Do you want to spend the money to keep up with this technological arms race that you necessarily have to because it is concomitant with the electronic era that each of these companies are embracing?

We need to put in place the highest possible standards.

The Congress shouldn't require a specific technology, but it should require a standard.

So, what they were complaining about was that we initially offered one year, and they said one year is not adequate.

I would suggest to you that you look perhaps to a broader group of companies here that would be helpful.

If you don't keep up with the changes, that you are liable.

You have to think of it as a necessary investment that you have to make.

NIST's job is not to say exactly what it should be for this month, the next month, the next month.

If a financial institution, retailer, or a Federal agency determines that sensitive information was or may have been compromised, the bill that Senator Carper and I have proposed would simply require them to investigate the scope of the…

But not everyone appreciates every aspect of our bill and I would just invite you to--you have heard some of the criticisms of each of the major pieces that have been introduced in the Senate.

Every day, sophisticated criminals, hackers, and even nation states are probing our government agencies, universities, major retailers, and critical infrastructure, and they are looking for weak spots in our defenses.

I endorse the framework as an excellent first step; however, it is important to stress it is the beginning and it is not the end.

49 different compliance regimens, an area that has driven us from one of the most secure places to do business.

One of the most significant accomplishments over the last year though, was the release of a voluntary Cybersecurity Framework.

Senator Toomey has a bill that could very well be, many elements of it, added to the bill that Senator Carper and I have proposed.

I was so pleased to see that that cyber resilience program is part of their rollout strategy.

I think of my mother and I think of, why does it matter what State she lives in to determine the level of protection that she has? It should not.

We think this common sense legislation... would require a national standard for entities that collect sensitive personal information.