House panel advances bill to create cybersecurity standards for government IT devices

The House Oversight and Reform Committee approved bipartisan legislation on Wednesday that would establish baseline cybersecurity standards for government-purchased internet-connected devices.

The approval, done through a voice vote, advances the The Internet of Things Cybersecurity Improvement Act of 2019 toward a vote on the House floor.

The legislation is aimed at reducing the risks to government information technology from cyberattacks, and directs the National Institute of Standards and Technology to establish recommendations for the federal government on “the appropriate use and management” of the devices by no later than March 31, 2020.

{mosads}”Internet of things” devices include those with internet connections and those that are able to send and receive data, such as laptops and mobile phones.

The bill is spearheaded by Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas), and has almost two dozen other bipartisan co-sponsors.

Kelly described the bill as a “major step towards improving our nation’s cybersecurity,” adding that “we have an obligation to prevent these devices from becoming a backdoor for hackers and tools for cyber criminals.”

Hurd highlighted in a statement the severity of threat from malicious cyber criminals trying to steal data, saying that “we must act now to ensure these devices are built with security in mind, not as an afterthought.”

While the bill was approved, House Oversight and Reform Committee ranking member Jim Jordan (R-Ohio) expressed concern during the committee meeting that the legislation might be “redundant” due to existing federal cybersecurity standards, and that it could create “de facto regulations for the entire [internet of things] sector” beyond just the federal government.

House Oversight and Reform Committee Chairman Elijah Cummings (D-Md.), however, expressed “strong” support for the legislation.

There is a Senate version of the Internet of Things Cybersecurity Improvement Act, which is sponsored by Sens. Mark Warner (D-Va.), Cory Gardner (R-Colo.), Maggie Hassan (D-N.H.), Steve Daines (R-Mont.), Catherine Cortez Masto (D-Nev.) and Mike Rounds (R-S.D.).

The Senate version of the bill has not seen action since being introduced in March, though a spokesperson for Warner told The Hill on Wednesday that there have been “encouraging conversations” with the Senate Homeland Security and Governmental Affairs Committee about the bill being marked up “in the coming weeks.”

Kelly, in committee discussions on Wednesday, noted that the legislation has support from industry groups including Verizon, Tenable, Symantec, BSA: The Software Alliance and wireless trade group CTIA.