,i #aad? ,,congress #b;d ,session ,h4 ,r4 #fjff ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,septemb] #ai1 #bjaf,mr4 ,abraham 7= himself & ,mr4 ,smi? ( ,texas7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,ov]sight & ,gov]nm5t ,re=m1 & 9 addition to ! ,committee on ,sci5ce1 ,space1 & ,te*nology1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to en=ce ,f$]al cyb]security responsibility & acc\ntability4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf4 #b4 ,def9itions ,section #ceeb ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 by r$esignat+ p>agraphs 7#f7 & 7#g7 z p>agraphs 7#g7 & 7#h71 respectively2 & 7#b7 by ins]t+ aft] p>agraph 7#e7 ! foll[+ new p>agraph3 7#f7 ,! t]m major cyb]security incid5t has ! mean+ giv5 ! t]m major incid5t 9 ,(fice ( ,managem5t & ,budget ,memor&um ,m-#af-jc1 dat$ ,octob] #cj1 #bjae1 or any successor docum5t4 4 #c4 ,au?ority & functions ( ! ,director ( ,,ni/ 7a7 ,am5dm5t ,section #ceec ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 by r$esignat+ subsections 7c7 ?r\gh 7j7 z subsections 7d7 ?r\gh 7k71 respectively2 & 7#b7 by ins]t+ aft] subsection 7b7 ! foll[+ new subsection3 7c7 ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all fur!r develop & update z necess>y ! /&>ds & guidel9es "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 to fulfill ! additional objectives & requirem5ts ( ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf4 ,fur!r1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all-- 7#a7 provide to ! ,director ( ! ,(fice ( ,managem5t & ,budget a framework & process = ag5cy implem5tation ( su* /&>ds & guidel9es2 7#b7 provide support to ag5cy heads = ! implem5tation ( su* /&>ds & guidel9es & _! application to in=mation security policies & pr9ciples1 z well z ) ! developm5t ( in=mation security tra9+ & c]tification = ag5cy heads2 7#c7 conduct cyb]security rese>*-- 7,a7 to id5tify & address preval5t in=mation security *all5ges1 conc]ns1 & k gaps id5tifi$ by ag5cies1 includ+ ^? manife/$ 9 any ( ! reports1 evaluations1 assessm5ts1 & plans describ$ 9 ?is sub*apt] t may und]m9e ag5cies' in=mation security policies & practices2 7,b7 to assess ! suffici5cy ( ! curr5t /atutory requirem5ts ( ! ,f$]al ,in=mation ,security ,managem5t ,act ( #bjjb & ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad1 & _! effectiv5ess 9 requir+ ag5cies to implem5t /&>ds & guidel9es develop$ "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 & au?oriz$ by ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf reg>d+ in=mation security policies & practices2 & 7,c7 t %all require ! ,director ( ! ,(fice ( ,managem5t & ,budget1 ! ,secret>y ( ,homel& ,security1 & ! heads ( o!r ,f$]al ag5cies to provide ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology any res\rces1 includ+ reports1 evaluations1 assessm5ts1 & plans1 t may be requir$ = su* rese>*2 & 7#d7 develop1 publi%1 & update z necess>y in=mation security /&>ds & guidel9es = national security sy/ems bas$ on e/abli%$ /&>ds & guidel9es = in=mation sy/ems4 4 7b7 ,con=m+ am5dm5ts ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 ! item relat+ to section #ceec 9 ! table ( sections1 by /rik+ & ! ,secret>y & ins]t+ 1 ! ,secret>y1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology2 7#b7 9 ! section head+ = section #ceec1 by /rik+ & ! ,secret>y & ins]t+ 1 ! ,secret>y1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology2 7#c7 9 section #ceec7;e71 z s r$esignat$ by subsection 7a77#a7 ( ?is section1 by /rik+ subsection 7c7 & ins]t+ subsection 7d72 7#d7 9 section #ceec7;i77#a77;,b71 z s r$esignat$ by subsection 7a77#a7 ( ?is section-- 7,a7 by /rik+ subsection 7d7 & ins]t+ subsection 7e72 & 7,b7 by /rik+ subsection 7e7 & ins]t+ subsection 7f72 7#e7 9 section #ceed7;a77#a77;,b77v71 by /rik+ section #ceec7;h7 & ins]t+ section #ceec7;i72 & 7#f7 9 section #ceee7;g77#a71 by /rik+ section #ceec7;c7 & ins]t+ section #ceec7;d74 #d4 ,ag5cy heads ,section #b7;d7 ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad 7#dd ,u4,s4,c4 #ceec note7 is am5d$-- 7#a7 9 p>agraph 7#a7-- 7,a7 9 subp>agraph 7,a7-- 7i7 9 ! matt] be=e clause 7i71 by ins]t+ head aft] affect$ ag5cy2 & 7ii7 9 clause 7ii77,,iv71 by ins]t+ head aft] :5 ! ag5cy2 & 7,b7 9 subp>agraph 7,b7-- 7i7 by ins]t+ head ( ! aft] notice by !2 & 7ii7 by /rik+ ag5cy discov]s & ins]t+ ag5cy head discov]s2 7#b7 9 p>agraph 7#c77;,a77ii71 by /rik+ section #ceec7;c7 & ins]t+ section #ceec7;d72 & 7#c7 9 p>agraph 7#d71 by ins]t+ ! ,national ,in/itute ( ,/&>ds & ,te*nology & aft] su* notice to4 #e4 ,f$]al ag5cy head responsibilities ,section #ceed ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a77#c77;,a7-- 7,a7 by /rik+ designat+ a s5ior ag5cy in=mation security (fic] & ins]t+ collaborat+ ) ! ag5cy head to designate a ,*ief ,in=mation ,security ,(fic]2 7,b7 by r$esignat+ clauses 7i7 ?r\gh 7iv7 z clauses 7ii7 ?r\gh 7v71 respectively2 7,c7 by ins]t+ be=e clause 7ii71 z s r$esignat$1 ! foll[+ new clause3 7i7 h ! job description & responsibilities t %all be provid$ 9 guidance issu$ by ! ,director1 develop$ 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology & ! ,secret>y1 )9 #f mon?s aft] ! date ( enactm5t ( ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf2 2 7,d7 9 clause 7iv71 z s r$esignat$1 by /rik+ & at ! end2 7,e7 9 clause 7v71 z s r$esignat$1 by ins]t+ & aft] ! semicolon at ! end2 & 7,f7 by add+ at ! end ! foll[+ new clause3 7vi7 be designat$ )\t increas+ ! numb] ( full-"t equival5t employee positions at ! ag5cy2 2 7#b7 9 subsection 7b7-- 7,a7 by r$esignat+ p>agraphs 7#e7 ?r\gh 7#h7 z p>agraphs 7#f7 ?r\gh 7#i71 respectively2 & 7,b7 by ins]t+ aft] p>agraph 7#d7 ! foll[+ new p>agraph3 7#e7 m&atory annual in=mation security tra9+ & c]tification design$ specifically = ! ag5cy head1 develop$ & updat$ z necess>y by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ! purpose ( :i* %all be to ensure t ! ag5cy head has an und]/&+ ( ,f$]al cyb]security policy1 includ+ an und]/&+ (-- 7,a7 ! in=mation & in=mation sy/ems t support ! op]ations & assets ( ! ag5cy1 us+ nonte*nical t]ms z mu* z possible2 7,b7 ! pot5tial impact ( common types ( cyb]-attacks & data brea*es on ! ag5cy's op]ations & assets2 7,c7 h[ cyb]-attacks & data brea*es occur2 7,d7 /eps ! ag5cy head & ag5cy employees %\ld take to protect _! in=mation & in=mation sy/ems1 includ+ n us+ private messag+ sy/em s(tw>e or private e-mail s]v]s = (ficial communications2 & 7,e7 ! annual report+ requirem5ts requir$ ( ! ag5cy head "u subsection 7c71 includ+ ! c]tifications requir$ "u subsection 7c77#a77;,a77iv72 2 7#c7 9 subsection 7c7-- 7,a7 9 p>agraph 7#a77;,a7-- 7i7 by /rik+ ,ea* ag5cy & ins]t+ ,! head ( ea* ag5cy2 7ii7 by ins]t+ ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 aft] ! ,director1 ! ,secret>y12 7iii7 by ins]t+ 1 ,space1 & ,te*nology aft] ! ,committee on ,sci5ce2 7iv7 by /rik+ & at ! end ( clause 7iii77,,ii72 7v7 by r$esignat+ clause 7iv7 z clause 7v72 & 7vi7 by ins]t+ aft] clause 7iii7 ! foll[+ new clause3 7iv7 specific writt5 c]tification by ! ag5cy head t-- 7,i7 c]tifies t in=mation security /&>ds develop$ "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 are be+ met by ! ag5cy2 7,,ii7 id5tifies ! security controls 9 place at ! ag5cy & h[ !y ea* meet ! relevant in=mation security /&>d2 7,,iii7 may be bas$ on or in=m$ by ! assessm5t describ$ 9 section #ceec7;d77#d72 & 7,,iv7 = any in=mation security /&>d t ! ag5cy does n meet1 provides ! reasons !re= & includes docum5tation ( ! ,director's c]tification ( ! ag5cy n meet+ ! /&>d2 & 2 & 7,b7 9 p>agraph 7#b71 by /rik+ ,ea* ag5cy & ins]t+ ,! head ( ea* ag5cy2 7#d7 9 subsection 7d71 by /rik+ ea* ag5cy & ins]t+ ! head ( ea* ag5cy2 7#e7 by r$esignat+ subsection 7e7 z subsection 7f72 7#f7 by ins]t+ aft] subsection 7d7 ! foll[+ new subsection3 7e7 ,plans = implem5tation ( recomm5dations 7#a7 ,comptroll] ,g5]al recomm5dations 7,a7 ,9 g5]al ,9 addition to ! requirem5ts ( subsections 7c7 & 7d71 ea* ag5cy head %all1 n lat] ?an #f mon?s aft] ! date ( enactm5t ( ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf1 develop a plan1 9 consultation ) ! ,comptroll] ,g5]al1 to implem5t all ( ! ,comptroll] ,g5]al's recomm5dations reg>d+ in=mation security controls relevant to t ag5cy4 7,b7 ,plan ,! plan requir$ "u subp>agraph 7,a7-- 7i7 %all be submitt$ to ! ag5cies & committees describ$ 9 subsection 7c77#a77;,a72 7ii7 %all include a s*$ule = implem5tation ( ! ,comptroll] ,g5]al's recomm5dations1 includ+ a completion deadl9e2 7iii7 %all be updat$ annually1 & su* annual updates %all be includ$ 9 ! annual report describ$ 9 subsection 7c77#a77;,a72 & 7iv7 may1 z appropriate1 be bas$ on or in=m$ by recomm5dations includ$ 9 ! evaluation & report describ$ 9 section #ceee7;h74 7,c7 ,if no recomm5dations ,if ! ,comptroll] ,g5]al does n h any relevant recomm5dations = an ag5cy head to implem5t relative to in=mation security controls1 !n ! ag5cy head %all accord+ly notify ! ag5cies & committees describ$ 9 subsection 7c77#a77;,a74 7,d7 ,reasons = failure to implem5t ,if !re are any ,comptroll] ,g5]al recomm5dations t an ag5cy head does n implem5t1 ! ag5cy head %all provide ! reasons = t failure to ! ,director = ! ,director's approval4 ,= ea* unimplem5t$ recomm5dation1 ! plan %all include ei!r ! ,director's approval or a c]tification by ! ,director ( ! ag5cy head's failure to implem5t su* recomm5dation4 7#b7 ,inspector ,g5]al recomm5dations 7,a7 ,9 g5]al ,9 addition to ! requirem5ts ( subsections 7c7 & 7d71 ea* ag5cy head %all1 n lat] ?an #f mon?s aft] ! date ( enactm5t ( ! ,cyb]security ,responsibility & ,acc\ntability ,act ( #bjaf1 develop a plan1 9 consultation ) its ,inspector ,g5]al1 to implem5t all ( ! ,inspector ,g5]al's recomm5dations reg>d+ ! ag5cy's in=mation security program4 7,b7 ,plan ,! plan requir$ "u subp>agraph 7,a7-- 7i7 %all be submitt$ to ! ag5cies & committees describ$ 9 subsection 7c77#a77;,a72 7ii7 %all include a s*$ule = implem5tation ( ! ,inspector ,g5]al's recomm5dations1 includ+ a completion deadl9e2 7iii7 %all be updat$ annually1 & su* annual updates %all be includ$ 9 ! annual report describ$ 9 subsection 7c77#a77;,a72 & 7iv7 may1 z appropriate1 be bas$ on or in=m$ by recomm5dations includ$ 9-- 7,i7 ! evaluation describ$ 9 section #ceee7;b77#a72 or 7,,ii7 if ! ag5cy does n h an ,inspector ,g5]al1 ! evaluation describ$ 9 section #ceee7;b77#b74 7,c7 ,if no recomm5dations ,if ! ,inspector ,g5]al does n h any relevant in=mation security control recomm5dations = ! ag5cy head to implem5t1 !n ! ag5cy head %all accord+ly notify ! ag5cies & committees describ$ 9 subsection 7c77#a77;,a74 7,d7 ,reasons = failure to implem5t ,if !re are any ,inspector ,g5]al recomm5dations t ! ag5cy head does n implem5t1 ! ag5cy head %all provide ! reasons = t failure to ! ,director = ! ,director's approval4 ,= ea* unimplem5t$ recomm5dation1 ! plan %all include ei!r ! ,director's approval or a c]tification by ! ,director ( ! ag5cy head's failure to implem5t su* recomm5dation4 2 & 7#g7 9 subsection 7f71 z s r$esignat$1 by /rik+ ,ea* ag5cy & ins]t+ ,! head ( ea* ag5cy4 #f4 ,annual indep5d5t evaluation ,section #ceee ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a77#a71 by ins]t+ head aft] ea* ag5cy2 7#b7 9 subsection 7b77#a71 by ins]t+ & evaluations requir$ by section #ceee;a aft] requir$ by ?is section2 7#c7 9 subsection 7c71 by /rik+ t portion ( ! evaluation requir$ by ?is section & ins]t+ ! portions ( evaluations requir$ by ?is section or section #ceee;a2 7#d7 9 subsection 7e77#b71 by ins]t+ or section #ceee;a aft] requir$ "u ?is section2 7#e7 9 subsection 7f71 by /rik+ ,ag5cies & ins]t+ ,9 c>ry+ out ?is section & section #ceee;a1 ag5cies2 7#f7 9 subsection 7g77#c71 by ins]t+ "u ?is section or section #ceee;a aft] ,evaluations2 7#g7 9 subsection 7i7-- 7,a7 by /rik+ ! head ( an ag5cy & ins]t+ an ag5cy head2 7,b7 by /rik+ head ( an ag5cy & ins]t+ ag5cy head2 & 7,c7 by ins]t+ or section #ceee;a aft] "u ?is section2 & 7#h7 9 subsection 7j71 by ins]t+ ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 aft] ) ! ,secret>y14 #g4 ,major cyb]security incid5t indep5d5t evaluations 7a7 ,am5dm5t ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #ceee ! foll[+ new section3 #ceee;a4 ,major cyb]security incid5t indep5d5t evaluations 7a7 ,requirem5t ,ea* "t an ag5cy exp]i5ces a major cyb]security incid5t1 ! ag5cy head %all h p]=m$ an indep5d5t evaluation ( su* incid5t4 7b7 ,inclusions ,an evaluation ( a major cyb]security incid5t "u ?is section %all be transmitt$ by ! ag5cy head to ! ag5cies & committees describ$ 9 section #ceed7;c77#a77;,a71 & %all include-- 7#a7 a description ( ea* major cyb]security incid5t includ+-- 7,a7 ?reats & ?reat actors1 vuln]abilities1 & impacts1 includ+ :e!r ! incid5t involv$ in=mation t is classifi$1 controll$ unclassifi$ in=mation propriet>y1 controll$ unclassifi$ in=mation privacy1 or controll$ unclassifi$ in=mation o!r1 z ^! t]ms are def9$ 9 ,(fice ( ,managem5t & ,budget ,memor&um ,m-#af-jc1 dat$ ,octob] #cj1 #bjae1 or any successor docum5t2 7,b7 risk assessm5ts conduct$ on ! sy/em be=e ! incid5t2 7,c7 ! /atus ( compliance ( ! affect$ in=mation sy/em ) in=mation security requirem5ts at ! "t ( ! incid5t1 includ+-- 7i7 in=mation security control recomm5dations made by ! ag5cy's ,inspector ,g5]al t are "p ( ! plan describ$ 9 section #ceed7;e77#b72 7ii7 in=mation security control recomm5dations made by ! ,comptroll] ,g5]al t are "p ( ! plan describ$ 9 section #ceed7;e77#a72 & 7iii7 ,national ,in/itute ( ,/&>ds & ,te*nology in=mation security /&>ds t are "p ( ! ag5cy head's c]tification describ$ 9 section #ceed7;c77#a77;,a77iv72 7,d7 ! detection1 response1 & rem$iation actions ! ag5cy has complet$2 & 7,e7 recomm5dations = rese>*1 process1 & policy actions ! ag5cy %\ld consid] tak+ 9 response to ! incid5t & to help prev5t future incid5ts ( a simil> nature2 & 7#b7 = ea* major cyb]security incid5t involv+ a brea* ( p]sonally id5tifiable in=mation-- 7,a7 ! numb] ( individuals ^: in=mation 0 affect$ by ! incid5t & a description ( ! in=mation t 0 brea*$ or expos$2 7,b7 an assessm5t ( ! risk ( h>m to affect$ individuals2 & 7,c7 details ( :e!r & :5 ! ag5cy provid$ notice to affect$ individuals ab\t ! data brea*1 includ+ :at protections 7 (f]$ by ! brea*$ ag5cy4 7c7 ,en=cem5t 7#a7 ,9 g5]al ,if an evaluation ( a major cyb]security incid5t describ$ 9 subsection 7a7 det]m9es t ! major cyb]security incid5t occurr$ 9 "p or 9 :ole because ! ag5cy head _h fail$ to comply suffici5tly ) ! in=mation security requirem5ts1 recomm5dations1 or /&>ds describ$ 9 subsection 7b77#a77;,c71 ! ,director %all1 )9 #fj days ( receiv+ ! evaluation1 take action "u p>agraph 7#b74 7#b7 ,en=cem5t actions ,en=cem5t actions ! ,director may take "u ?is subsection are-- 7,a7 actions describ$ 9 section #aacjc7;b77#e7 ( title #dj1 ,unit$ ,/ates ,code2 & 7,b7 ei!r-- 7i7 recomm5d+ to ! ,presid5t ! removal or demotion ( ! ag5cy head2 or 7ii7 action to ensure ! ag5cy head does n receive any ca% or pay aw>ds or bonuses = a p]iod ( #a ye> aft] submission ( ! explanation requir$ "u p>agraph 7#c74 7#c7 ,explanation ,! ,director %all provide a detail$ explanation = en=cem5t actions tak5 "u p>agraph 7#b71 or = a decision n to act1 to ! committees describ$ 9 section #ceed7;c77#a77;,a74 4 7b7 ,table ( sections am5dm5t ,! table ( sections = su* sub*apt] is am5d$ by ins]t+ aft] ! item relat+ to section #ceee ! foll[+ new item3 #ceee;a4 ,major cyb]security incid5t indep5d5t evaluations4 4