Cyber Deterrence and Response Act of 2025

The Cyber Deterrence and Response Act of 2025 establishes a process for designating foreign entities as "critical cyber threat actors" when they engage in state-sponsored cyber activities that threaten U.S. national security, economic stability, or critical infrastructure. It requires the creation of a National Attribution Framework to standardize how the government determines responsibility for cyber attacks, with specific evidence standards and coordination mechanisms for attribution. The bill authorizes a range of sanctions against designated entities, including travel bans, financial restrictions, and export controls on goods and technology. It includes exemptions for U.S. intelligence activities and provisions for case-by-case waivers of sanctions. The law aims to deter foreign cyber threats through a structured, evidence-based approach to attribution and sanctions.