The proposed legislation comes in the midst of a 60-day review of federal cybersecurity programs that was ordered by President Barack Obama and is being led by Melissa Hathaway, who worked during the Bush administration as a "cyber-coordination executive" in the Office of the Director of National Intelligence.
In addition, there have been increasing calls for for a comprehensive national strategy on cybersecurity as well as stronger government leadership to ensure that security initiatives are implemented effectively.
Hathaway's much-anticipated report is expected to touch upon the need for more effective public-private partnerships in the area of information security, as well as regulations and incentives that are most likely to engender cooperation between the government and the private sector. It remains unclear, though, whether the report will call for the creation of cybersecurity office within the White House or recommend a more decentralized organizational model.
The bill introduced by Snowe and Rockefeller would require federal agencies, contractors and private-sector owners of critical infrastructure networks to prove that they're in compliance with NIST's new security standards. Meanwhile, NIST's director would be responsible for ensuring that software vendors and distributors comply with the envisioned rules on software security.
Other provisions in the bill include the following:
The creation of new state and regional cybersecurity centers to assist small and midsize companies on information security matters.
The designation of a federal agency to serve as a clearinghouse for security threat and vulnerability data across both the public and private sectors.
The development by the Department of Commerce of a cybersecurity licensing and certification program. If the bill is passed as written, security professionals looking to work for the federal government or for companies in critical infrastructure industries would have three years to get licensed.
A separate requirement calling for the Commerce Department to set up a cybersecurity dashboard that can provide real-time information on security threats and vulnerabilities all federal systems.
The establishment of a Secure Products and Services Acquisitions Board that would be responsible for certifying that IT products purchased by the government meet prescribed security standards.
Not everyone is convinced that new regulations aimed at the private sector would help improve data security, though.
"Security is an attitude, and it's hard to legislate attitude," said Brian Chess, founder and chief scientist at Fortify Software Inc., a security vendor in San Mateo, Calif. "It has more to do with understanding the impact of insecure software on the organization."
Grant Gross of the IDG News Service contributed to this story.