Financial Services and General Government Appropriations Act, 2024

Floor Speech

BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, I have amendment No. 80 at the desk, the cybersecurity incident disclosure rule.

BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, I rise today to offer an amendment, which I am proud to co-lead with my colleague from New York, Mr. Garbarino.

This amendment prohibits funding to implement the Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rule.

Now, as someone who has served for more than two decades in cybersecurity both in the U.S. military, as well as the chief of counterintelligence at ODNI for cyber, the National Cyber Counterintelligence Officer, as well as service in the Obama administration's White House as part of the National Security Council, combating cyberattacks from foreign adversaries are important to both my colleagues on the left and to us here on the right.

Irrespective of the SEC's intent to standardize these requirements, these new and expansive disclosure requirements have the opposite effect on our cybersecurity and safeguards here at home. Instead of working to achieve a regulatory harmonization across the Federal Government, this rulemaking creates duplicative, burdensome regulations and causes even more confusion in our public and private sectors.

Worse yet, the SEC's cybersecurity disclosure rule compromises the confidentiality of each company's cybersecurity program, opening them up to potentially further attacks that can harm instead of protect both the companies and the investors that they are charged with protecting.

This rule mandates disclosure of any material cybersecurity incident within 4 business days. The disclosure requires companies to disclose when it is the victim of a cyberattack, as well as the nature, the timing, the scope of an incident, and its material impact, oftentimes before law enforcement has even had the opportunity to fully evaluate this.

Disclosure of this type of information to the public before it is remediated would achieve the same effect as disclosing these vulnerabilities before there is even a patch, leading other bad actors to exploit the same vulnerabilities potentially for themselves, in effect providing a best practices to the worst actors.

It is clear that we must work together to be able to increase resiliency in cybersecurity across the board, but the SEC's rule falls short and fails to strike the right balance between the regulatory burden and improving security outcomes.

Therefore, Mr. Chair, I am offering this amendment to ensure that we do not inadvertently jeopardize companies' confidentiality reporting strategies and publicly divulge bad information to bad actors to further threaten the United States.

BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, I respectfully disagree with both the premise and the impact my colleague has represented here.

We have multiple lines of effort when it comes to protecting cybersecurity, particularly for Americans in our small and medium businesses in this area.

First and foremost, the Department of Homeland Security has primacy on this issue. When there is a violation, the Department of Justice must be informed. When we have CISA who lays out the requirements for reporting standards and then we have unelected individuals at the SEC who weigh on top of this with new regulations that are actually in conflict, we find ourselves not only confusing the issue but exposing some of our most sensitive information to our adversaries.

We have seen time and time again the threat imposed by foreign actors who look at what we are doing and disclosing as a way to attack us. They are using it not only as a model but as a playbook to go after us.

Let's secure our cybersecurity and ensure that our investors and our cyber hygiene are protected before we rampantly put out in the public space information which could truly harm national security.

BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, I urge my colleagues to support a strong cybersecurity hygiene in this space, hold the SEC accountable, and support this amendment.

Mr. Chair, I yield back the balance of my time.
BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, I rise today, like many of my colleagues, to offer an amendment to push back on yet another ill- informed and arguably reckless proposal.

This amendment, which I am proud to co-lead with the chairwoman of the Subcommittee on Capital Markets, Mrs. Wagner, is a straightforward amendment to protect businesses in States like mine in Iowa and many communities across America and to mitigate harm to investors at every level.

This amendment would prohibit unelected bureaucrats at the SEC from using funds in this legislation to require a small business to be forced to consider unrelated external factors as they review financial statements.

Like my colleagues on both sides of the aisle, I agree that preventing fraud and maintaining financial reporting integrity is essential to U.S. capital markets. However, this proposal is unnecessary and extremely burdensome. If passed, it would divert valuable resources away from a business' principle responsibility to rigorously evaluate financial statements and make every auditor into some kind of pseudo attorney, a situation no small business can afford.

Small businesses are already the subject of highly complex and often technical laws and regulations that both Federal, State, and even local authorities impose upon them. The vague and complex language included in this proposal creates ambiguity that would only lead to adverse outcomes for U.S. businesses, including increased legal and compliance costs for all that ultimately are passed on to everyday Americans.

In fact, estimates report that this proposal could triple the annual costs for public companies to the tune of more than $55 billion per year.

Mr. Chair, I came to Congress, like so many in this room, to be able to serve my constituents and to roll back the type of bureaucracy and bureaucratic requirements that are crushing everyday Main Street businesses in my hometown and towns like it across Iowa by an imposed, non-elected person somewhere in Washington who sits behind a desk and writes these regulations with no consideration of the impact to hometown America. We do ourselves a disservice.

With this amendment, I believe it is a step forward to fulfilling so many of our commitments that we share on both the left and the right, and I urge my colleagues to support this amendment.

BREAK IN TRANSCRIPT

Mr. NUNN of Iowa. Mr. Chair, like the roughly 80 percent of businesses that commented on this proposal, I would have to respectfully disagree with my Democratic colleague.

We have a folklore hero in the heartland called Will Rogers. He says: You should write your Member of Congress frequently, because even if they don't read it, they will at least know there is a problem out there.

We have heard back overwhelmingly from individuals who are operators in this space. The feedback highlights the imperative in evaluating the effectiveness of any rule and striking the right balance between not only fraud prevention and audit quality but by preserving the essential financial reporting duties, something that they have been doing ardently for years.

The PCAOB has failed to engage in a productive dialogue with so many not only in my district but across the country on this critical matter to take into account the detrimental impact that it is going to have to small businesses across America.

While I respect my colleagues on the other side of the aisle, I would urge them to consider all the good work that is already being done in this area and ask that the PCAOB do its job and start listening to Americans and implementing exercises that will assist, not regulations that will terminate.

Mr. Chair, I yield back the balance of my time.

BREAK IN TRANSCRIPT

Source