Congressman May Introduce Bill To Mandate Risk AssessmentsCongressman May Introduce Bill To Mandate Risk Assessments

The chairman of a subcommittee overseeing federal IT says he may introduce legislation to require publicly traded companies to conduct annual information-security risk assessments. In a letter to executives at technology companies, Rep. Adam Putman, R.-Fla., chairman of the House Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census, says he'd rather avoid legislating such action--but that the gravity of such vulnerabilities may leave him no alternative.

"While I am not a proponent of imposing additional legislative or regulatory requirements on the private sector, I am also convinced that the issue of network vulnerability is so real and imminent, that affirmative steps must be taken to prevent a digital disaster," Putman wrote in a letter dated Oct. 30 and released Monday. "Recent experiences of the impact that computer worms and viruses caused this summer, as well as the impact that the electric power grid failure caused a few months ago, are real evidence of the potential outcomes that could be produced by an orchestrated cyber attack."

Putman says he circulated a discussion draft to industry representatives, who responded with "some interesting ideas for alternative approaches" to accomplish the goal of protecting the nation's computer networks. He didn't detail those suggestions. To further examine these suggestions, he says he has organized a working group that will review the discussion draft with subcommittee staffers. Putman gave no timetable on when he'll decide whether to introduce the legislation.