Satellite Cybersecurity Act
Bill: H.R.7629 | Sponsor: Rep. Malinowski, Tom (D-NJ)
Policy area: Science, Technology, Communications

Summary:
Satellite Cybersecurity Act
This bill addresses cybersecurity matters related to commercial satellite systems.
Specifically, the Cybersecurity and Infrastructure Security Agency (CISA) must maintain a publicly available clearinghouse of resources concerning the cybersecurity of commercial satellite systems. CISA must also consolidate voluntary recommendations for the development, maintenance, and operation of such systems. The recommendations must include measures to protect systems against cyber-related vulnerabilities, risks, and attacks.
The bill also requires the Government Accountability Office (GAO) to study and report on federal actions to support the cybersecurity of commercial satellite systems, including with respect to critical infrastructure sectors. In carrying out its study and report, the GAO must coordinate with designated federal agencies.

To require a report on Federal support to the cybersecurity of 
 commercial satellite systems, establish a commercial satellite system 
  cybersecurity clearinghouse in the Cybersecurity and Infrastructure 
                Security Agency, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Satellite Cybersecurity Act''.

SEC. 2. REPORT ON COMMERCIAL SATELLITE CYBERSECURITY; CISA COMMERCIAL 
              SATELLITE SYSTEM CYBERSECURITY CLEARINGHOUSE.

    (a) Study.--
            (1) In general.--The Comptroller General of the United 
        States shall conduct a study on the actions the Federal 
        Government has taken to support the cybersecurity of commercial 
        satellite systems, including as part of any action to address 
        the cybersecurity of critical infrastructure sectors.
            (2) Report.--Not later than two years after the date of the 
        enactment of this Act, the Comptroller General of the United 
        States shall report to Congress on the study conducted under 
        paragraph (1), which shall include information on--
                    (A) the effectiveness of efforts of the Federal 
                Government in improving the cybersecurity of commercial 
                satellite systems;
                    (B) the resources made available to the public, as 
                of the date of the enactment of this Act, by Federal 
                agencies to address cybersecurity risks and 
                cybersecurity threats to commercial satellite systems;
                    (C) the extent to which commercial satellite 
                systems are reliant on or are relied on by critical 
                infrastructure and an analysis of how commercial 
                satellite systems, and the cybersecurity threats to 
                such systems, are integrated into Federal and non-
                Federal critical infrastructure risk analyses and 
                protection plans;
                    (D) the extent to which Federal agencies are 
                reliant on commercial satellite systems and how Federal 
                agencies mitigate cybersecurity risks associated with 
                those systems; and
                    (E) the extent to which Federal agencies coordinate 
                or duplicate authorities and take other actions focused 
                on the cybersecurity of commercial satellite systems.
            (3) Consultation.--In carrying out paragraphs (1) and (2), 
        the Comptroller General of the United States shall coordinate 
        with appropriate Federal agencies, including--
                    (A) the Department of Homeland Security;
                    (B) the Department of Commerce;
                    (C) the Department of Defense;
                    (D) the Department of Transportation;
                    (E) the Federal Communications Commission;
                    (F) the National Aeronautics and Space 
                Administration; and
                    (G) the National Executive Committee for Space-
                Based Positioning, Navigation, and Timing.
            (4) Briefing.--Not later than one year after the date of 
        the enactment of this Act, the Comptroller General of the 
        United States shall provide a briefing to Congress relating to 
        carrying out paragraphs (1) and (2).
            (5) Classification.--The report under paragraph (2) shall 
        be unclassified but may include a classified annex.
    (b) CISA Commercial Satellite System Cybersecurity Clearinghouse.--
            (1) Establishment.--
                    (A) In general.--Not later than 180 days after the 
                date of the enactment of this Act, the Director shall 
                establish a commercial satellite system cybersecurity 
                clearinghouse.
                    (B) Requirements.--The clearinghouse shall--
                            (i) be publicly available online;
                            (ii) contain current, relevant, and 
                        publicly available commercial satellite system 
                        cybersecurity resources, including the 
                        recommendations consolidated under paragraph 
                        (2), and any other appropriate materials for 
                        reference by entities that develop commercial 
                        satellite systems; and
                            (iii) include materials specifically aimed 
                        at assisting small business concerns with the 
                        secure development, operation, and maintenance 
                        of commercial satellite systems.
                    (C) Existing platform or website.--The Director may 
                establish the clearinghouse on an online platform or a 
                website that is in existence as of the date of the 
                enactment of this Act.
            (2) Consolidation of commercial satellite system 
        cybersecurity recommendations.--
                    (A) In general.--The Director shall consolidate 
                voluntary cybersecurity recommendations designed to 
                assist in the development, maintenance, and operation 
                of commercial satellite systems.
                    (B) Requirements.--The recommendations consolidated 
                under subparagraph (A) shall include, to the greatest 
                extent practicable, materials addressing the following:
                            (i) Risk-based, cybersecurity-informed 
                        engineering, including continuous monitoring 
                        and resiliency.
                            (ii) Planning for retention or recovery of 
                        positive control of commercial satellite 
                        systems in the event of a cybersecurity 
                        incident.
                            (iii) Protection against unauthorized 
                        access to vital commercial satellite system 
                        functions.
                            (iv) Physical protection measures designed 
                        to reduce the vulnerabilities of a commercial 
                        satellite system's command, control, or 
                        telemetry receiver systems.
                            (v) Protection against jamming or spoofing.
                            (vi) Security against threats throughout a 
                        commercial satellite system's mission lifetime.
                            (vii) Management of supply chain risks that 
                        affect the cybersecurity of commercial 
                        satellite systems.
                            (viii) As appropriate, and as applicable 
                        pursuant to the requirement under paragraph 
                        (1)(b)(ii) (relating to the clearinghouse 
                        containing current, relevant, and publicly 
                        available commercial satellite system 
                        cybersecurity resources), the findings and 
                        recommendations from the study conducted by the 
                        Comptroller General of the United States under 
                        subsection (a)(1).
                            (ix) Any other recommendations to ensure 
                        the confidentiality, availability, and 
                        integrity of data residing on or in transit 
                        through commercial satellite systems.
            (3) Implementation.--In implementing this subsection, the 
        Director shall--
                    (A) to the extent practicable, carry out such 
                implementation as a public-private partnership;
                    (B) coordinate with the heads of appropriate 
                Federal agencies with expertise and experience in 
                satellite operations, including the entities described 
                in subsection (a)(3); and
                    (C) consult with non-Federal entities developing 
                commercial satellite systems or otherwise supporting 
                the cybersecurity of commercial satellite systems, 
                including private, consensus organizations that develop 
                relevant standards.
    (c) Definitions.--In this section:
            (1) Clearinghouse.--The term ``clearinghouse'' means the 
        commercial satellite system cybersecurity clearinghouse 
        required to be developed and maintained under subsection 
        (b)(1).
            (2) Commercial satellite system.--The term ``commercial 
        satellite system'' means an earth satellite owned and operated 
        by a non-Federal entity.
            (3) Critical infrastructure.--The term ``critical 
        infrastructure'' has the meaning given such term in section 
        1016(e) of Public Law 107-56 (42 U.S.C. 5195c(e)).
            (4) Cybersecurity risk.--The term ``cybersecurity risk'' 
        has the meaning given such term in section 2209 of the Homeland 
        Security Act of 2002 (6 U.S.C. 659).
            (5) Cybersecurity threat.--The term ``cybersecurity 
        threat'' has the meaning given such term in section 102 of the 
        Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501).
            (6) Director.--The term ``Director'' means the Director of 
        the Cybersecurity and Infrastructure Security Agency.
            (7) Small business concern.--The term ``small business 
        concern'' has the meaning given the term in section 3 of the 
        Small Business Act (15 U.S.C. 632).
                                 <all>