Bipartisan Senate Effort Aims to Harden Telecom Networks Against Foreign Threats
Two senior Senate committee leaders have introduced new legislation designed to improve cybersecurity across the telecommunications industry, nearly two years after the public disclosure of the Salt Typhoon cyberespionage campaign. Senator Mark Warner of Virginia, the top Democrat on the Senate Intelligence Committee, and Senator Ted Cruz of Texas, the Republican chairman of the Commerce, Science and Transportation Committee, are co-sponsoring the Telecommunications Cybersecurity and Resilience Act.
The bill seeks to address what officials describe as a critical gap in national cybersecurity posture by creating a collaborative framework between government and industry to develop and maintain telecom-specific security practices.
Lawmakers Cite Salt Typhoon as Catalyst for Legislative Action
In announcing the legislation, Senator Warner emphasized the severity of the Salt Typhoon intrusion, stating it represented "the worst telecom hack in our nation’s history" and underscored the vulnerability of critical infrastructure. He argued that adopting cybersecurity best practices could significantly enhance network resilience and framed the bill as a necessary step to protect the communications networks that Americans depend on daily.
Senator Cruz echoed these concerns, noting that foreign adversaries continue to target U.S. communications systems and that effective defense requires agile, evolving strategies. He described the bill as a "sensible" approach that prioritizes collaboration over rigid mandates, which he warned could quickly become outdated in the face of rapidly changing threats.
Legislation Establishes Telecom-Focused Cybersecurity Working Group
The core mechanism of the Telecommunications Cybersecurity and Resilience Act is the creation of a telecom cybersecurity working group within the National Telecommunications and Information Administration (NTIA). This group would bring together telecommunications carriers, equipment suppliers, cybersecurity experts, and relevant federal agencies to develop voluntary, industry-wide best practices.
According to the bill’s provisions, the working group must finalize its initial set of best practices within 18 months of the legislation’s enactment. These practices would then be subject to review every two years or following any major cybersecurity incident to ensure they remain effective against emerging threats.
Best Practices to Align with Existing Frameworks and Include Certification Option
The legislation specifies that the developed best practices would focus exclusively on the full lifecycle of cybersecurity risk: identifying, responding to, mitigating, preventing, and remediating incidents and vulnerabilities. These practices would be designed to align with established federal cybersecurity risk management frameworks, ensuring consistency with broader national security efforts.
Additionally, the working group would establish a voluntary certification program administered by independent third-party assessors. Telecommunications companies could opt to participate in this program to demonstrate compliance with the recommended practices, providing a market-driven incentive for adoption without imposing federal mandates.
Addressing the Need for Evolving, Sector-Specific Guidance
A summary of the bill highlights what its sponsors view as a current deficiency: the absence of a common, telecom sector-specific set of cybersecurity best practices that can adapt as threats and technologies evolve. The legislation aims to close this gap by leveraging the industry’s existing experience in secure development and threat information sharing.
By formalizing a public-private partnership for ongoing practice development, the bill seeks to create a sustainable model for improving telecom security that remains responsive to the tactics of groups like Salt Typhoon, which U.S. officials have confirmed remains active and continues to pose a threat to telecommunications infrastructure and associated data.
Source: CyberScoop