S. 1007: 9–8–8 Lifeline Cybersecurity Responsibility Act

This bill, known as the 9–8–8 Lifeline Cybersecurity Responsibility Act, aims to strengthen the cybersecurity measures for the National Suicide Prevention Lifeline program. Here are the key components of the bill:

Enhancements to Cybersecurity

The bill proposes to amend existing regulations under the Public Health Service Act to protect the National Suicide Prevention Lifeline from cybersecurity threats. It mandates:

• Coordination with the Chief Information Security Officer of the Department of Health and Human Services to enhance protections against cybersecurity incidents.

Reporting Requirements

The legislation introduces stricter reporting protocols for cybersecurity vulnerabilities and incidents:

• Network administrators of the program must report any identified cybersecurity vulnerabilities or incidents to the Assistant Secretary within 24 hours.
• Local and regional crisis centers that are part of the program are also required to report any identified vulnerabilities or incidents within the same 24-hour timeframe.

Furthermore, if a vulnerability or incident is discovered or reported, it must be notified to the Assistant Secretary promptly.

Oversight Responsibilities

The responsibilities for overseeing technology used in the program will largely lie with local and regional crisis centers, with specific stipulations allowing the program’s network administrator to take on oversight in certain circumstances as outlined in their agreements.

Supplementary Reporting

This new reporting requirement is designed to supplement existing federal cybersecurity reporting requirements, ensuring that this specific area remains covered without overriding previous laws.

Study on Cybersecurity Risks

Within 180 days after the bill is enacted, the Comptroller General of the United States is instructed to conduct a study evaluating cybersecurity risks associated with the 9–8–8 National Suicide Prevention Lifeline. The findings are to be reported to relevant congressional committees.

Relevant Companies

None found