Insure Cybersecurity Act of 2025
The Insure Cybersecurity Act of 2025 would direct the Assistant Secretary of Commerce for Communications and Information to create a temporary federal working group on cyber insurance within 90 days of enactment. The working group would include representatives from federal agencies, a state insurance regulator, and the Assistant Secretary as chair, and would study how cyber insurance policies are written, marketed, and understood. Its tasks include clarifying technical and legal policy language, explaining how coverage applies to common cyber incidents such as ransomware, examining how policy exclusions and coverage limits work, and identifying ways to improve data, information sharing, and measurement of customer cybersecurity practices.
The bill also requires the working group to consult publicly with insurers, brokers, business customers, small businesses, academia, state regulators, and critical infrastructure operators. Within one year of its first meeting, the group must submit a report to Congress with findings and recommendations. After that report is issued, the Assistant Secretary must publish publicly available informational resources on the NTIA website for insurers, agents, brokers, and customers, including case studies and examples, and conduct outreach to promote those materials. The bill expressly states that the recommendations are not mandatory and do not create new authority to regulate insurance business beyond existing law.
The bill would not directly change state insurance codes or create new federal insurance regulation. Instead, it would establish a federal advisory and information-sharing process focused on cyber insurance, with the goal of improving consumer understanding, insurer communication, and market practices. Its practical effect would be to influence how cyber insurance is discussed and marketed, while leaving regulation of the business of insurance to existing federal and state authorities. It could affect insurers, brokers, small businesses, critical infrastructure operators, and other cyber insurance customers by producing guidance and educational resources that may shape policy design and purchasing decisions.
The available legislative record shows a generally favorable and noncontroversial posture toward the bill. It was reported by the Senate Commerce Committee without amendment, and there are no recorded committee transcripts or votes indicating opposition. The bill’s structure is collaborative and informational rather than regulatory, which likely contributed to its broad acceptability. The absence of recorded dissent suggests the measure was viewed as a modest, technical effort to improve understanding of cyber insurance rather than a major policy overhaul.
The main policy tension in the bill is between improving consumer clarity and avoiding any perception of federal intrusion into insurance regulation. To address that concern, the bill includes a rule of construction stating that the working group’s recommendations are not binding and do not grant new authority to regulate insurance. Another possible point of discussion is the scope of the working group’s analysis, including whether it should focus on standardizing definitions of cyber insurance, how much detail it should provide on ransomware and ransom payments, and how to balance insurer concerns about actuarial data, cyber risk measurement, and coverage limits with customer demands for broader protection. These issues appear to be addressed through consultation rather than formal dispute in the available record.