NCTA-the Internet & Television Association is celebrating the President's signature on the Internet of Things Cybersecurity Improvement Act.

The bill, introduced in March 2019, "requires that devices purchased by the U.S. government meet certain minimum security requirements." 

Related: IoT BIll Heads to Senate

“We applaud the President for signing into law the Internet of Things Cybersecurity Improvement Act," NCTA said in a statement. "With potential security threats to networks always looming, maintaining stringent cybersecurity standards is a must to protect many business and government operations. Since the government is such a large purchaser and user of IoT devices, this new law will have an impact on IoT purchases by businesses and beyond. Many thanks to Senators Gardner and Warner, and Representatives Kelly and Hurd, for introducing this important legislation and navigating it through Congress.”

Specifically, the law:

"Requires contractors and vendors providing information systems to the U.S. government to adopt coordinated vulnerability disclosure policies, so that if a vulnerability is uncovered, that can be effectively shared with a vendor for remediation." 

"Requires the National Institute of Standards and Technology (NIST) to issue recommendations addressing, at a minimum, secure development, identity management, patching, and configuration management for IoT devices. 

"Directs the Office of Management and Budget (OMB) to issue guidelines for each agency that are consistent with the NIST recommendations, and charge OMB with reviewing these policies at least every five years. 

"Requires any Internet-connected devices purchased by the federal government to comply with those recommendations. 

"Directs NIST to work with cybersecurity researchers, industry experts, and the Department of Homeland Security (DHS) to publish guidance on coordinated vulnerability disclosure to ensure that vulnerabilities related to agency devices are addressed."

The bill was introduced in the Senate by Sens. Mark Warner (D-Va.) and Cory Gardner (R-Colo.), co-chairs of the Senate Cybersecurity Caucus, as well as Sens. Maggie Hassan (D-N.H.) and Steve Daines (R-Mont.). Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas) took the lead on the bill in the House.

The National Cable & Telecommunications Association praised passage by the Senate Select Committee Wednesday of the Cybersecurity Information Sharing Act (S. 754).

The bill would make it easier for NCTA members to share cyber threat information.

The March 13 vote was in closed session, but it was 14-1. The committee on March 17 released the final version of the bill.

"The release and introduction of the bill yesterday marks an important step forward in our collective efforts to improve our nation’s cyber readiness and share critical information on evolving cyber threat indicators," the cable trade association said in a statement. "The legislation seeks to balance cybersecurity, privacy and civil liberties concerns and will improve our ability to protect our Internet infrastructure, consumers and America’s economy. We look forward to working with Chairman Burr, Ranking Member Feinstein, and other members of the Senate as this legislation moves to the Senate floor.”

New America’s Open Technology Institute was not as pleased, saying the bill falls far short of protecting privacy.

“We are gravely disappointed by the Senate Intelligence Committee’s failure to add any significant new privacy protections to the Cybersecurity Information Sharing Act," said Robyn Greene, policy counsel at the Open Technology Institute. "Most of the changes the Committee made when approving the bill last week are cosmetic, such that the final bill—like the draft bill before it—does more to authorize cyber-surveillance than to protect cybersecurity."