Warner and Cruz propose voluntary telecom cybersecurity framework after Salt Typhoon

The proposed legislation signals a shift toward formalized, albeit voluntary, oversight of the infrastructure that carries streaming traffic and sensitive consumer data. By establishing a standardized telecom cybersecurity framework, the bill aims to close vulnerabilities exposed by the Salt Typhoon hacks without imposing rigid federal mandates that might stifle technical innovation. For the streaming ecosystem, this creates a new benchmark for vendor reliability and supply chain security, particularly for cloud and network management providers. As the NTIA begins coordinating with industry members, stakeholders should watch for the publication of the initial best practices and the specific criteria for third-party assessors to gauge the potential compliance burden.

The Telecommunications Cybersecurity and Resilience Act arrives amid a broader congressional push to address the Salt Typhoon intrusions, which compromised at least nine major U.S. carriers. In March 2025, the Senate Intelligence Committee released a bipartisan report documenting that Chinese state-sponsored actors maintained persistent access to U.S. telecom networks for years, prompting calls for mandatory security standards that Warner and Cruz ultimately scaled back to a voluntary approach. The bill's structure, housing the working group within NTIA rather than imposing FCC rulemaking, reflects a deliberate choice to avoid the regulatory battles that have historically stalled telecom security legislation.

Warner has spent over a year building legislative momentum around telecom infrastructure security. In December 2024, he co-authored a letter with Cruz and other senators urging the FCC to use its existing authority to mandate basic cybersecurity requirements for carriers, arguing that the agency's Title II jurisdiction provided a ready-made enforcement mechanism. The shift from that mandatory posture to the current voluntary framework signals the political compromise required to secure bipartisan sponsorship, particularly from Cruz, who chairs the Senate Commerce Committee and has historically resisted expanding FCC regulatory reach over private carriers.

The bill's third-party certification model draws on the NIST Cybersecurity Framework, which the legislation explicitly names as an alignment target. NIST published version 2.0 of that framework in February 2024, adding a sixth core function called Govern to address supply chain risk management and organizational accountability, both of which map directly to the working group's mandate to assess carrier and supplier practices. The two-year certification validity period and mandatory reassessment after major incidents mirror the cadence NIST already recommends for critical infrastructure operators, suggesting the framework could integrate with existing federal compliance programs rather than creating a parallel regime.

For related background, see StreamingMeme's prior coverage of Paramount and Warner merger prompts industry calls for modified fin-syn rules.