Cybersecurity Policy Report, Warner, Cruz Offer Bill to Create Telecom Cybersecurity ‘Best Practices’ Framework, (Sep 25, 2026)

By Lynn Stanton

Sens. Mark Warner (D., Va.), vice chairman of the Senate Intelligence Committee, and Senate Commerce, Science, and Transportation Committee Chairman Ted Cruz (R., Texas) yesterday introduced a bill to create a voluntary framework for strengthening telecommunications cybersecurity in the wake of the Salt Typhoon cyber espionage campaign.

The Telecommunications Cybersecurity and Resilience Act would establish a telecommunications cybersecurity working group within the National Telecommunications and Information Administration, with participants drawn from service providers, suppliers, cybersecurity experts, and relevant state, local and federal agencies. The working group would “develop practical, risk-based cybersecurity best practices focusing specifically on the telecommunications sector,” according to a press release from the bill’s sponsors.

The best practices would be required to “[f]ocus on identifying, responding to, mitigating, preventing, and remediating cybersecurity incidents and vulnerabilities”; “[b]e risk-based and consistent with existing federal frameworks (e.g., the NIST cybersecurity framework, the NIST risk management framework, and guidance under executive order 14028)”; “[c]onsider allied-nation cybersecurity requirements ... for interoperability purposes”; “[a]void duplicating existing risk-management processes”; and “[r]eflect current threat intelligence and technology,” according to a section-by-section outline of the bill released by the sponsors.

“Industry Best Practices include, but are not limited to, timely application of security updates, decommissioning or mitigating unsupported network devices, configuration management practices aligned with the NIST Cybersecurity Framework 2.0, multi-factor authentication and identity/access-management measures, and other practices the Working Group establishes,” the section-by-section outline says.

The bill would also create a voluntary certification process “that puts real accountability behind the adoption of best practices through independent third-party assessment and certification” and would “[r]equire the best practices to be reviewed and updated at least every two years and following major cyber incidents or significant changes in the threat landscape,” the press release said.

Certification would rely on “a network of independent third-party assessors” who would certify implementation of the best practices and provide technical feedback and implementation guidance, according to the section-by-section outline. The working group would develop criteria for the third-party assessors, subject to the approval of the NTIA administrator. NTIA would publish a list of eligible assessors, as well as conditions for revoking or suspending an assessor’s designation. An entity owned or controlled by a telecommunications carrier could be designated as an assessor.

The section-by-section outline says NTIA would publish the best practices, implementation guidance, and assessor criteria and would publish an interagency memorandum of understanding among NTIA, the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology, the Office of the Director of National Intelligence, the Office of the National Cyber Director, the National Security Agency, and the FCC describing their roles and coordination.

Sen. Warner said, “The Salt Typhoon intrusion was the worst telecom hack in our nation’s history and showed us just how vulnerable our critical infrastructure is, but it does not have to be that way. If telecommunications companies adopt cybersecurity best practices, our networks can be more resilient. This bipartisan legislation is a good start in protecting our nation and strengthening the communications networks Americans rely on every day.”

Chairman Cruz said, “Foreign adversaries are increasingly targeting America’s communications networks. Securing them requires an approach that keeps pace with evolving threats. This sensible bill brings government and industry together to develop voluntary, telecom-specific cybersecurity best practices rather than adopting rigid federal mandates that quickly become outdated. As Commerce Committee chairman, I will continue working to strengthen the networks Americans rely on while preserving the innovation needed to protect them.”

News: FederalLegislation DataSecurity