,i #aacth ,,congress #ast ,session ,h4 ,r4 #cfce ,,in ,,the ,,house ,,of ,,representatives ,december #c1 #bjac,mr4 ,bentivolio introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform ,a ,,bill ,to ensure the functionality and security of new ,federal websites that collect personally identifiable information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,safe and ,secure ,federal ,websites ,act of #bjac4 #b4 ,ensuring functionality and security of new ,federal websites that collect personally identifiable information 7a7 ,certification requirement 7#a7 ,in general ,except as otherwise provided under this subsection1 an agency may not deploy or make available to the public a new ,federal ,,pii website until the date on which a certification under subsection 7b77#b7 is submitted to ,congress that the website is fully functional and secure4 7#b7 ,transition ,in the case of a new ,federal ,,pii website that is operational on the date of the enactment of this ,act1 paragraph 7#a7 shall not apply until the end of the #cj-;day period beginning on such date of enactment4 ,if the certification under subsection 7b77#b7 for such website has not been submitted to ,congress before the end of such period1 the head of the responsible agency shall render the website inaccessible to the public until such certification is submitted to ,congress4 7#c7 ,exception for beta website with explicit permission ,paragraph 7#a7 shall not apply to a website 7or portion thereof7 that is designed for testing and development purposes1 if the following conditions are met3 7,a7 ,a member of the public may access ,,pii-related portions of the website only after executing an agreement that acknowledges the risks involved4 7,b7 ,no agency compelled1 enjoined1 or otherwise provided incentives for such a member to access the website for such purposes4 7#d7 ,construction ,nothing in this section shall be construed as applying to a website that is operated entirely by an entity 7such as a ,state or locality7 that is independent of the ,federal ,government1 regardless of the receipt of funding in support of such website from the ,federal ,government4 7b7 ,process for study and certification of functionality and security of new ,federal ,,pii websites 7#a7 ,,gao study and report 7,a7 ,study 7i7 ,current websites ,not later than #cj days after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall conduct a study of each new ,federal ,,pii website that is operational as of such date of enactment to determine whether such website is fully functional and secure4 7ii7 ,future websites ,not later than #cj days after the date on which an advance notification is received under paragraph 7#c7 for a new ,federal ,,pii website that is not operational as of such date of enactment1 the ,comptroller ,general shall conduct a study of such website to determine whether such website is fully functional and secure4 7,b7 ,report to appropriate congressional committees ,upon the completion of a study of a website under subparagraph 7,a7 or 7,c71 the ,comptroller ,general shall submit to the appropriate committees of ,congress and the ,chief ,information ,officer for the responsible agency a report on the results of the study4 ,such report shall include a determination of whether the website is fully functional and secure4 7,c7 ,followup studies and report ,if1 based on the results of the most recent study under subparagraph 7,a7 or this subparagraph1 the ,comptroller ,general determines that the website is not fully functional or not secure1 the ,comptroller ,general shall conduct an additional study 7and submit a report described in subparagraph 7,b7 on the results of such study7 until the ,comptroller ,general determines that the website is determined to be fully functional and secure4 7#b7 ,certification by ,,cio of responsible agency ,upon the submission of a report under paragraph 7#a7 that determines that a website operated by a responsible agency is fully functional and secure1 the ,chief ,information ,officer for such agency shall submit to ,congress a certification of the results of such report and a certification as to whether the website is fully functional and secure4 7#c7 ,advance notification for operation of future websites ,each agency that intends to operate a new ,federal ,,pii website on or after the date of the enactment of this ,act shall notify the ,comptroller ,general of such intention and provide to the ,comptroller ,general1 in advance of the website becoming operational1 such information as the ,comptroller ,general may require to conduct a study and perform an evaluation under this subsection4 7c7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given that term under section #eea of title #e1 ,united ,states ,code4 7#b7 ,fully functional ,the term fully functional means1 with respect to a new ,federal ,,pii website1 that the website can fully support the activities for which it is designed or intended with regard to the eliciting1 collection1 or storage of personally identifiable information1 including handling a volume of queries relating to such information commensurate with the purpose for which the website is designed4 7#c7 ,new ,federal ,,pii website ,the term new ,federal ,,pii website means a website that-- 7,a7 is operated by 7or under a contract with7 an agency2 7,b7 elicits1 collects1 or stores personally identifiable information of individuals and is accessible to the public2 and 7,c7 is first made accessible to the public and collects or stores personally identifiable information of individuals1 on or after ,july #a1 #bjac4 7#d7 ,operational ,the term operational means1 with respect to a website1 that such website elicits1 collects1 or stores personally identifiable information of members of the public and is accessible to the public4 7#e7 ,personally identifiable information 7,,pii7 ,the terms personally identifiable information and ,,pii mean any information that can be associated with one individual through a social security account number1 taxpayer identification number1 state identification number or other identifer1 but does not include information 7such as name1 mailing or email address1 telephone number1 or similar contact information7 necessary to contact an individual4 7#f7 ,responsible agency ,the term responsible agency means1 with respect to a new ,federal ,,pii website1 the agency that is responsible for the operation 7whether directly or through contracts with other entities7 of the website4 7#g7 ,secure ,the term secure means1 with respect to a new ,federal ,,pii website1 that the following requirements are met3 7,a7 ,the website has security features that meet a standard acceptable for banking purposes and the responsible agency has a named overall security leader with a comprehensive1 top-down view of the security posture for the website who has supervised a complete end-to-end security test4 7,b7 ,the website ensures that personally identifiable information elicited1 collected1 or stored in connection with the website is captured at the latest possible step in a user input sequence4 7,c7 ,the responsible agency for the website has taken reasonable efforts to minimize domain name confusion1 including through additional domain registrations and a program to educate consumers how to spot fraudulent websites4 7,d7 ,the responsible agency requires all personnel who have access to personally identifiable information in connection with the website to have completed a ,standard ,form #he,p and signed a non-disclosure agreement with respect to personally identifiable information1 and the agency takes proper precautions to ensure only trustworthy persons may access such information4 7,e7 ,the responsible agency maintains 7either directly or through contract7 ample personnel to respond in a timely manner to issues relating to the proper functioning and security of the website1 and to monitor on an ongoing basis existing and emerging security threats to the website4 7#h7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each territory or possession of the ,united ,states1 and each federally recognized ,indian tribe4