I 
117TH CONGRESS 
1ST SESSION H. R. 2236 
To establish a voluntary program to identify and promote internet-connected 
products that meet industry-leading cybersecurity and data security 
standards, guidelines, best practices, methodologies, procedures, and proc-
esses, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 26, 2021 
Mr. LIEU introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To establish a voluntary program to identify and promote 
internet-connected products that meet industry-leading 
cybersecurity and data security standards, guidelines, 
best practices, methodologies, procedures, and processes, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Shield Act of 
2021’’. 
SEC. 2. DEFINITIONS. 
In this Act— 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(1) the term ‘‘Advisory Committee’’ means the 
Cyber Shield Advisory Committee established by the 
Secretary under section 3(a); 
(2) the term ‘‘benchmarks’’ means standards, 
guidelines, best practices, methodologies, procedures, 
and processes; 
(3) the term ‘‘covered product’’ means a con-
sumer-facing physical object that can— 
(A) connect to the internet or other net-
work; and 
(B)(i) collect, send, or receive data; or 
(ii) control the actions of a physical object 
or system; 
(4) the term ‘‘Cyber Shield program’’ means 
the voluntary program established by the Secretary 
under section 4(a)(1); and 
(5) the term ‘‘Secretary’’ means the Secretary 
of Commerce. 
SEC. 3. CYBER SHIELD ADVISORY COMMITTEE. 
(a) ESTABLISHMENT.—Not later than 90 days after 
the date of enactment of this Act, the Secretary shall es-
tablish the Cyber Shield Advisory Committee. 
(b) DUTIES.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act, the Advisory 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
Committee shall provide recommendations to the 
Secretary regarding— 
(A) the format and content of the Cyber 
Shield labels required to be established under 
section 4; and 
(B) the process for identifying, estab-
lishing, reporting on, adopting, maintaining, 
and promoting compliance with the voluntary 
cybersecurity and data security benchmarks re-
quired to be established under section 4. 
(2) PUBLIC
AVAILABILITY
OF
RECOMMENDA-
TIONS.—The Advisory Committee shall publish, and 
provide the public with an opportunity to comment 
on, the recommendations provided to the Secretary 
under paragraph (1). 
(c) MEMBERS, CHAIR, AND DUTIES.— 
(1) APPOINTMENT.— 
(A) IN
GENERAL.—The Advisory Com-
mittee shall be composed of members appointed 
by the Secretary from among individuals who 
are specially qualified to serve on the Advisory 
Committee based on the education, training, or 
experience of those individuals. 
(B) 
REPRESENTATION.—Members 
ap-
pointed under subparagraph (A) shall include— 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(i) representatives of the covered 
products industry, including small, me-
dium, and large businesses; 
(ii) cybersecurity experts, including 
independent cybersecurity researchers that 
specialize in areas such as cryptanalysis, 
hardware and software security, wireless 
and network security, cloud security, and 
data privacy; 
(iii) public interest advocates; 
(iv) a liaison from the Information Se-
curity and Privacy Advisory Board estab-
lished under section 21(a) of the National 
Institute of Standards and Technology Act 
(15 U.S.C. 278g–4(a)) who is a member of 
that Board as described in paragraph (3) 
of such section 21(a); 
(v) Federal employees with expertise 
in certification, covered devices, or cyberse-
curity, including employees of— 
(I) the Department of Commerce; 
(II) the National Institute of 
Standards and Technology; 
(III) the Federal Trade Commis-
sion; 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(IV) the Federal Communications 
Commission; and 
(V) the Consumer Product Safety 
Commission; and 
(vi) an expert who shall ensure that, 
subject to subsection (e), the Advisory 
Committee conforms to and complies with 
the requirements under the Federal Advi-
sory Committee Act (5 U.S.C. App.). 
(C) LIMITATION.—In appointing members 
under subparagraph (A), the Secretary shall en-
sure that— 
(i) each interest group described in 
clauses (i), (ii), (iii), and (v) of subpara-
graph (B) is proportionally represented on 
the Advisory Committee, including— 
(I) businesses of each size de-
scribed in clause (i) of that subpara-
graph; 
(II) Federal employees with ex-
pertise in each subject described in 
clause (v) of that subparagraph; and 
(III) Federal employees from 
each agency described in subclauses 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(I) through (V) of clause (v) of that 
subparagraph; and 
(ii) no single interest group described 
in clauses (i), (ii), (iii), and (v) of subpara-
graph (B) is represented by a majority of 
the members of the Advisory Committee. 
(2) CHAIR.—The Secretary shall designate a 
member of the Advisory Committee to serve as 
Chair. 
(3) PAY.—Members of the Advisory Committee 
shall serve without pay, except that the Secretary 
may allow a member, while attending meetings of 
the Advisory Committee or a subcommittee of the 
Advisory Committee, per diem, travel, and transpor-
tation expenses authorized under section 5703 of 
title 5, United States Code. 
(d) SUPPORT STAFF; ADMINISTRATIVE SERVICES.— 
(1) SUPPORT STAFF.—The Secretary shall pro-
vide support staff for the Advisory Committee. 
(2) ADMINISTRATIVE SERVICES.—Upon the re-
quest of the Advisory Committee, the Secretary shall 
provide any information, administrative services, and 
supplies that the Secretary considers necessary for 
the Advisory Committee to carry out the duties and 
powers of the Advisory Committee. 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(e) NO TERMINATION.—Section 14 of the Federal 
Advisory Committee Act (5 U.S.C. App.) shall not apply 
to the Advisory Committee. 
(f) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to be appropriated such sums as may be 
necessary to carry out this section. 
SEC. 4. CYBER SHIELD PROGRAM. 
(a) ESTABLISHMENT OF PROGRAM.— 
(1) IN GENERAL.—The Secretary shall establish 
a voluntary program to identify and certify covered 
products through voluntary certification and labeling 
of, and other forms of communication about, covered 
products and subsets of covered products that meet 
industry-leading cybersecurity and data security 
benchmarks to enhance cybersecurity and protect 
data. 
(2) LABELS.—Labels applied to covered prod-
ucts under the Cyber Shield program— 
(A) shall be digital and, if feasible, phys-
ical and affixed to the covered product or pack-
aging; and 
(B) may be in the form of different grades 
that display the extent to which a covered prod-
uct meets the industry-leading cybersecurity 
and data security benchmarks. 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(b) CONSULTATION.—Not later than 90 days after 
the date of enactment of this Act, the Secretary shall es-
tablish a process for consulting interested parties, the Sec-
retary of Health and Human Services, the Commissioner 
of Food and Drugs, the Secretary of Homeland Security, 
and the heads of other Federal agencies in carrying out 
the Cyber Shield program. 
(c) DUTIES.—In carrying out the Cyber Shield pro-
gram, the Secretary— 
(1) shall— 
(A) by convening and consulting interested 
parties and the heads of other Federal agencies, 
establish and maintain cybersecurity and data 
security benchmarks for covered products with 
the Cyber Shield label to ensure that those cov-
ered products perform better than counterparts 
of those covered products that do not have the 
Cyber Shield label; and 
(B) in carrying out subparagraph (A)— 
(i) engage in an open public review 
and comment process; 
(ii) in consultation with the Advisory 
Committee, identify and apply cybersecu-
rity and data security benchmarks to dif-
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(iii) to the extent possible, incorporate 
existing cybersecurity and data security 
benchmarks, such as the baseline of cyber-
security features defined in the document 
entitled ‘‘Core Cybersecurity Feature Base-
line for Securable IoT Devices: A Starting 
Point for IoT Device Manufacturers’’, pub-
lished by the National Institute of Stand-
ards and Technology in July 2019, or any 
successor thereto; 
(2) may not establish any cybersecurity and 
data security benchmark under paragraph (1) that 
is arbitrary, capricious, an abuse of discretion, or 
otherwise not in accordance with law; 
(3) shall permit a manufacturer or distributor 
of a covered product to display a Cyber Shield label 
reflecting the extent to which the covered product 
meets the cybersecurity and data security bench-
marks established under paragraph (1); 
(4) shall promote technologies, practices, and 
policies that— 
(A) are compliant with the cybersecurity 
and data security benchmarks established under 
paragraph (1); and 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(B) the Secretary determines are the pre-
ferred technologies, practices, and policies in 
the marketplace for— 
(i) enhancing cybersecurity; 
(ii) ensuring that cybersecurity is in-
corporated in all aspects of the life cycle of 
a covered product; and 
(iii) protecting data; 
(5) shall work to enhance public awareness of 
the Cyber Shield label, including through public out-
reach, education, research and development, and 
other means; 
(6) shall preserve the integrity of the Cyber 
Shield label; 
(7) if helpful in fulfilling the obligation under 
paragraph (6), may elect to not treat a covered 
product as a covered product certified under the 
Cyber Shield program until the covered product 
meets appropriate conformity standards, which may 
include— 
(A) standards relating to testing by an ac-
credited third-party certifying laboratory or 
other entity in accordance with the Cyber 
Shield program; and 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(B) certification by the laboratory or entity 
described in subparagraph (A) that the covered 
product meets the applicable cybersecurity and 
data security benchmarks established under 
paragraph (1); 
(8) not less frequently than annually after the 
date on which the Secretary establishes cybersecurity 
and data security benchmarks for a covered product 
category under paragraph (1), shall review, and, if 
appropriate, update the cybersecurity and data secu-
rity benchmarks, for that covered product category; 
(9) shall solicit comments from interested par-
ties and the Advisory Committee before establishing 
or revising a Cyber Shield covered product category 
or cybersecurity and data security benchmark (or be-
fore the effective date of the establishment or revi-
sion of a covered product category or cybersecurity 
and data security benchmark); 
(10) upon adoption of a new or revised covered 
product category or cybersecurity and data security 
benchmark, shall provide reasonable notice to inter-
ested parties of any changes (including effective 
dates) to covered product categories or cybersecurity 
and data security benchmarks, along with— 
(A) an explanation of the changes; and 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(B) as appropriate, responses to comments 
submitted by interested parties; 
(11) shall provide appropriate lead time before 
the applicable effective date for a new or a signifi-
cant revision to a covered product category or cyber-
security and data security benchmark, taking into 
account the timing requirements of the manufac-
turing, marketing, and distribution process for any 
covered product addressed; and 
(12) may remove the certification of a covered 
product as a covered product certified under the 
Cyber Shield program if the manufacturer of the 
certified covered product falls out of conformity with 
the benchmarks established under paragraph (1) for 
the covered product, as determined by the Secretary. 
(d) DEADLINES.—Not later than 2 years after the 
date of enactment of this Act, the Secretary shall establish 
cybersecurity and data security benchmarks for covered 
products under subsection (c)(1), which shall take effect 
not later than 60 days after the date on which the Sec-
retary establishes the cybersecurity and data security 
benchmarks. 
(e) ADMINISTRATION.—The Secretary, in consulta-
tion with the Advisory Committee, may enter into a con-
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
tract with a third party to administer the Cyber Shield 
program if— 
(1) the third party is an impartial adminis-
trator; and 
(2) entering into the contract improves the cy-
bersecurity and data security of covered products. 
(f) PROGRAM EVALUATION.— 
(1) IN GENERAL.—Not later than 3 years after 
the date on which the Secretary establishes cyberse-
curity and data security benchmarks for covered 
products under subsection (c)(1), and not less fre-
quently than every 3 years thereafter, the Inspector 
General of the Department of Commerce shall— 
(A) evaluate the Cyber Shield program; 
and 
(B) submit a report on the results of the 
evaluation carried out under subparagraph (A) 
to— 
(i) the Committee on Commerce, 
Science, and Transportation of the Senate; 
and 
(ii) the Committee on Energy and 
Commerce of the House of Representa-
tives. 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS
(2) REQUIREMENTS.—In conducting an evalua-
tion under paragraph (1)(A), the Inspector General 
of the Department of Commerce shall— 
(A) with respect to the cybersecurity and 
data security benchmarks established under 
subsection (c)(1)— 
(i) evaluate the extent to which the 
cybersecurity and data security bench-
marks address cybersecurity and data se-
curity threats; and 
(ii) assess how the cybersecurity and 
data security benchmarks have evolved to 
meet emerging cybersecurity and data se-
curity threats; 
(B) conduct covert testing of covered prod-
ucts to evaluate the integrity of certification 
testing under the Cyber Shield program; 
(C) assess the costs to businesses that 
manufacture covered products of participating 
in the Cyber Shield program; 
(D) evaluate the level of participation in 
the Cyber Shield program by businesses that 
manufacture covered products; 
VerDate Sep 11 2014 
03:00 May 25, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2236.IH
H2236
kjohnson on DSK79L0C42PROD with BILLS