,,ii  #aadth ,,congress  #ast ,session  
,s4 #ahfi  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,july #bg1     
#bjae ,mr4 ,carper 7for himself and ,mr4
 ,johnson7 introduced the following     
bill2 which was read twice and referred 
to the ,committee on ,homeland ,security
 and ,governmental ,affairs  ,a ,,bill  
,to improve ,federal network security   
and authorize and enhance an existing   
intrusion detection and prevention      
system for civilian ,federal networks4  
#a4 ,short title  ,this ,act may be     
cited as the ,federal ,cybersecurity    
,enhancement ,act of #bjae4  #b4        
,definitions ,in this ,act-- 7#a7 the   
term agency has the meaning given the   
term in section #cejb of title #dd1     
,united ,states ,code2  7#b7 the term   
agency information system has the       
meaning given the term in section #bbh  
of the ,homeland ,security ,act of      
#bjjb1 as added by section #c7;a72  7#c7
 the term appropriate congressional     
committees means-- 7,a7 the ,committee  

on ,homeland ,security and ,governmental
 ,affairs of the ,senate2 and  7,b7 the 
,committee on ,homeland ,security of the
 ,house of ,representatives2  7#d7 the  
terms cybersecurity risk and information
 system have the meanings given those   
terms in section #bbg of the ,homeland  
,security ,act of #bjjb1 as so          
redesignated by section #c7;a72  7#e7   
the term ,director means the ,director  
of the ,office of ,management and       
,budget2  7#f7 the term intelligence    
community has the meaning given the term
 in section #c7d7 of the ,national      
,security ,act of #aidg 7#ej ,u4,s4,c4  
#cjjc7d772 and  7#g7 the term ,secretary
 means the ,secretary of ,homeland      
,security4  #c4 ,improved ,federal      
network security  7a7 ,in general       
,subtitle ,c of title ,,ii of the       
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #ada et seq47 is amended--    
7#a7 by redesignating section #bbh as   
section #bbi2  7#b7 by redesignating    
section #bbg as subsection 7c7 of       

section #bbh1 as added by paragraph     
7#d71 and adjusting the margins         
accordingly2  7#c7 by redesignating the 
second section designated as section    
#bbf 7relating to the national          
cybersecurity and communications        
integration center7 as section #bbg2    
7#d7 by inserting after section #bbg1 as
 so redesignated1 the following3  #bbh4 
,cybersecurity plans  7a7 ,definitions  
,in this section--  7#a7 the term agency
 information system means an information
 system used or operated by an agency1  
by a contractor of an agency1 or by     
another entity on behalf of an agency2  
7#b7 the terms cybersecurity risk and   
information system have the meanings    
given those terms in section #bbg2  7#c7
 the term information sharing and       
analysis organization has the meaning   
given the term in section #bab7e72 and  
7#d7 the term intelligence community has
 the meaning given the term in section  
#c7d7 of the ,national ,security ,act of
 #aidg 7#ej ,u4,s4,c4 #cjjc7d774  7b7   

,intrusion assessment plan  7#a7        
,requirement ,the ,secretary1 in        
coordination with the ,director of the  
,office of ,management and ,budget1     
shall develop and implement an intrusion
 assessment plan to identify and remove 
intruders in agency information systems4
  7#b7 ,exception ,the intrusion        
assessment plan required under paragraph
 7#a7 shall not apply to the ,department
 of ,defense or an element of the       
intelligence community4  2  7#e7 in     
section #bbh7;c71 as so redesignated1 by
 striking section #bbf and inserting    
section #bbg2 and  7#f7 by inserting    
after section #bbi1 as so redesignated1 
the following3  #bcj4 ,federal intrusion
 detection and prevention system  7a7   
,definitions ,in this section-- 7#a7 the
 term agency has the meaning given that 
term in section #cejb of title #dd1     
,united ,states ,code2  7#b7 the term   
agency information means information    
collected or maintained by or on behalf 
of an agency2  7#c7 the term agency     

information system has the meaning given
 the term in section #bbh2 and  7#d7 the
 terms cybersecurity risk and           
information system have the meanings    
given those terms in section #bbg4  7b7 
,requirement  7#a7 ,in general ,not     
later than #a year after the date of    
enactment of this section1 the          
,secretary shall deploy1 operate1 and   
maintain1 to make available for use by  
any agency1 with or without             
reimbursement--  7,a7 a capability to   
detect cybersecurity risks in network   
traffic transiting or traveling to or   
from an agency information system2 and  
7,b7 a capability to prevent network    
traffic associated with such            
cybersecurity risks from transiting or  
traveling to or from an agency          
information system or modify such       
network traffic to remove the           
cybersecurity risk4  7#b7 ,regular      
improvement ,the ,secretary shall       
regularly deploy new technologies and   
modify existing technologies to the     

intrusion detection and prevention      
capabilities described in paragraph 7#a7
 as appropriate to improve the intrusion
 detection and prevention capabilities4 
7c7 ,activities ,in carrying out        
subsection 7b71 the ,secretary-- 7#a7   
may access1 and the head of an agency   
may disclose to the ,secretary or a     
private entity providing assistance to  
the ,secretary under paragraph 7#b71    
information transiting or traveling to  
or from an agency information system1   
regardless of the location from which   
the ,secretary or a private entity      
providing assistance to the ,secretary  
under paragraph 7#b7 accesses such      
information1 notwithstanding any other  
provision of law that would otherwise   
restrict or prevent the head of an      
agency from disclosing such information 
to the ,secretary or a private entity   
providing assistance to the ,secretary  
under paragraph 7#b72  7#b7 may enter   
into contracts or other agreements with1
 or otherwise request and obtain the    

assistance of1 private entities to      
deploy and operate technologies in      
accordance with subsection 7b72  7#c7   
may retain1 use1 and disclose           
information obtained through the conduct
 of activities authorized under this    
section only to protect information and 
information systems from cybersecurity  
risks2  7#d7 shall regularly assess     
through operational test and evaluation 
in real world or simulated environments 
available advanced protective           
technologies to improve detection and   
prevention capabilities1 including      
commercial and non-commercial           
technologies and detection technologies 
beyond signature-based detection1 and   
utilize such technologies when          
appropriate2  7#e7 shall establish a    
pilot to acquire1 test1 and deploy1 as  
rapidly as possible1 technologies       
described in paragraph 7#d72 and  7#f7  
shall periodically update the privacy   
impact assessment required under section
 #bjh7;b7 of the ,e-,government ,act of 

#bjjb 7#dd ,u4,s4,c4 #ceja note74  7d7  
,private entities  7#a7 ,conditions ,a  
private entity described in subsection  
7c77#b7 may not-- 7,a7 disclose any     
network traffic transiting or traveling 
to or from an agency information system 
to any entity other than the ,department
 or the agency that disclosed the       
information under subsection 7c77#a72 or
  7,b7 use any network traffic          
transiting or traveling to or from an   
agency information system to which the  
private entity gains access in          
accordance with this section for any    
purpose other than to protect agency    
information and agency information      
systems against cybersecurity risks or  
to administer a contract or other       
agreement entered into pursuant to      
subsection 7c77#b7 or as part of another
 contract with the ,secretary4  7#b7    
,limitation on liability ,no cause of   
action shall lie in any court against a 
private entity for assistance provided  
to the ,secretary in accordance with    

this section and any contract or        
agreement entered into pursuant to      
subsection 7c77#b74  4  7b7             
,prioritizing advanced security tools   
,the ,director and the ,secretary1 in   
consultation with appropriate agencies1 
shall--  7#a7 review and update         
,governmentwide policies and programs to
 ensure appropriate prioritization and  
use of network security monitoring tools
 within agency networks2 and  7#b7 brief
 appropriate congressional committees on
 such prioritization and use4  7c7      
,agency responsibilities  7#a7 ,in      
general ,except as provided in paragraph
 7#b7--  7,a7 not later than #a year    
after the date of enactment of this ,act
 or #b months after the date on which   
the ,secretary makes available the      
intrusion detection and prevention      
capabilities under section #bcj7;b77#a7 
of the ,homeland ,security ,act of      
#bjjb1 as added by subsection 7a71      
whichever is later1 the head of each    
agency shall apply and continue to      

utilize the capabilities to all         
information traveling between an agency 
information system and any information  
system other than an agency information 
system2 and  7,b7 not later than #f     
months after the date on which the      
,secretary makes available improvements 
to the intrusion detection and          
prevention capabilities pursuant to     
section #bcj7;b77#b7 of the ,homeland   
,security ,act of #bjjb1 as added by    
subsection 7a71 the head of each agency 
shall apply and continue to utilize the 
improved intrusion detection and        
prevention capabilities4  7#b7          
,exception ,the requirements under      
paragraph 7#a7 shall not apply to the   
,department of ,defense or an element of
 the intelligence community4  7d7 ,table
 of contents amendment ,the table of    
contents in section #a7;b7 of the       
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #aja note7 is amended by      
striking the items relating to the first
 section designated as section #bbf1 the

 second section designated as section   
#bbf 7relating to the national          
cybersecurity and communications        
integration center71 section #bbg1 and  
section #bbh and inserting the          
following3  ,sec4 #bbf4 ,cybersecurity  
recruitment and retention4,sec4 #bbg4   
,national cybersecurity and             
communications integration center4,sec4 
#bbh4 ,cybersecurity plans4,sec4 #bbi4  
,clearances4,sec4 #bcj4 ,federal        
intrusion detection and prevention      
system4  4  #d4 ,advanced internal      
defenses  7a7 ,advanced network security
 tools  7#a7 ,in general ,the ,secretary
 shall include in the ,continuous       
,diagnostics and ,mitigation ,program   
advanced network security tools to      
improve visibility of network activity1 
including through the use of commercial 
and free or open source tools1 to detect
 and mitigate intrusions and anomalous  
activity4  7#b7 ,development of plan    
,the ,director shall develop and        
implement a plan to ensure that each    

agency utilizes advanced network        
security tools1 including those         
described in paragraph 7#a71 to detect  
and mitigate intrusions and anomalous   
activity4  7b7 ,improved metrics ,the   
,secretary1 in collaboration with the   
,director1 shall review and update the  
metrics used to measure security under  
section #ceed of title #dd1 ,united     
,states ,code1 to include measures of   
intrusion and incident detection and    
response times4  7c7 ,transparency and  
accountability ,the ,director1 in       
consultation with the ,secretary1 shall 
increase transparency to the public on  
agency cybersecurity posture1 including 
by increasing the number of metrics     
available on ,federal ,government       
performance websites and1 to the        
greatest extent practicable1 displaying 
metrics for department components1 small
 agencies1 and micro agencies4  7d7     
,maintenance of technologies ,section   
#ceec7;b77#f77;,b7 of title #dd1 ,united
 ,states ,code1 is amended by inserting 

1 operating1 and maintaining after      
deploying4  #e4 ,federal cybersecurity  
best practices  7a7 ,assessment of best 
practices for ,federal cybersecurity    
,the ,secretary1 in consultation with   
the ,director1 shall regularly assess   
and require implementation of best      
practices for securing agency           
information systems against intrusion   
and preventing data exfiltration in the 
event of an intrusion4  7b7             
,cybersecurity requirements at agencies 
7#a7 ,in general ,except as provided in 
paragraph 7#b71 not later than #a year  
after the date of enactment of this     
,act1 the head of each agency shall--   
7,a7 identify sensitive and mission     
critical data stored by the agency      
consistent with the inventory required  
under the first subsection 7c7 7relating
 to the inventory of major information  
systems7 and the second subsection 7c7  
7relating to the inventory of           
information systems7 of section #ceje of
 title #dd1 ,united ,states ,code2  7,b7

 assess access controls to the data     
described in subparagraph 7,a71 the need
 for readily accessible storage of the  
data1 and individuals' need to access   
the data2  7,c7 encrypt the data        
described in subparagraph 7,a7 that is  
stored on or transiting agency          
information systems consistent with     
standards and guidelines promulgated    
under section #aacca of title #dj1      
,united ,states ,code2  7,d7 implement a
 single sign-on trusted identity        
platform for individuals accessing each 
public website of the agency that       
requires user authentication1 as        
developed by the ,administrator of      
,general ,services in collaboration with
 the ,secretary2 and  7,e7 implement    
multi-factor authentication consistent  
with standards and guidelines           
promulgated under section #aacca of     
title #dj1 ,united ,states ,code1 for-- 
7i7 remote access to an agency          
information system2 and  7ii7 each user 
account with elevated privileges on an  

agency information system4  7#b7        
,exception ,the requirements under      
paragraph 7#a7 shall not apply to the   
,department of ,defense or an element of
 the intelligence community4  #f4       
,assessment2 reports  7a7 ,definitions  
,in this section-- 7#a7 the term        
intrusion assessments means actions     
taken under the intrusion assessment    
plan to identify and remove intruders in
 agency information systems2  7#b7 the  
term intrusion assessment plan means the
 plan required under section            
#bbh7;b77#a7 of the ,homeland ,security 
,act of #bjjb1 as added by section      
#c7;a7 of this ,act2 and  7#c7 the term 
intrusion detection and prevention      
capabilities means the capabilities     
required under section #bcj7;b7 of the  
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act4   
7b7 ,third-,party assessment ,not later 
than #c years after the date of         
enactment of this ,act1 the ,government 
,accountability ,office shall conduct a 

study and publish a report on the       
effectiveness of the approach and       
strategy of the ,federal ,government to 
securing agency information systems1    
including the intrusion detection and   
prevention capabilities and the         
intrusion assessment plan4  7c7 ,reports
 to ,congress  7#a7 ,intrusion detection
 and prevention capabilities  7,a7      
,secretary of ,homeland ,security report
 ,not later than #f months after the    
date of enactment of this ,act1 and     
annually thereafter1 the ,secretary     
shall submit to the appropriate         
congressional committees a report on the
 status of implementation of the        
intrusion detection and prevention      
capabilities1 including--  7i7 a        
description of privacy controls2  7ii7 a
 description of the technologies and    
capabilities utilized to detect         
cybersecurity risks in network traffic1 
including the extent to which those     
technologies and capabilities include   
existing commercial and non-commercial  

technologies2  7iii7 a description of   
the technologies and capabilities       
utilized to prevent network traffic     
associated with cybersecurity risks from
 transiting or traveling to or from     
agency information systems1 including   
the extent to which those technologies  
and capabilities include existing       
commercial and non-commercial           
technologies2  7iv7 a list of the types 
of indicators or other identifiers or   
techniques used to detect cybersecurity 
risks in network traffic transiting or  
traveling to or from agency information 
systems on each iteration of the        
intrusion detection and prevention      
capabilities and the number of each such
 type of indicator1 identifier1 and     
technique2  7v7 the number of instances 
in which the intrusion detection and    
prevention capabilities detected a      
cybersecurity risk in network traffic   
transiting or traveling to or from      
agency information systems and the      
number of times the intrusion detection 

and prevention capabilities blocked     
network traffic associated with         
cybersecurity risk2 and  7vi7 a         
description of the pilot established    
under section #bcj7;c77#e7 of the       
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act1   
including the number of new technologies
 tested and the number of participating 
agencies4  7,b7 ,,omb report ,not later 
than #ah months after the date of       
enactment of this ,act1 and annually    
thereafter1 the ,director shall submit  
to ,congress1 as part of the report     
required under section #ceec7;c7 of     
title #dd1 ,united ,states ,code1 an    
analysis of agency application of the   
intrusion detection and prevention      
capabilities1 including--  7i7 a list of
 each agency and the degree to which    
each agency has applied the intrusion   
detection and prevention capabilities to
 an agency information system2 and  7ii7
 a list by agency of-- 7,i7 the number  
of instances in which the intrusion     

detection and prevention capabilities   
detected a cybersecurity risk in network
 traffic transiting or traveling to or  
from an agency information system and   
the types of indicators1 identifiers1   
and techniques used to detect such      
cybersecurity risks2 and  7,,ii7 the    
number of instances in which the        
intrusion detection and prevention      
capabilities prevented network traffic  
associated with a cybersecurity risk    
from transiting or traveling to or from 
an agency information system and the    
types of indicators1 identifiers1 and   
techniques used to detect such agency   
information systems4  7#b7 ,,omb report 
on development and implementation of    
intrusion assessment plan1 advanced     
internal defenses1 and ,federal         
cybersecurity best practices ,the       
,director shall-- 7,a7 not later than #f
 months after the date of enactment of  
this ,act1 and #cj days after any update
 thereto1 submit the intrusion          
assessment plan to the appropriate      

congressional committees2  7,b7 not     
later than #a year after the date of    
enactment of this ,act1 and annually    
thereafter1 submit to ,congress1 as part
 of the report required under section   
#ceec7;c7 of title #dd1 ,united ,states 
,code--  7i7 a description of the       
implementation of the intrusion         
assessment plan2  7ii7 the findings of  
the intrusion assessments conducted     
pursuant to the intrusion assessment    
plan2  7iii7 advanced network security  
tools included in the ,continuous       
,diagnostics and ,mitigation ,program   
pursuant to section #d7;a77#a72  7iv7   
the results of the assessment of the    
,secretary of best practices for        
,federal cybersecurity pursuant to      
section #e7;a72 and  7v7 a list by      
agency of compliance with the           
requirements of section #e7;b72 and     
7,c7 not later than #a year after the   
date of enactment of this ,act1 submit  
to the appropriate congressional        
committees--  7i7 a copy of the plan    

developed pursuant to section           
#d7;a77#b72 and  7ii7 the improved      
metrics developed pursuant to section   
#d7;b74  #g4 ,termination  7a7 ,in      
general ,the authority provided under   
section #bcj of the ,homeland ,security 
,act of #bjjb1 as added by section      
#c7;a7 of this ,act1 and the reporting  
requirements under section #f7;c7 shall 
terminate on the date that is #g years  
after the date of enactment of this     
,act4  7b7 ,rule of construction        
,nothing in subsection 7a7 shall be     
construed to affect the limitation of   
liability of a private entity for       
assistance provided to the ,secretary   
under section #bcj7;d77#b7 of the       
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act1 if
 such assistance was rendered before the
 termination date under subsection 7a7  
or otherwise during a period in which   
the assistance was authorized4