To express the sense of Congress that information security is critical to the economic security of the United States and to direct the Assistant Secretary of Commerce for Communications and Information to submit to Congress a report on the costs of information security.

To express the sense of Congress that information security is critical to the economic security of the United States and to direct the Assistant Secretary of Commerce for Communications and Information to submit to Congress a report on the costs of information security. 1. Sense of Congress on information security It is the sense of Congress that— (1) information is vital to all industries of the United States for domestic and international commerce; (2) the modern United States economy relies increasingly on digital information systems; and (3) information security is therefore critical to the economic security of the United States and should be protected in a manner that continues to promote economic growth. 2. NTIA report on costs of information security to United States economy (a) In general Not later than 2 years after the date of the enactment of this Act, the Assistant Secretary of Commerce for Communications and Information shall submit to Congress a report on the direct and indirect costs of information security to the economy of the United States. In preparing such report, the Assistant Secretary shall use existing commercial indices and other publicly available information. (b) Required considerations The report required by subsection (a) shall contain an estimate of the costs described in such subsection. In preparing such estimate, the Assistant Secretary shall consider costs that include the cost of— (1) keeping information systems secure; (2) actions necessary to mitigate compromise of information systems; (3) measures used to hedge against such compromise; and (4) economic loss or harm caused by such compromise. 3. Definitions In this Act: (1) Information security The term information security (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity; (B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; (C) availability, which means ensuring timely and reliable access to and use of information; and (D) authentication, which means utilizing digital credentials to assure the identity of users and validate their access. (2) Information system The term information system (A) networks and computers and other network-enabled devices; (B) ancillary equipment; (C) software, firmware, and related procedures; (D) services, including support services; and (E) related resources.

Summary: This bill expresses the sense of Congress that information security is critical to U.S. economic security and should be protected to promote economic growth. The National Telecommunications and Information Administration must report on the costs to the U.S. economy of protecting information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction to provide information integrity, confidentiality, timely and reliable access, and authentication through digital credentials. The report must estimate the cost of: (1) security for computers, networks, software, storage systems, data transmission, equipment, and support services; (2) measures to mitigate and hedge against compromises of information systems; and (3) economic loss or harm caused by such compromises.