Commerce Dept. to create plain-language cyber insurance guide for small businesses

What it does

This bill directs the Commerce Department's Assistant Secretary for Communications and Information to establish a working group within 90 days to study cyber insurance markets and develop plain-language educational resources. The working group—composed of representatives from CISA, NIST, Treasury, Justice, the FTC, and state insurance regulators—will analyze policy terminology, explain coverage gaps, gather data from insurers on barriers to offering broader coverage, and recommend ways to reduce cyber risk and insurance costs. Within one year, the group submits a report to Congress; the Assistant Secretary then has 90 days to publish voluntary educational materials on the NTIA website. No federal regulation of insurance is created, and use of the resources is entirely voluntary.

Why we flagged it

The bill's operative mechanism is information dissemination and stakeholder coordination—not regulation, subsidy, or liability shield. It aims to reduce information asymmetry in cyber insurance markets by requiring plain-language analysis and public education, with no mandate on insurers or customers.

What the text implies

• The working group may redefine 'cyber insurance' differently from the statutory definition (Section 3(a)(1)), potentially creating two competing definitions—one for the bill's purposes and one for the working group's analysis. This could create confusion if the redefined term is later adopted in other legislation or regulation.
• The bill requires the working group to 'gather input from issuers on what measures could improve the ability of those issuers to offer additional coverage,' including 'improvements to their actuarial data and cyber risk data.' This may indirectly influence future regulatory or legislative proposals favoring data-sharing mechanisms or actuarial standardization that benefit insurers' underwriting ca
• The explicit prohibition on new insurance regulation (Section 3(d)(2)) is a safeguard, but the working group's recommendations—once published—may become de facto industry standards or pressure points for state regulators, effectively creating soft regulatory influence without formal rulemaking.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill creates transparency and consumer education infrastructure for a critical but opaque market (cyber insurance) without imposing mandates or creating new regulatory authority. Citizens and small businesses gain access to plain-language guidance on coverage, terminology, and risk evaluation—reducing information asymmetry and enabling better purchasing decisions. The voluntary nature and explicit prohibition on new insurance regulation preserve state authority while improving market clarity

Who stands to gain

• Cyber insurance issuers (improved market clarity and customer education may expand addressable marke
• Insurance agents and brokers (better tools to explain and sell policies)

Named in the bill

Assistant Secretary of Commerce for Communications and Information, Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), Department of the Treasury, Department of Justice, Federal Trade Commission (FTC), National Telecommunications and Information Administration (NTIA), State insurance regulators, Critical infrastructure owners and operators

Where it stands

1 cosponsor: 1 Republicans.

• Jan 24, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Jan 24, 2025 — Referred to Senate Committee on Commerce, Science, and Transportation · Congress.gov: “Read twice and referred to the Committee on Commerce, Science, and Transportation”
• Feb 5, 2025 — Reported out of committee · Congress.gov: “Committee on Commerce, Science, and Transportation. Ordered to be reported without amendment favorably”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

4 lobbying clients named this bill on 9 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $6,285,758 in lobbying spend. A filing names 68 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 72% of bills with at least one filing.

John Hickenlooper, the sponsor, reported $975,352 in PAC receipts in the 2026 cycle.

• American Property Casualty Insurance Association — $3,540,000 on 2 filings
• Reinsurance Assn of America — $1,100,000 on 3 filings
• National Association of Mutual Insurance Companies — $1,005,758 on 2 filings
• Hartford Insurance Group (fka Hartford Financial Services Group) — $640,000 on 2 filings

Lobbying Disclosure Act filings through Jul 23, 2026. A filing shows who paid to lobby on a bill it names, not what changed.