ferent subsets of covered products based 
on, with respect to each such subset— 
(I) any cybersecurity and data 
security risk relating to covered prod-
ucts in the subset; 
(II) the sensitivity of the infor-
mation 
collected, 
transmitted, 
or 
stored by covered products in the sub-
set; 
(III) the functionality of covered 
products in the subset; 
(IV) the security practices and 
testing procedures used in developing 
and manufacturing covered products 
in the subset; 
(V) the level of expertise, quali-
fications, and professional accredita-
tion of the staff employed by the man-
ufacturers of covered products in the 
subset who are responsible for cyber-
security of the covered products; and 
(VI) any other criteria the Advi-
sory Committee and Secretary deter-
mine is necessary and appropriate; 
and 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(iii) to the extent possible, incorporate 
existing cybersecurity and data security 
benchmarks, such as the baseline of cyber-
security features defined in the document 
entitled ‘‘Core Cybersecurity Feature Base-
line for Securable IoT Devices: A Starting 
Point for IoT Device Manufacturers’’, pub-
lished by the National Institute of Stand-
ards and Technology in July 2019, or any 
successor thereto; 
(2) may not establish any cybersecurity and 
data security benchmark under paragraph (1) that 
is arbitrary, capricious, an abuse of discretion, or 
otherwise not in accordance with law; 
(3) shall permit a manufacturer or distributor 
of a covered product to display a Cyber Shield label 
reflecting the extent to which the covered product 
meets the cybersecurity and data security bench-
marks established under paragraph (1); 
(4) shall promote technologies, practices, and 
policies that— 
(A) are compliant with the cybersecurity 
and data security benchmarks established under 
paragraph (1); and 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(B) the Secretary determines are the pre-
ferred technologies, practices, and policies in 
the marketplace for— 
(i) enhancing cybersecurity; 
(ii) ensuring that cybersecurity is in-
corporated in all aspects of the life cycle of 
a covered product; and 
(iii) protecting data; 
(5) shall work to enhance public awareness of 
the Cyber Shield label, including through public out-
reach, education, research and development, and 
other means; 
(6) shall preserve the integrity of the Cyber 
Shield label; 
(7) if helpful in fulfilling the obligation under 
paragraph (6), may elect to not treat a covered 
product as a covered product certified under the 
Cyber Shield program until the covered product 
meets appropriate conformity standards, which may 
include— 
(A) standards relating to testing by an ac-
credited third-party certifying laboratory or 
other entity in accordance with the Cyber 
Shield program; and 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(B) certification by the laboratory or entity 
described in subparagraph (A) that the covered 
product meets the applicable cybersecurity and 
data security benchmarks established under 
paragraph (1); 
(8) not less frequently than annually after the 
date on which the Secretary establishes cybersecurity 
and data security benchmarks for a covered product 
category under paragraph (1), shall review, and, if 
appropriate, update the cybersecurity and data secu-
rity benchmarks, for that covered product category; 
(9) shall solicit comments from interested par-
ties and the Advisory Committee before establishing 
or revising a Cyber Shield covered product category 
or cybersecurity and data security benchmark (or be-
fore the effective date of the establishment or revi-
sion of a covered product category or cybersecurity 
and data security benchmark); 
(10) upon adoption of a new or revised covered 
product category or cybersecurity and data security 
benchmark, shall provide reasonable notice to inter-
ested parties of any changes (including effective 
dates) to covered product categories or cybersecurity 
and data security benchmarks, along with— 
(A) an explanation of the changes; and 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(B) as appropriate, responses to comments 
submitted by interested parties; 
(11) shall provide appropriate lead time before 
the applicable effective date for a new or a signifi-
cant revision to a covered product category or cyber-
security and data security benchmark, taking into 
account the timing requirements of the manufac-
turing, marketing, and distribution process for any 
covered product addressed; and 
(12) may remove the certification of a covered 
product as a covered product certified under the 
Cyber Shield program if the manufacturer of the 
certified covered product falls out of conformity with 
the benchmarks established under paragraph (1) for 
the covered product, as determined by the Secretary. 
(d) DEADLINES.—Not later than 2 years after the 
date of enactment of this Act, the Secretary shall establish 
cybersecurity and data security benchmarks for covered 
products under subsection (c)(1), which shall take effect 
not later than 60 days after the date on which the Sec-
retary establishes the cybersecurity and data security 
benchmarks. 
(e) ADMINISTRATION.—The Secretary, in consulta-
tion with the Advisory Committee, may enter into a con-
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
tract with a third party to administer the Cyber Shield 
program if— 
(1) the third party is an impartial adminis-
trator; and 
(2) entering into the contract improves the cy-
bersecurity and data security of covered products. 
(f) PROGRAM EVALUATION.— 
(1) IN GENERAL.—Not later than 3 years after 
the date on which the Secretary establishes cyberse-
curity and data security benchmarks for covered 
products under subsection (c)(1), and not less fre-
quently than every 3 years thereafter, the Inspector 
General of the Department of Commerce shall— 
(A) evaluate the Cyber Shield program; 
and 
(B) submit a report on the results of the 
evaluation carried out under subparagraph (A) 
to— 
(i) the Committee on Commerce, 
Science, and Transportation of the Senate; 
and 
(ii) the Committee on Energy and 
Commerce of the House of Representa-
tives. 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(2) REQUIREMENTS.—In conducting an evalua-
tion under paragraph (1)(A), the Inspector General 
of the Department of Commerce shall— 
(A) with respect to the cybersecurity and 
data security benchmarks established under 
subsection (c)(1)— 
(i) evaluate the extent to which the 
cybersecurity and data security bench-
marks address cybersecurity and data se-
curity threats; and 
(ii) assess how the cybersecurity and 
data security benchmarks have evolved to 
meet emerging cybersecurity and data se-
curity threats; 
(B) conduct covert testing of covered prod-
ucts to evaluate the integrity of certification 
testing under the Cyber Shield program; 
(C) assess the costs to businesses that 
manufacture covered products of participating 
in the Cyber Shield program; 
(D) evaluate the level of participation in 
the Cyber Shield program by businesses that 
manufacture covered products; 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(E) assess the level of public awareness 
and consumer awareness of the Cyber Shield 
label; 
(F) determine whether any private sector 
or international cybersecurity certification pro-
grams comparable to the Cyber Shield program 
exist; and 
(G) if any private sector or international 
cybersecurity certification programs described 
in subparagraph (F) exist, evaluate how each 
such private sector or international cybersecu-
rity certification program interacts with and 
compares to the Cyber Shield program. 
(g) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to be appropriated such sums as may be 
necessary to carry out this section. 
SEC. 5. CYBER SHIELD DIGITAL COVERED PRODUCT POR-
TAL. 
(a) IN GENERAL.—The Secretary shall make publicly 
available on the website of the Department of Commerce 
in a searchable format— 
(1) a web page providing information about the 
Cyber Shield program; 
(2) a database of covered products certified 
under the Cyber Shield program; and 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
(3) contact information for each manufacturer 
of a covered product certified under the Cyber 
Shield program that may be used by consumers to 
contact the manufacturer regarding questions or 
complaints. 
(b) 
REQUIREMENTS.—The 
database 
established 
under subsection (a)(2) shall include— 
(1) the cybersecurity and data security bench-
marks established under section 4(c)(1) for each 
covered product category; and 
(2) for each covered product certified under the 
Cyber Shield program— 
(A) the certification for the covered prod-
uct; 
(B) the name and manufacturer of the cov-
ered product; 
(C) the contact information for the manu-
facturer of the covered product; 
(D) the functionality of the covered prod-
uct; 
(E) the location of any applicable privacy 
policy; and 
(F) any other information that the Sec-
retary determines to be necessary and appro-
priate. 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS
SEC. 6. RULE OF CONSTRUCTION. 
The decision of a manufacturer of a covered product 
to not participate in the Cyber Shield program shall not 
affect the liability of the manufacturer for a cybersecurity 
or data security breach of that covered product. 
Æ 
VerDate Sep 11 2014 
22:48 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6301
E:\BILLS\H4623.IH
H4623
kjohnson on DSK79L0C42PROD with BILLS