S. 1007 — 9–8–8 Lifeline Cybersecurity Responsibility Act

This section amends the National Suicide Prevention Lifeline program, also known as the 9-8-8 lifeline (i.e., a federally funded nationwide network of crisis centers providing 24/7 suicide prevention and mental health crisis counseling), to enhance cybersecurity protections and reporting as follows: (1) requires the Assistant Secretary for Mental Health and Substance Use to coordinate with the Department of Health and Human Services Chief Information Security Officer to protect the program from cybersecurity incidents and eliminate known vulnerabilities; (2) establishes reporting requirements under which the program's federally funded network administrator must report identified cybersecurity vulnerabilities and incidents to the Assistant Secretary within 24 hours (in a manner protecting personal privacy consistent with federal and state laws), and participating local and regional crisis centers must similarly report to the administrator within 24 hours (with the administrator notifying the Assistant Secretary within 24 hours); clarifies that crisis centers oversee their program-related technology unless oversight is assigned to the administrator via participation agreement, and states these requirements supplement other applicable federal cybersecurity reporting laws; and (3) directs the Comptroller General to evaluate cybersecurity risks and vulnerabilities associated with the 9-8-8 lifeline and submit a report on findings within 180 days of enactment to the House Committee on Energy and Commerce and the Senate Committee on Health, Education, Labor, and Pensions.