(III) Federal employees from 
each agency described in such clause 
(iv); and 
(ii) no single interest group is rep-
resented by a majority of the members of 
the Advisory Committee. 
(2) CHAIR.—The Secretary shall designate a 
member of the Advisory Committee to serve as 
Chair. 
(3) PAY.—Members of the Advisory Committee 
shall serve without pay, except that the Secretary 
may allow a member, while attending meetings of 
the Advisory Committee or a subcommittee of the 
Advisory Committee, expenses authorized under sec-
tion 5703 of title 5, United States Code, relating to 
per diem, travel, and transportation. 
(d) SUPPORT STAFF; ADMINISTRATIVE SERVICES.— 
(1) SUPPORT STAFF.—The Secretary shall pro-
vide support staff for the Advisory Committee. 
(2) ADMINISTRATIVE SERVICES.—Upon request 
by the Advisory Committee, the Secretary shall pro-
vide any information, administrative services, and 
supplies that the Secretary considers necessary for 
the Advisory Committee to carry out its duties and 
powers. 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(e) NO TERMINATION.—Section 14 of the Federal 
Advisory Committee Act (5 U.S.C. App.) shall not apply 
to the Advisory Committee. 
SEC. 4. CYBER SHIELD PROGRAM. 
(a) ESTABLISHMENT OF PROGRAM.— 
(1) IN GENERAL.—The Secretary shall establish 
a voluntary program to identify and certify covered 
products with superior cybersecurity and data secu-
rity through voluntary certification and labeling of, 
and other forms of communication about, covered 
products and subsets of covered products that meet 
industry-leading cybersecurity and data security 
benchmarks to enhance cybersecurity and protect 
data. 
(2) GRADES.—Labels applied to products under 
the Cyber Shield program— 
(A) may be digital; and 
(B) may be in the form of different grades 
that display the extent to which a product 
meets the industry-leading cybersecurity and 
data security benchmarks. 
(b) CONSULTATION.—Not later than 90 days after 
the date of enactment of this Act, the Secretary shall es-
tablish a process for consulting interested parties, the Sec-
retary of Health and Human Services, the Commissioner 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
of Food and Drugs, the Secretary of Homeland Security, 
and other Federal agencies in carrying out the Cyber 
Shield program. 
(c) DUTIES.—In carrying out the Cyber Shield pro-
gram, the Secretary— 
(1) shall— 
(A) establish and maintain cybersecurity 
and data security benchmarks, by convening 
and consulting interested parties and other 
Federal agencies, for products with the Cyber 
Shield label to ensure that those products per-
form better than their less secure counterparts; 
and 
(B) in carrying out subparagraph (A)— 
(i) engage in an open public review 
and comment process; 
(ii) in consultation with the Advisory 
Committee, identify and apply cybersecu-
rity and data security benchmarks to dif-
ferent subsets of covered products based 
on— 
(I) cybersecurity and data secu-
rity risk; 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(II) the sensitivity of the infor-
mation 
collected, 
transmitted, 
or 
stored by the product; and 
(III) product functionality; and 
(iii) to the extent possible, incorporate 
existing benchmarks when establishing and 
maintaining cybersecurity and data secu-
rity benchmarks; 
(2) may not establish benchmarks under para-
graph (1) that are— 
(A) arbitrary, capricious, an abuse of dis-
cretion, or otherwise not in accordance with 
law; or 
(B) unsupported by evidence; 
(3) shall permit a manufacturer or distributor 
of a covered product to display a Cyber Shield label 
reflecting the extent to which the product meets the 
industry-leading cybersecurity and data security 
benchmarks established under paragraph (1); 
(4) shall promote technologies that are compli-
ant with the cybersecurity and data security bench-
marks established by the Secretary as the preferred 
technologies in the marketplace for— 
(A) enhancing cybersecurity; and 
(B) protecting data; 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(5) shall work to enhance public awareness of 
the Cyber Shield label, including through public out-
reach, education, research and development, and 
other means; 
(6) shall preserve the integrity of the Cyber 
Shield label; 
(7) if helpful in fulfilling the obligation under 
paragraph (6), may elect to not treat a covered 
product as a Cyber Shield-certified product until the 
product meets appropriate conformity standards, 
which may include— 
(A) testing by an accredited third-party 
certifying laboratory or other entity in accord-
ance with the Cyber Shield program; and 
(B) certification by the laboratory or entity 
described in subparagraph (A) as meeting the 
applicable cybersecurity and data security 
benchmarks established by the Secretary; 
(8) not less frequently than once every 2 years 
after establishing cybersecurity and data security 
benchmarks for a product category under paragraph 
(1), shall review and, if appropriate, update the cy-
bersecurity and data security benchmarks for that 
product category; 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(9) shall solicit comments from interested par-
ties and the Advisory Committee prior to estab-
lishing or revising a Cyber Shield product category 
or benchmark (or prior to the effective date of the 
establishment or revision of a product category or 
benchmark); 
(10) upon adoption of a new or revised product 
category or benchmark, shall provide reasonable no-
tice to interested parties of any changes (including 
effective dates) to product categories or benchmarks, 
along with— 
(A) an explanation of the changes; and 
(B) as appropriate, responses to comments 
submitted by interested parties; and 
(11) shall provide appropriate lead time prior to 
the applicable effective date for a new or a signifi-
cant revision to a product category or benchmark, 
taking into account the timing requirements of the 
manufacturing, product marketing, and distribution 
process for the product or products addressed. 
(d) DEADLINES.—Not later than 2 years after the 
date of enactment of this Act, the Secretary shall establish 
cybersecurity and data security benchmarks for covered 
products under subsection (c)(1), which shall take effect 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
not later than 60 days after the date on which the bench-
marks are established. 
(e) ADMINISTRATION.—The Secretary, in consulta-
tion with the Advisory Committee, may enter into a con-
tract with a third party to administer the Cyber Shield 
program if— 
(1) the third party is an impartial adminis-
trator; and 
(2) entering into the contract improves the cy-
bersecurity and data security of covered products. 
(f) PROGRAM EVALUATION.— 
(1) IN GENERAL.—Not later than 4 years after 
the date of enactment of this Act, and not less fre-
quently than every 2 years thereafter, the Inspector 
General of the Department of Commerce shall evalu-
ate the Cyber Shield program. 
(2) REQUIREMENTS.—In conducting an evalua-
tion under paragraph (1), the Inspector General of 
the Department of Commerce shall— 
(A) evaluate the extent to which the cyber-
security and data security benchmarks estab-
lished under the Cyber Shield program address 
cybersecurity and data security threats; 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(B) assess how the benchmarks have 
evolved to meet emerging cybersecurity and 
data security threats; 
(C) conduct covert testing to evaluate the 
integrity of certification testing; and 
(D) assess the costs to businesses of par-
ticipating in the Cyber Shield program. 
SEC. 5. CYBER SHIELD DIGITAL PRODUCT PORTAL. 
(a) IN GENERAL.—The Secretary shall make publicly 
available on the website of the Department of Commerce 
in a searchable format— 
(1) a web page providing information about the 
Cyber Shield program; and 
(2) a database of covered products certified 
under the Cyber Shield program. 
(b) 
REQUIREMENTS.—The 
database 
established 
under subsection (a) shall include— 
(1) the cybersecurity and data security bench-
marks for each product category; and 
(2) for each covered product certified under the 
Cyber Shield program— 
(A) the certification for the product; 
(B) the name and manufacturer of the 
product; 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS
(C) the contact information for the manu-
facturer; 
(D) the functionality of the product; 
(E) the location of any applicable privacy 
policy; and 
(F) any other information the Secretary 
determines necessary and appropriate. 
SEC. 6. RULE OF CONSTRUCTION. 
The decision of a manufacturer of a covered product 
not to participate in the Cyber Shield program shall not 
affect the liability of the manufacturer for a cybersecurity 
or data security breach of that covered product. 
Æ 
VerDate Sep 11 2014 
01:24 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H4163.IH
H4163
lotter on DSKBCFDHB2PROD with BILLS