Inside Cybersecurity

April 23, 2024

Daily News

Software industry seeks formal notice-and-comment process on Commerce ICT security rule

By Charlie Mitchell / October 4, 2019

With an interim final rule on ICT supply-chain security just a week away, the software industry is spearheading a last-minute push to persuade the Commerce Department to instead open a formal comment period on regulations expected to sharply restrict U.S. companies' interactions with Chinese firms like Huawei.

BSA -- The Software Alliance is seeking signatures from various industry groups on a letter to Commerce Secretary Wilbur Ross, expected to be delivered Monday, calling for a notice-and-comment period on the information and communications technology supply-chain security rule, according to sources.

Commerce is expected to release an interim final rule by Oct. 12 to implement President Trump’s May 15 executive order on the ICT supply chain, which required the department to issue regulations within 150 days. The rule, effective immediately, is expected to essentially ban U.S. companies from using Chinese products in the build-out of a 5G wireless network and other services.

Department officials have said industry will have opportunities to provide input both during development and after release of the interim rule, and have held meetings with telecom and technology industry trade associations.

But a software industry source said various stakeholders have not been invited to discuss the regulations with Commerce officials. “We haven't gotten much information on the substance” of the interim rule Commerce intends to release, the source said, comparing this stage of the process unfavorably to DHS' efforts to develop an ICT vulnerability assessment under the executive order.

DHS' Cybersecurity and Infrastructure Security Agency earned plaudits from industry groups for its collaborative approach to the vulnerability assessment.

The software industry source said the Commerce Department has declined to engage through the government-industry ICT task force, which provided a venue for discussions during CISA's work on the vulnerability assessment.

Further, the source said, “There are ongoing discussions within collaborative settings like the ICT task force that could be useful, but this [Commerce] rulemaking is getting ahead of that.”

“These regulations could have a lot of impact on our industry,” the source said. “There's a lot of concern around town.” -- Charlie Mitchell (cmitchell@iwpnews.com)