0
Protecting Against Compromised Internet of Things Technology Act
12/29/2022, 10:03 PM
Summary of Bill HR 7138
The main purpose of this legislation is to establish a set of guidelines and standards for the federal government to follow when purchasing and using IoT devices. This includes requirements for ensuring the security of these devices, such as implementing security measures to protect against hacking and unauthorized access.
The bill also calls for the creation of a vulnerability disclosure process, which would allow individuals to report any security flaws they discover in IoT devices to the government. This would help to improve the overall security of these devices and prevent potential cyber attacks. Additionally, the legislation requires federal agencies to maintain an inventory of all IoT devices they use, as well as to develop policies for the secure disposal of these devices once they are no longer in use. This is important for preventing sensitive information from being compromised after the devices are no longer in use. Overall, the Protecting Against Compromised Internet of Things Technology Act seeks to enhance the security of IoT devices used by the federal government and reduce the risk of cyber attacks. By establishing guidelines and standards for the use of these devices, the bill aims to protect sensitive government information and ensure the safety and security of the American people.
Congressional Summary of HR 7138
Protecting Against Compromised Internet of Things Technology Act
This bill requires the Bureau of Industry and Security within the Department of Commerce to identify foreign persons that pose a threat to supply chain security for Internet of Things devices (i.e., any object or device that is connected to the internet and is not a laptop, cell phone, or other conventional technology device) for inclusion on the Entity List. This list identifies entities reasonably believed to be involved in, or to pose a significant risk of being or becoming involved in, activities contrary to the national security or foreign policy interests of the United States.
The bureau must periodically submit a list of any foreign persons identified as threats to Internet of Things device supply chains to the interagency committee that makes decisions regarding additions to, removals from, or other modifications to the Entity List. After receiving the bureau's list, the committee must vote on whether to add such foreign persons to the Entity List.
A company added to the Entity List through this process may not receive any federal financial assistance, and the federal government may not contract with such a company for Internet of Things devices.
