,,ib ,union ,calendar ,no4 #dba #aacth ,,congress #b;d ,session ,h4 ,r4 #cfce ,report ,no4 #aac-efb ,,in ,,the ,,house ,,of ,,representatives ,december #c1 #bjac ,mr4 ,bentivolio introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform ,july #bh1 #bjad ,additional sponsors3 ,mr4 ,cole1 ,mr4 ,wilson of ,south ,carolina1 ,mr4 ,brooks of ,alabama1 ,mrs4 ,bachmann1 ,mr4 ,westmoreland1 ,mr4 ,duncan of ,south ,carolina1 ,mrs4 ,lummis1 ,mr4 ,yoho1 ,mr4 ,walberg1 ,mr4 ,huizenga of ,michigan1 ,mr4 ,meadows1 ,mrs4 ,blackburn1 ,mr4 ,benishek1 ,mr4 ,kingston1 ,mr4 ,weber of ,texas1 ,mr4 ,franks of ,arizona1 ,mr4 ,la,malfa1 ,mr4 ,rohrabacher1 ,mr4 ,mica1 ,mr4 ,kelly of ,pennsylvania1 ,mr4 ,barr1 ,mr4 ,lucas1 ,mr4 ,miller of ,florida1 ,mr4 ,sam ,johnson of ,texas1 ,mr4 ,messer1 ,mr4 ,mulvaney1 ,mr4 ,hudson1 ,mr4 ,rice of ,south ,carolina1 ,mr4 ,posey1 ,mr4 ,cramer1 ,mr4 ,williams1 ,mr4 ,stockman1 ,mr4 ,farenthold1 ,mr4 ,jordan1 ,mr4 ,mullin1 ,mr4 ,bridenstine1 ,mr4 ,fincher1 ,mr4 ,hultgren1 ,mr4 ,collins of ,new ,york1 ,mr4 ,fleischmann1 ,mr4 ,gibbs1 ,mr4 ,wenstrup1 ,mr4 ,lankford1 ,mr4 ,broun of ,georgia1 ,mr4 ,rodney ,davis of ,illinois1 ,mr4 ,young of ,alaska1 ,mr4 ,rokita1 ,mr4 ,mc,henry1 ,mr4 ,gosar1 ,mr4 ,carter1 ,mr4 ,diaz-,balart1 ,mr4 ,collins of ,georgia1 ,mr4 ,de,santis1 ,mr4 ,gowdy1 ,mr4 ,amash1 ,mr4 ,gingrey of ,georgia1 ,mr4 ,amodei1 ,mr4 ,hall1 ,mr4 ,hunter1 ,mr4 ,price of ,georgia1 ,mrs4 ,wagner1 ,mr4 ,joyce1 ,mr4 ,burgess1 ,mr4 ,cassidy1 ,mr4 ,schweikert1 ,mr4 ,stewart1 ,ms4 ,jenkins1 ,mr4 ,scalise1 ,mr4 ,latham1 ,mr4 ,hurt1 ,mr4 ,des,jarlais1 ,mr4 ,aderholt1 ,mr4 ,cook1 ,mr4 ,crawford1 ,mr4 ,king of ,iowa1 ,mr4 ,thompson of ,pennsylvania1 ,mr4 ,griffin of ,arkansas1 ,mr4 ,duncan of ,tennessee1 ,mrs4 ,roby1 ,mr4 ,chabot1 ,mr4 ,pittenger1 ,mr4 ,sanford1 ,mr4 ,graves of ,georgia1 ,mr4 ,crenshaw1 ,mr4 ,griffith of ,virginia1 ,mr4 ,nunnelee1 ,mr4 ,duffy1 ,mr4 ,shuster1 ,mr4 ,hastings of ,washington1 ,mr4 ,roskam1 ,mr4 ,latta1 ,mr4 ,goodlatte1 ,mr4 ,coble1 ,mr4 ,sensenbrenner1 ,mr4 ,lance1 ,mr4 ,southerland1 ,mr4 ,culberson1 ,mr4 ,cotton1 ,mr4 ,marchant1 ,mr4 ,boustany1 ,mr4 ,whitfield1 ,mr4 ,roe of ,tennessee1 ,mr4 ,wittman1 ,mr4 ,tiberi1 ,mr4 ,poe of ,texas1 ,mr4 ,smith of ,texas1 ,mr4 ,frelinghuysen1 ,mr4 ,ross1 ,mrs4 ,hartzler1 ,mr4 ,ribble1 ,mr4 ,tipton1 ,mr4 ,schock1 ,mr4 ,calvert1 ,mr4 ,fortenberry1 ,mr4 ,barletta1 ,mr4 ,gibson1 ,mr4 ,guthrie1 ,mr4 ,coffman1 ,mr4 ,byrne1 ,mrs4 ,mc,morris ,rodgers1 ,mr4 ,mc,clintock1 ,mr4 ,kline1 ,mr4 ,wolf1 ,mr4 ,camp1 ,mr4 ,connolly1 and ,mr4 ,johnson of ,ohio ,july #bh1 #bjad ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,strike out all after the enacting clause and insert the part printed in italic ,for text of introduced bill1 see copy of bill as introduced on ,december #c1 #bjac ,a ,,bill ,to ensure the functionality and security of new ,federal websites that collect personally identifiable information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,safe and ,secure ,federal ,websites ,act of #bjad4 #b4 ,ensuring functionality and security of new ,federal websites that collect personally identifiable information 7a7 ,certification requirement 7#a7 ,in general ,except as otherwise provided under this subsection1 an agency may not deploy or make available to the public a new ,federal ,,pii website until the date on which the chief information officer of the agency submits a certification to ,congress that the website is fully functional and secure4 7#b7 ,transition ,in the case of a new ,federal ,,pii website that is operational on the date of the enactment of this ,act1 paragraph 7#a7 shall not apply until the end of the #ij-;day period beginning on such date of enactment4 ,if the certification required under paragraph 7#a7 for such website has not been submitted to ,congress before the end of such period1 the head of the responsible agency shall render the website inaccessible to the public until such certification is submitted to ,congress4 7#c7 ,exception for beta website with explicit permission ,paragraph 7#a7 shall not apply to a website 7or portion thereof7 that is in a development or testing phase1 if the following conditions are met3 7,a7 ,a member of the public may access ,,pii-related portions of the website only after executing an agreement that acknowledges the risks involved4 7,b7 ,no agency compelled1 enjoined1 or otherwise provided incentives for such a member to access the website for such purposes4 7#d7 ,construction ,nothing in this section shall be construed as applying to a website that is operated entirely by an entity 7such as a ,state or locality7 that is independent of the ,federal ,government1 regardless of the receipt of funding in support of such website from the ,federal ,government4 7b7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given that term under section #eea of title #e1 ,united ,states ,code4 7#b7 ,fully functional ,the term fully functional means1 with respect to a new ,federal ,,pii website1 that the website can fully support the activities for which it is designed or intended with regard to the eliciting1 collection1 storage1 or maintenance of personally identifiable information1 including handling a volume of queries relating to such information commensurate with the purpose for which the website is designed4 7#c7 ,new ,federal personally identifiable information website 7,new ,federal ,,pii website7 ,the terms new ,federal personally identifiable information website and new ,federal ,,pii website mean a website that-- 7,a7 is operated by 7or under a contract with7 an agency2 7,b7 elicits1 collects1 stores1 or maintains personally identifiable information of individuals and is accessible to the public2 and 7,c7 is first made accessible to the public and collects or stores personally identifiable information of individuals1 on or after ,october #a1 #bjab4 7#d7 ,operational ,the term operational means1 with respect to a website1 that such website elicits1 collects1 stores1 or maintains personally identifiable information of members of the public and is accessible to the public4 7#e7 ,personally identifiable information 7,,pii7 ,the terms personally identifiable information and ,,pii mean any information about an individual elicited1 collected1 stored1 or maintained by an agency1 including-- 7,a7 any information that can be used to distinguish or trace the identity of an individual1 such as a name1 a social security number1 a date and place of birth1 a mother's maiden name1 or biometric records2 and 7,b7 any other information that is linked or linkable to an individual1 such as medical1 educational1 financial1 and employment information4 7#f7 ,responsible agency ,the term responsible agency means1 with respect to a new ,federal ,,pii website1 the agency that is responsible for the operation 7whether directly or through contracts with other entities7 of the website4 7#g7 ,secure ,the term secure means1 with respect to a new ,federal ,,pii website1 that the following requirements are met3 7,a7 ,the website is in compliance with subchapter ,,iii of chapter #ce of title #dd1 ,united ,states ,code4 7,b7 ,the website ensures that personally identifiable information elicited1 collected1 stored1 or maintained in connection with the website is captured at the latest possible step in a user input sequence4 7,c7 ,the responsible agency for the website has taken reasonable efforts to minimize domain name confusion1 including through additional domain registrations4 7,d7 ,the responsible agency requires all personnel who have access to personally identifiable information in connection with the website to have completed a ,standard ,form #he,p and signed a non-disclosure agreement with respect to personally identifiable information1 and the agency takes proper precautions to ensure only trustworthy persons may access such information4 7,e7 ,the responsible agency maintains 7either directly or through contract7 sufficient personnel to respond in a timely manner to issues relating to the proper functioning and security of the website1 and to monitor on an ongoing basis existing and emerging security threats to the website4 7#h7 ,state ,the term ,state means each ,state of the ,united ,states1 the ,district of ,columbia1 each territory or possession of the ,united ,states1 and each federally recognized ,indian tribe4 #c4 ,privacy breach requirements 7a7 ,information security amendment ,subchapter ,,iii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceej4 ,privacy breach requirements 7a7 ,policies and ,procedures ,the ,director of the ,office of ,management and ,budget shall establish and oversee policies and procedures for agencies to follow in the event of a breach of information security involving the disclosure of personally identifiable information1 including requirements for-- 7#a7 not later than #gb hours after the agency discovers such a breach1 or discovers evidence that reasonably indicates such a breach has occurred1 notice to the individuals whose personally identifiable information could be compromised as a result of such breach2 7#b7 timely reporting to a ,federal cybersecurity center1 as designated by the ,director of the ,office of ,management and ,budget2 and 7#c7 any additional actions that the ,director finds necessary and appropriate1 including data breach analysis1 fraud resolution services1 identity theft insurance1 and credit protection or monitoring services4 7b7 ,required ,agency ,action ,the head of each agency shall ensure that actions taken in response to a breach of information security involving the disclosure of personally identifiable information under the authority or control of the agency comply with policies and procedures established by the ,director of the ,office of ,management and ,budget under subsection 7a74 7c7 ,report ,not later than ,march #a of each year1 the ,director of the ,office of ,management and ,budget shall report to ,congress on agency compliance with the policies and procedures established under subsection 7a74 7d7 ,federal cybersecurity center defined ,the term ,federal cybersecurity center means any of the following3 7#a7 ,the ,department of ,defense ,cyber ,crime ,center4 7#b7 ,the ,intelligence ,community ,incident ,response ,center4 7#c7 ,the ,united ,states ,cyber ,command ,joint ,operations ,center4 7#d7 ,the ,national ,cyber ,investigative ,joint ,task ,force4 7#e7 ,central ,security ,service ,threat ,operations ,center of the ,national ,security ,agency4 7#f7 ,the ,united ,states ,computer ,emergency ,readiness ,team4 7#g7 ,any successor to a center1 team1 or task force described in paragraphs 7#a7 through 7#f74 7#h7 ,any center that the ,director of the ,office of ,management and ,budget determines is appropriate to carry out the requirements of this section4 4 7b7 ,technical and ,conforming ,amendment ,the table of sections for subchapter ,,iii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceej4 ,privacy breach requirements4 4 ,july #bh1 #bjad ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed