S. 245 — Insure Cybersecurity Act of 2025

This section defines nine terms for purposes of the Act: (1) Assistant Secretary, meaning the Assistant Secretary of Commerce for Communications and Information; (2) critical infrastructure, meaning as defined in 42 U.S.C. 5195c(e); (3) customer, meaning an individual or organization that purchases cyber insurance from an issuer; (4) cyber incident, meaning as defined in 44 U.S.C. 3552(b); (5) cyber insurance, meaning an insurance policy that includes coverage for losses, damages, and costs incurred due to cyber incidents (subject to section 3(c)(1)(A)); (6) issuer, meaning an organization that issues cyber insurance; (7) policy, meaning a policy for cyber insurance; (8) small business, meaning a small business concern as defined in section 3 of the Small Business Act (15 U.S.C. 632) (i.e., independently owned and operated and not dominant in its field of operation, with size standards that may vary by industry and be based on factors such as number of employees or annual average gross receipts); and (9) working group, meaning the working group established under section 3(a).

This section directs the Assistant Secretary to establish, not later than 90 days after enactment, a working group on cyber insurance chaired by the Assistant Secretary and composed of at least one representative each from the Cybersecurity and Infrastructure Security Agency, National Institute of Standards and Technology, Department of the Treasury, Department of Justice, Federal Trade Commission, and a state insurance regulator with cybersecurity expertise. The working group must (1) define cyber insurance if needed differently from existing law; (2) analyze and explain policy terminology, coverage for cyber incidents (e.g., ransomware), customer responses (e.g., ransom payments), exclusions, and issuer constraints (e.g., reputational damage); (3) develop guidance for customers on evaluating coverage and for issuers, agents, and brokers on clear communication; (4) gather issuer input on improving data and information sharing; (5) identify measures to reduce policy costs, cyber risks, and incidents; and (6) recommend customer best practices—consulting publicly with issuers, agents, brokers, businesses, academia, regulators, critical infrastructure owners, and experts. The working group must submit a report to Congress on these activities and recommendations within one year of convening and then terminate. This section specifies that the working group's recommendations need not be adopted and confer no new authority to regulate insurance.

This section directs the Assistant Secretary to disseminate and make publicly available informative resources for cyber insurance stakeholders (i.e., issuers, agents, brokers, and customers) not later than 90 days after submission of the report required under section 3(d). The resources must incorporate the report's recommendations, be generally applicable to a wide range of stakeholders, and include case studies and examples where appropriate; they must be published on the National Telecommunications and Information Administration (NTIA) public website, promoted through outreach to industry and the public, and used on a voluntary basis.