This bill requires major websites and online services (excluding small businesses) to provide a simplified, accessible summary of their terms of service within 360 days. The summary must clearly explain what sensitive data they collect (e.g., health, location, financial info), user rights (like arbitration waivers), data breach history, and estimated reading time, and must be placed prominently on their sites. It also mandates a graphic diagram showing how user data is shared with third parties and an interactive format for full terms. Violations can be enforced by the FTC or state attorneys general acting on behalf of residents.
This bill requires federal contractors with large contracts (over $250,000) or those managing government information systems to implement standardized processes for reporting security flaws. It directs federal agencies to update procurement rules to mandate these vulnerability disclosure policies, aligning with existing NIST cybersecurity guidelines and international standards like ISO 29147. Contractors must address potential security issues in systems used for government work, with limited waivers allowed only for national security reasons and requiring congressional notification. The policy applies directly to major federal contractors handling sensitive government data or systems. The bill does not authorize new funding for implementation.
The Enhanced Cybersecurity for SNAP Act of 2026 requires states to transition from magnetic stripe to chip-enabled EBT cards within 4-5 years, with specific deadlines for new cards and reissuing existing cards. It mandates states to provide multiple user interfaces for managing EBT accounts - including mobile-friendly web portals, text messaging, voice services, and nondigital options - all available 99% of the time in required languages. The bill requires states to provide real-time transaction notifications, access to historical transactions for the past year, and fraud reporting capabilities to SNAP recipients, while prohibiting PIN/password requirements that conflict with federal cybersecurity standards. It eliminates fees for replacing cards due to malfunction, fraud, or required upgrades and requires states to replace damaged or lost cards within 3 business days. Additionally, the bill includes a grant program to help retailers upgrade to chip-compatible payment terminals in areas with limited grocery access.
The Insure Cybersecurity Act of 2025 establishes a working group within the Commerce Department to improve clarity around cyber insurance policies. The working group, composed of federal agencies (like CISA and the FTC), state regulators, and stakeholders, will analyze and explain technical policy terms, coverage limitations, and how policies relate to common cyber incidents (such as ransomware) in plain language for customers - especially small businesses. It will develop voluntary resources for insurers, brokers, and customers to better evaluate coverage and understand policy terms, and submit a report to Congress within one year. The bill does not change insurance regulations but focuses on making existing policies more transparent and accessible.
The Rural Hospital Cybersecurity Enhancement Act requires the Secretary of Health and Human Services to develop a workforce strategy for rural hospitals within one year of enactment. This strategy must address cybersecurity staffing challenges, create partnerships with educational institutions, and develop training materials tailored to rural hospital needs. The bill also mandates the creation of accessible cybersecurity instructional materials for hospital staff and annual congressional briefings on progress. It directly affects rural hospitals - defined as non-urban facilities providing inpatient, emergency, and diagnostic care - without authorizing new funding. Implementation must use existing resources, focusing on practical workforce development and training.
This bill establishes the Department of Commerce as the lead federal agency for blockchain technology policy, designating the Secretary as the principal advisor to the President on blockchain deployment, use, and competitiveness. It creates a Blockchain Deployment Program to develop best practices for security, interoperability, and cost savings, while requiring the Secretary to form advisory committees with industry experts, small businesses, and cybersecurity stakeholders. The bill directly affects federal agencies (through guidance on adopting blockchain) and the private sector (via voluntary best practices for digital tokens and blockchain applications). It mandates annual reports to Congress on implementation progress, emerging risks, and recommendations for future legislation, with the program set to expire 7 years after enactment.
HR 3841, the Healthcare Cybersecurity Act of 2025, requires the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to coordinate on improving cybersecurity for healthcare facilities. It mandates appointing a CISA-HHS liaison, updating a sector-specific risk management plan within one year (including analysis of impacts on rural and small facilities), and creating a biannually updated list of high-risk healthcare assets to prioritize support. The bill also directs CISA to provide training for healthcare providers on cybersecurity risks and mitigation. These provisions directly affect hospitals, clinics, and other healthcare entities handling patient data, aiming to reduce breaches and improve resilience against cyberattacks.
This bill (S 2605) creates special hiring and pay authorities to help the Department of Defense recruit and retain cybersecurity professionals. It allows the Secretary to establish "qualified positions" outside regular civil service hiring rules, set pay up to 150% of top executive rates, and offer flexible benefits like sabbaticals or retention bonuses. The policy directly affects DoD cyber workers in critical technical roles, including new hires and current employees in converted positions. It requires an implementation plan, annual reports tracking hiring/retention metrics, and a Comptroller General assessment to evaluate effectiveness.
This bill restricts access to Treasury payment systems (including the Bureau of the Fiscal Service) to only Treasury employees with a "fully successful" performance rating and at least one year of civil service, or contractors/outsiders with security clearances, required privacy/cybersecurity training, ethics agreements, and no conflicts of interest. It treats non-government users accessing these systems as government employees for ethics rules and defines specific actions (like stopping payments) as "personal and substantial participation" in government matters. The Treasury Inspector General must investigate any unauthorized access within 30 days and report to Congress, detailing the breach, security risks, and any halted payments. The bill directly affects Treasury staff, contractors, and any external entities accessing federal payment systems.
This bill requires the Secretary of Homeland Security to publicly release the full unclassified report titled "U.S. Telecommunications Insecurity 2022" within 30 days of the bill's enactment. The report was prepared for the Cybersecurity and Infrastructure Security Agency (CISA) under a DHS contract. This mandates transparency about the findings of that specific report, directly affecting DHS and CISA by requiring them to make the document publicly available. The bill focuses solely on the disclosure of the existing report, not on new security measures or policy changes.
