H.R.2683 — Remote Access Security Act
House Roll Call
H.R.2683
| Bill | H.R.2683 — Remote Access Security Act |
|---|---|
| Vote question | On Motion to Suspend the Rules and Pass, as Amended |
| Vote type | 2/3 Yea-And-Nay |
| Result | Passed |
| Totals | Yea 369 / Nay 22 / Present 0 / Not Voting 39 |
| Party | Yea | Nay | Present | Not Voting |
|---|---|---|---|---|
| R | 167 | 22 | 0 | 28 |
| D | 202 | 0 | 0 | 11 |
| I | 0 | 0 | 0 | 0 |
Research Brief
On Motion to Suspend the Rules and Pass, as Amended
Bill Analysis
HR 2683 – Remote Access Security Act (119th Congress)
HR 2683 amends the Communications Act of 1934 to tighten federal oversight of remote access to U.S. communications networks and equipment, with a focus on supply-chain and cybersecurity risks from foreign-manufactured products.
Core provisions and what it does
- Directs the Federal Communications Commission (FCC) to establish or update rules governing remote access to communications equipment and services used in U.S. networks, including routers, switches, base stations, and other critical infrastructure.
- Requires covered providers and equipment vendors to implement minimum security controls for remote access, such as strong authentication, logging, access segmentation, and timely patching.
- Targets risks associated with foreign adversary–linked vendors by restricting or conditioning remote access from certain jurisdictions or entities deemed national security risks, in coordination with the intelligence community and other federal agencies.
- Requires reporting to the FCC on remote access practices and incidents, and authorizes the FCC to require remediation plans, impose conditions on authorizations, or revoke equipment authorizations in serious cases.
Agencies and authorities
- Primary authority: Federal Communications Commission.
- Coordination: Department of Homeland Security (CISA), Department of Justice, and the intelligence community for threat assessments and designation of high-risk vendors or countries.
- The bill relies mainly on existing FCC authority under the Communications Act, expanding or clarifying it for remote-access security; it does not create a large new standalone program.
Who is affected
- Regulated: Telecommunications carriers, broadband providers, and other communications service providers; manufacturers, importers, and vendors of communications equipment used in U.S. networks; certain managed service and maintenance providers with remote access.
- Beneficiaries: U.S. consumers, businesses, and government users whose communications rely on more secure infrastructure; national security and law enforcement agencies through reduced exposure to foreign exploitation.
Timelines
- The FCC is typically directed to initiate rulemaking within a defined period (e.g., 180 days) of enactment and finalize rules within a subsequent period (often 1 year).
- Compliance deadlines for providers and vendors are phased in after final rules, allowing time for technical and contractual changes.
Yea (369)
K
Ken Calvert
J
Jason Crow
L
Lloyd Doggett
S
Scott Franklin
J
John Garamendi
J
John Mannion
L
Lucy McBath
L
Lisa McClain
J
John Rutherford
D
David Schweikert
P
Pete Sessions
R
Rashida Tlaib
N
Nydia Velázquez
D
Debbie Wasserman Schultz
Nay (22)
Not Voting (39)
E
Eric Swalwell
