,i #aad? ,,congress #b;d ,session ,h4 ,r4 #ejfi ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,april #bf1 #bjaf ,mr4 ,mc,dermott introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,f9ancial ,s]vices ,a ,,bill ,to am5d ! ,s>banes-,oxley ,act ( #bjjb to protect inve/ors by exp&+ ! m&at$ int]nal controls reports & disclosures to include cyb]security sy/ems & risks ( publicly trad$ companies4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,cyb]security ,sy/ems & ,risks ,report+ ,act4 #b4 ,cyb]security & in=mation sy/em requirem5ts 7a7 ,def9itions ,section #b7;a7 ( ! ,s>banes-,oxley ,act ( #bjjb 7#ae ,u4,s4,c4 #gbja7;a77 is am5d$-- 7#a7 9 p>agraph 7#b71 by ins]t+ aft] f9ancial /atem5ts ! foll[+3 & in=mation sy/ems2 7#b7 9 p>agraph 7#c77;,a71 by /rik+ & f9ancial & ins]t+ 1 f9ancial1 & cyb]security sy/ems2 7#c7 9 p>agraph 7#aj77;,b71 by ins]t+ aft] quality control policies & proc$ures1 ! foll[+3 cyb]security sy/ems /&>ds & practices12 & 7#d7 by add+ at ! end ! foll[+3 7#ah7 ,in=mation sy/em ,! t]m in=mation sy/em means a set ( activities1 involv+ p1 processes1 data1 or te*nology1 :i* enable ! issu] to obta91 g5]ate1 use1 & communicate transactions & in=mation to ma9ta9 acc\ntability & measure & review ! issu]'s p]=mance or progress t[>ds a*ievem5t ( objectives4 7#ai7 ,cyb]security sy/em ,! t]m cyb]security sy/em means a set ( activities or /ate1 involv+ p1 processes1 data or te*nology1 :]eby ! protection ( an in=mation sy/em ( ! issu] is secur$ f1 or def5d$ aga9/1 damage1 unau?oriz$ use or modification1 misdirection1 disruption or exploitation4 7#bj7 ,cyb]security risk ,! t]m cyb]security risk means a significant vuln]ability to1 or a significant defici5cy 91 ! security & def5se activities ( a cyb]security sy/em4 4 7b7 ,corporate responsibility ,section #cjb ( ! ,s>banes-,oxley ,act ( #bjjb 7#ae ,u4,s4,c4 #gbda7 is am5d$-- 7#a7 9 ! head+ ( su* section1 by ins]t+ aft] ,,reports ! foll[+3 ,,& ,,in=mation ,,sy/ems2 & 7#b7 9 subsection 7a7-- 7,a7 by /rik+ & ! pr9cipal f9ancial (fic] or (fic]s1 & ins]t+ 1 ! pr9cipal f9ancial (fic] or (fic]s1 & ! pr9cipal cyb]security sy/ems (fic] or (fic]s2 7,b7 9 p>agraph 7#d71 by /rik+ int]nal controls ea* place su* t]m appe>s & ins]t+ int]nal controls & cyb]security sy/ems2 7,c7 9 p>agraph 7#e7-- 7i7 9 subp>agraph 7,a7-- 7,i7 by ins]t+ aft] op]ation ( int]nal controls ! foll[+3 & cyb]security sy/ems2 & 7,,ii7 by ins]t+ be=e ! semicolon ! foll[+3 & any significant cyb]security risks 9 issu]'s in=mation sy/ems2 & 7ii7 9 subp>agraph 7,b71 by ins]t+ be=e ! semicolon ! foll[+3 1 cyb]security sy/ems1 or in=mation sy/ems2 & 7,d7 9 p>agraph 7#f7-- 7i7 by /rik+ int]nal controls ea* place su* t]m appe>s & ins]t+ int]nal controls1 cyb]security sy/ems1 or in=mation sy/ems2 & 7ii7 by /rik+ significant defici5cies & ins]t+ cyb]security risks1 significant defici5cies14 7c7 ,managem5t assessm5t ,section #djd ( ! ,s>banes-,oxley ,act ( #bjjb 7#ae ,u4,s4,c4 #gbfb7 is am5d$-- 7#a7 9 ! head+ ( su* section1 by ins]t+ aft] ,,controls ! foll[+3 ,,& ,,in=mation ,,sy/ems2 7#b7 9 subsection 7a7-- 7,a7 by ins]t+ aft] conta9 an int]nal control ! foll[+3 & in=mation sy/ems2 7,b7 9 p>agraph 7#a71 by /rik+ an adequate int]nal control /ructure & proc$ures = f9ancial report+ & ins]t+ adequate int]nal control & cyb]security sy/ems /ructures & proc$ures = f9ancial & in=mation sy/ems report+2 & 7,c7 by am5d+ p>agraph 7#b7 to read z foll[s3 7#b7 conta9 assessm5ts1 z ( ! end ( ! mo/ rec5t fiscal ye> ( ! issu]1 ( ! effectiv5ess (-- 7,a7 ! int]nal control /ructure & proc$ures ( ! issu] = f9ancial report+2 & 7,b7 ! cyb]security sy/ems /ructure ( ! issu]4 2 & 7#c7 9 subsection 7b7-- 7,a7 9 ! head+ ( su* subsection1 by ins]t+ aft] ,int]nal ,control ! foll[+2 & ,cyb]security ,sy/ems2 & 7,b7 by /rik+ int]nal control assessm5t & ins]t+ int]nal control & cyb]security sy/em /ructure assessm5ts4 7d7 ,disclosure ( exp]t ,section #djg ( ! ,s>banes-,oxley ,act ( #bjjb 7#ae ,u4,s4,c4 #gbfe7 is am5d$-- 7#a7 9 ! head+ ( su* section1 by /rik+ ,,exp]t & ins]t+ ,,& ,,cyb]security ,,sy/ems ,,exp]ts2 7#b7 9 subsection 7a7-- 7,a7 9 ! head+ ( su* subsection1 by /rik+ ,exp]t & ins]t+ & ,cyb]security ,exp]ts2 & 7,b7 by /rik+ 1 z su* t]m is def9$ by ! ,commission & ins]t+ & at lea/ #a memb] :o is a cyb]security sy/ems exp]t1 z su* t]ms are def9$ by ! ,commission 9 consultation ) ! ,secret>y ( ,homel& ,security & ! ,secret>y ( ,comm]ce2 & 7#c7 by /rik+ subsection 7c7 & ins]t+ ! foll[+3 7c7 ,consid]ations ) respect to cyb]security exp]ts ,9 def9+ ! t]m cyb]security exp]t = purposes ( subsection 7a71 ! ,commission %all1 9 consultation ) ! ,secret>y ( ,homel& ,security & ! ,secret>y ( ,comm]ce1 consid] :e!r a p]son has1 ?r\gh education or exp]i5ce z an in=mation te*nology (fic] or in=mation sy/ems security (fic]1 or f a position involv+ ! p]=mance ( simil> functions-- 7#a7 an und]/&+ ( g5]ally accept$ pr9ciples1 practices1 & law relat+ to comput] security1 comput] network security1 & data security & privacy2 7#b7 exp]i5ce 9-- 7,a7 ! prep>ation ( in=mation sy/ems audits = cyb]security risk discov]y2 & 7,b7 ! ma9t5ance1 implem5tation1 & monitor+ ( in=mation sy/ems & _! cyb]security sy/ems2 7#c7 exp]i5ce ) in=mation sy/ems aspects ( int]nal acc\nt+ controls2 & 7#d7 an und]/&+ ( audit committee functions4 4 7e7 ,enhanc$ review ,section #djh ( ! ,s>banes-,oxley ,act ( #bjjb 7#ae ,u4,s4,c4 #gbfe7 is am5d$-- 7#a7 9 subsection 7a71 by /rik+ f9ancial /atem5t & ins]t+ f9ancial1 in=mation sy/ems1 & cyb]security sy/ems /atem5ts2 & 7#b7 9 subsection 7b7-- 7,a7 9 p>agraph 7#e71 by /rik+ & at ! end2 7,b7 by r$esignat+ p>agraph 7#f7 z p>agraph 7#g72 & 7,c7 by ins]t+ aft] p>agraph 7#e7 ! foll[+3 7#f7 issu]s t h issu$ cyb]security risks disclosures2 & 4 7f7 ,cl]ical am5dm5t ,! table ( cont5ts 9 section #a7;b7 ( ! ,s>banes-,oxley ,act ( #bjjb is am5d$-- 7#a7 9 ! item relat+ to section #cjb1 by ins]t+ aft] ,,reports ! foll[+3 ,,& ,,in=mation ,,sy/ems2 7#b7 9 ! item relat+ to section #djd1 by ins]t+ aft] ,,controls ! foll[+3 ,,& ,,in=mation ,,sy/ems2 & 7#c7 9 ! item relat+ to section #djg1 by /rik+ ,,exp]t & ins]t+ ,,& ,,cyb]security ,,sy/ems ,,exp]ts4