the 

12 Cyber Shield program— 

13 (A) the certification for the covered prod14 uct; 

15 (B) the name and manufacturer of the cov16 ered product; 

17 (C) the contact information for the manu18 facturer of the covered product; 

19 (D) the functionality of the covered prod20 uct; 

21 (E) the location of any applicable privacy 

22 policy; and 

23 (F) any other information that the Sec24 retary determines to be necessary and appro25 priate. 


kjohnson on DSK79L0C42PROD with BILLS
18 

•S 965 IS

1 SEC. 6. RULE OF CONSTRUCTION. 

2 The decision of a manufacturer of a covered product 

3 to not participate in the Cyber Shield program shall not 

4 affect the liability of the manufacturer for a cybersecurity 

5 or data security breach of that covered product. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS