The nature of cyberattacks is changing, from simple intrusions to disruptive attacks, Alexander said. At some point, attackers may seek to destroy networks or infrastructure such as the electrical grid or stock markets, he said.

While Collins and Alexander called for new cybersecurity measures, Anthony Romero, executive director of the American Civil Liberties Union (ACLU), urged lawmakers to take a thoughtful approach. Government efforts in the area need strong oversight, and some recent proposals in Congress would put the NSA or U.S. Department of Defense in charge of most government cybersecurity programs, he said.

Programs at the NSA or DOD would have little transparency to the public, Romero said.

Romero said he's concerned that the fight against cyberattacks will become similar to the country's decade-old fight against terrorism. "In the name of fighting terrorism, we tortured, we abrogated due process for certain detainees, we opened a military camp in Guantanamo that's still open to this day," he said. "In the name of national security and cybersecurity, we could easily go too far as well."

The Cybersecurity Act had several civil liberties protections, Collins said. Civil liberties concerns are a good reason for Congress to act now, not after a major attack, she said.