FCC chair proposes yearly network security certificationFCC chair proposes yearly network security certification

Following recent reports involving an intrusion by foreign actors into U.S. communications networks, FCC Chairwoman Jessica Rosenworcel proposed urgent action to safeguard the nation's communications systems from real and present cybersecurity threats, including from state-sponsored cyber actors from the People's Republic of China. The Chairwoman announced today that the Federal Communications Commission will act to ensure telecommunication companies are required to secure their networks.

Chairwoman Rosenworcel has shared with her fellow commissioners a draft Declaratory Ruling finding that section 105 of Communications Assistance for Law Enforcement Act ("CALEA") affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications. That action is accompanied by a proposal that would require communications service providers to submit an annual certification to the FCC attesting that they have created, updated, and implemented a cybersecurity risk management plan, which would strengthen communications from future cyberattacks.

If adopted, the Declaratory Ruling would take effect immediately. In addition, the draft Notice of Proposed Rulemaking would seek comment on cybersecurity risk management requirements for a wide range of communications providers. The proposal would also seek comment on additional ways to strengthen the cybersecurity posture of communications systems and services.

Last month, the Commission proposed cybersecurity risk management plan requirements for submarine cable landing applicants and licensees. In addition, the Commission previously proposed that participants in the Emergency Alert System and Wireless Emergency Alerts maintain cybersecurity risk management plans.

Read the full press release here.

FCC