The U.S. Senate overwhelmingly approved cybersecurity information sharing legislation on October 27 that is intended to help private companies and public utilities access information about potential cyber attacks and respond to cyber threats.
S. 754, the “Cybersecurity Information Sharing Act,” or CISA, would direct the Homeland Security department to develop procedures for computer network operators to share cyber threat information with each other and with the federal government. This new DHS portal would be integrated with existing information sharing services, such as critical infrastructure sector information sharing and analysis centers (ISACs).
Other sections of CISA would authorize network operators to monitor network traffic for potential cyber threats, and to take “defensive measures” to protect networks and customers against apparent threats. Companies and utilities that share information, monitor their networks, or take defensive measures in accordance with the law would be shielded from any state or federal liability claims associated with these activities.
The Senate Intelligence Committee originally approved CISA in March, but early versions of the bill did not clearly extend information sharing opportunities and network monitoring rights to all public utilities, including water and wastewater systems. AMWA and other water sector organizations notified the Senate of this oversight in June, and lawmakers soon rectified it in later versions of the bill. As a result, CISA as passed by the Senate would computer networks operated by public water and wastewater systems the same as those run by private corporations, and allow all network operators to participate in the new information sharing process.
The Senate approved CISA by a vote of 74 – 21. The House of Representatives passed similar cybersecurity legislation earlier this year, so in the coming weeks Congress will begin establishing a conference committee tasked with working out a final cybersecurity information sharing bill.