,,ii  #aad? ,,congress  #a/ ,session    
,s4 #ahfi  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #bg1 #bjae ,mr4  
,c>p] 7= himself & ,mr4 ,johnson7       
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to improve ,f$]al network 
security & au?orize & enhance an exi/+  
intrusion detection & prev5tion sy/em = 
civilian ,f$]al networks4  #a4 ,%ort    
title  ,?is ,act may be cit$ z ! ,f$]al 
,cyb]security ,enhancem5t ,act ( #bjae4 
#b4 ,def9itions ,9 ?is ,act-- 7#a7 ! t]m
 ag5cy has ! mean+ giv5 ! t]m 9 section 
#cejb ( title #dd1 ,unit$ ,/ates ,code2 
7#b7 ! t]m ag5cy in=mation sy/em has !  
mean+ giv5 ! t]m 9 section #bbh ( !     
,homel& ,security ,act ( #bjjb1 z add$  
by section #c7;a72  7#c7 ! t]m          
appropriate congressional committees    
means-- 7,a7 ! ,committee on ,homel&    
,security & ,gov]nm5tal ,affairs ( !    
,s5ate2 &  7,b7 ! ,committee on ,homel& 
,security ( ! ,h\se ( ,repres5tatives2  

7#d7 ! t]ms cyb]security risk &         
in=mation sy/em h ! mean+s giv5 ^? t]ms 
9 section #bbg ( ! ,homel& ,security    
,act ( #bjjb1 z s r$esignat$ by section 
#c7;a72  7#e7 ! t]m ,director means !   
,director ( ! ,(fice ( ,managem5t &     
,budget2  7#f7 ! t]m intellig5ce        
community has ! mean+ giv5 ! t]m 9      
section #c7d7 ( ! ,national ,security   
,act ( #aidg 7#ej ,u4,s4,c4 #cjjc7d772 &
  7#g7 ! t]m ,secret>y means ! ,secret>y
 ( ,homel& ,security4  #c4 ,improv$     
,f$]al network security  7a7 ,9 g5]al   
,subtitle ,c ( title ,,ii ( ! ,homel&   
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ada et seq47 is am5d$--  7#a7 by       
r$esignat+ section #bbh z section #bbi2 
7#b7 by r$esignat+ section #bbg z       
subsection 7c7 ( section #bbh1 z add$ by
 p>agraph 7#d71 & adju/+ ! m>g9s        
accord+ly2  7#c7 by r$esignat+ ! second 
section designat$ z section #bbf 7relat+
 to ! national cyb]security &           
communications integration c5t]7 z      
section #bbg2  7#d7 by ins]t+ aft]      

section #bbg1 z s r$esignat$1 ! foll[+3 
#bbh4 ,cyb]security plans  7a7          
,def9itions ,9 ?is section--  7#a7 ! t]m
 ag5cy in=mation sy/em means an         
in=mation sy/em us$ or op]at$ by an     
ag5cy1 by a contractor ( an ag5cy1 or by
 ano!r entity on behalf ( an ag5cy2     
7#b7 ! t]ms cyb]security risk &         
in=mation sy/em h ! mean+s giv5 ^? t]ms 
9 section #bbg2  7#c7 ! t]m in=mation   
%>+ & analysis organization has ! mean+ 
giv5 ! t]m 9 section #bab7e72 &  7#d7 ! 
t]m intellig5ce community has ! mean+   
giv5 ! t]m 9 section #c7d7 ( ! ,national
 ,security ,act ( #aidg 7#ej ,u4,s4,c4  
#cjjc7d774  7b7 ,intrusion assessm5t    
plan  7#a7 ,requirem5t ,! ,secret>y1 9  
coord9ation ) ! ,director ( ! ,(fice (  
,managem5t & ,budget1 %all develop &    
implem5t an intrusion assessm5t plan to 
id5tify & remove intrud]s 9 ag5cy       
in=mation sy/ems4  7#b7 ,exception ,!   
intrusion assessm5t plan requir$ "u     
p>agraph 7#a7 %all n apply to !         
,dep>tm5t ( ,def5se or an elem5t ( !    

intellig5ce community4  2  7#e7 9       
section #bbh7;c71 z s r$esignat$1 by    
/rik+ section #bbf & ins]t+ section     
#bbg2 &  7#f7 by ins]t+ aft] section    
#bbi1 z s r$esignat$1 ! foll[+3  #bcj4  
,f$]al intrusion detection & prev5tion  
sy/em  7a7 ,def9itions ,9 ?is section-- 
7#a7 ! t]m ag5cy has ! mean+ giv5 t t]m 
9 section #cejb ( title #dd1 ,unit$     
,/ates ,code2  7#b7 ! t]m ag5cy         
in=mation means in=mation collect$ or   
ma9ta9$ by or on behalf ( an ag5cy2     
7#c7 ! t]m ag5cy in=mation sy/em has !  
mean+ giv5 ! t]m 9 section #bbh2 &  7#d7
 ! t]ms cyb]security risk & in=mation   
sy/em h ! mean+s giv5 ^? t]ms 9 section 
#bbg4  7b7 ,requirem5t  7#a7 ,9 g5]al ,n
 lat] ?an #a ye> aft] ! date ( enactm5t 
( ?is section1 ! ,secret>y %all deploy1 
op]ate1 & ma9ta91 to make available =   
use by any ag5cy1 ) or )\t              
reimbursem5t--  7,a7 a capability to    
detect cyb]security risks 9 network     
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em2 &  7,b7 a        

capability to prev5t network traffic    
associat$ ) su* cyb]security risks f    
transit+ or travel+ to or f an ag5cy    
in=mation sy/em or modify su* network   
traffic to remove ! cyb]security risk4  
7#b7 ,regul> improvem5t ,! ,secret>y    
%all regul>ly deploy new te*nologies &  
modify exi/+ te*nologies to ! intrusion 
detection & prev5tion capabilities      
describ$ 9 p>agraph 7#a7 z appropriate  
to improve ! intrusion detection &      
prev5tion capabilities4  7c7 ,activities
 ,9 c>ry+ out subsection 7b71 !         
,secret>y-- 7#a7 may access1 & ! head ( 
an ag5cy may disclose to ! ,secret>y or 
a private entity provid+ assi/ance to ! 
,secret>y "u p>agraph 7#b71 in=mation   
transit+ or travel+ to or f an ag5cy    
in=mation sy/em1 reg>dless ( ! location 
f :i* ! ,secret>y or a private entity   
provid+ assi/ance to ! ,secret>y "u     
p>agraph 7#b7 accesses su* in=mation1   
not)/&+ any o!r provision ( law t w\ld  
o!rwise re/rict or prev5t ! head ( an   
ag5cy f disclos+ su* in=mation to !     

,secret>y or a private entity provid+   
assi/ance to ! ,secret>y "u p>agraph    
7#b72  7#b7 may ent] into contracts or  
o!r agreem5ts )1 or o!rwise reque/ &    
obta9 ! assi/ance (1 private entities to
 deploy & op]ate te*nologies 9          
accordance ) subsection 7b72  7#c7 may  
reta91 use1 & disclose in=mation obta9$ 
?r\gh ! conduct ( activities au?oriz$ "u
 ?is section only to protect in=mation &
 in=mation sy/ems f cyb]security risks2 
7#d7 %all regul>ly assess ?r\gh         
op]ational te/ & evaluation 9 real _w or
 simulat$ environm5ts available advanc$ 
protective te*nologies to improve       
detection & prev5tion capabilities1     
includ+ comm]cial & non-comm]cial       
te*nologies & detection te*nologies     
beyond signature-bas$ detection1 &      
utilize su* te*nologies :5 appropriate2 
7#e7 %all e/abli% a pilot to acquire1   
te/1 & deploy1 z rapidly z possible1    
te*nologies describ$ 9 p>agraph 7#d72 & 
7#f7 %all p]iodically update ! privacy  
impact assessm5t requir$ "u section     

#bjh7;b7 ( ! ,e-,gov]nm5t ,act ( #bjjb  
7#dd ,u4,s4,c4 #ceja note74  7d7        
,private entities  7#a7 ,conditions ,a  
private entity describ$ 9 subsection    
7c77#b7 may n-- 7,a7 disclose any       
network traffic transit+ or travel+ to  
or f an ag5cy in=mation sy/em to any    
entity o!r ?an ! ,dep>tm5t or ! ag5cy t 
disclos$ ! in=mation "u subsection      
7c77#a72 or  7,b7 use any network       
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em to :i* ! private  
entity ga9s access 9 accordance ) ?is   
section = any purpose o!r ?an to protect
 ag5cy in=mation & ag5cy in=mation      
sy/ems aga9/ cyb]security risks or to   
adm9i/] a contract or o!r agreem5t ent]$
 into pursuant to subsection 7c77#b7 or 
z "p ( ano!r contract ) ! ,secret>y4    
7#b7 ,limitation on liability ,no cause 
( action %all lie 9 any c\rt aga9/ a    
private entity = assi/ance provid$ to ! 
,secret>y 9 accordance ) ?is section &  
any contract or agreem5t ent]$ into     
pursuant to subsection 7c77#b74  4  7b7 

,prioritiz+ advanc$ security tools  ,!  
,director & ! ,secret>y1 9 consultation 
) appropriate ag5cies1 %all--  7#a7     
review & update ,gov]nm5twide policies &
 programs to ensure appropriate         
prioritization & use ( network security 
monitor+ tools )9 ag5cy networks2 &     
7#b7 brief appropriate congressional    
committees on su* prioritization & use4 
7c7 ,ag5cy responsibilities  7#a7 ,9    
g5]al ,except z provid$ 9 p>agraph      
7#b7--  7,a7 n lat] ?an #a ye> aft] !   
date ( enactm5t ( ?is ,act or #b mon?s  
aft] ! date on :i* ! ,secret>y makes    
available ! intrusion detection &       
prev5tion capabilities "u section       
#bcj7;b77#a7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by subsection 7a71      
:i*ev] is lat]1 ! head ( ea* ag5cy %all 
apply & cont9ue to utilize !            
capabilities to all in=mation travel+   
betwe5 an ag5cy in=mation sy/em & any   
in=mation sy/em o!r ?an an ag5cy        
in=mation sy/em2 &  7,b7 n lat] ?an #f  
mon?s aft] ! date on :i* ! ,secret>y    

makes available improvem5ts to !        
intrusion detection & prev5tion         
capabilities pursuant to section        
#bcj7;b77#b7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by subsection 7a71 !    
head ( ea* ag5cy %all apply & cont9ue to
 utilize ! improv$ intrusion detection &
 prev5tion capabilities4  7#b7          
,exception ,! requirem5ts "u p>agraph   
7#a7 %all n apply to ! ,dep>tm5t (      
,def5se or an elem5t ( ! intellig5ce    
community4  7d7 ,table ( cont5ts am5dm5t
 ,! table ( cont5ts 9 section #a7;b7 ( !
 ,homel& ,security ,act ( #bjjb 7#f     
,u4,s4,c4 #aja note7 is am5d$ by /rik+ !
 items relat+ to ! fir/ section         
designat$ z section #bbf1 ! second      
section designat$ z section #bbf 7relat+
 to ! national cyb]security &           
communications integration c5t]71       
section #bbg1 & section #bbh & ins]t+ ! 
foll[+3  ,sec4 #bbf4 ,cyb]security      
recruitm5t & ret5tion4,sec4 #bbg4       
,national cyb]security & communications 
integration c5t]4,sec4 #bbh4            

,cyb]security plans4,sec4 #bbi4         
,cle>ances4,sec4 #bcj4 ,f$]al intrusion 
detection & prev5tion sy/em4  4  #d4    
,advanc$ int]nal def5ses  7a7 ,advanc$  
network security tools  7#a7 ,9 g5]al ,!
 ,secret>y %all include 9 ! ,cont9u\s   
,diagno/ics & ,mitigation ,program      
advanc$ network security tools to       
improve visibility ( network activity1  
includ+ ?r\gh ! use ( comm]cial & free  
or op5 s\rce tools1 to detect & mitigate
 intrusions & anomal\s activity4  7#b7  
,developm5t ( plan ,! ,director %all    
develop & implem5t a plan to ensure t   
ea* ag5cy utilizes advanc$ network      
security tools1 includ+ ^? describ$ 9   
p>agraph 7#a71 to detect & mitigate     
intrusions & anomal\s activity4  7b7    
,improv$ metrics ,! ,secret>y1 9        
collaboration ) ! ,director1 %all review
 & update ! metrics us$ to measure      
security "u section #ceed ( title #dd1  
,unit$ ,/ates ,code1 to include measures
 ( intrusion & incid5t detection &      
response times4  7c7 ,transp>5cy &      

acc\ntability ,! ,director1 9           
consultation ) ! ,secret>y1 %all        
increase transp>5cy to ! public on ag5cy
 cyb]security po/ure1 includ+ by        
increas+ ! numb] ( metrics available on 
,f$]al ,gov]nm5t p]=mance websites &1 to
 ! greate/ ext5t practicable1 display+  
metrics = dep>tm5t compon5ts1 small     
ag5cies1 & micro ag5cies4  7d7          
,ma9t5ance ( te*nologies ,section       
#ceec7;b77#f77;,b7 ( title #dd1 ,unit$  
,/ates ,code1 is am5d$ by ins]t+ 1      
op]at+1 & ma9ta9+ aft] deploy+4  #e4    
,f$]al cyb]security be/ practices  7a7  
,assessm5t ( be/ practices = ,f$]al     
cyb]security ,! ,secret>y1 9            
consultation ) ! ,director1 %all        
regul>ly assess & require implem5tation 
( be/ practices = secur+ ag5cy in=mation
 sy/ems aga9/ intrusion & prev5t+ data  
exfiltration 9 ! ev5t ( an intrusion4   
7b7 ,cyb]security requirem5ts at ag5cies
  7#a7 ,9 g5]al ,except z provid$ 9     
p>agraph 7#b71 n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is ,act1 ! head ( ea*

 ag5cy %all--  7,a7 id5tify s5sitive &  
mission critical data /or$ by ! ag5cy   
consi/5t ) ! inv5tory requir$ "u ! fir/ 
subsection 7c7 7relat+ to ! inv5tory (  
major in=mation sy/ems7 & ! second      
subsection 7c7 7relat+ to ! inv5tory (  
in=mation sy/ems7 ( section #ceje (     
title #dd1 ,unit$ ,/ates ,code2  7,b7   
assess access controls to ! data        
describ$ 9 subp>agraph 7,a71 ! ne$ =    
readily accessible /orage ( ! data1 &   
individuals' ne$ to access ! data2  7,c7
 encrypt ! data describ$ 9 subp>agraph  
7,a7 t is /or$ on or transit+ ag5cy     
in=mation sy/ems consi/5t ) /&>ds &     
guidel9es promulgat$ "u section #aacca (
 title #dj1 ,unit$ ,/ates ,code2  7,d7  
implem5t a s+le sign-on tru/$ id5tity   
plat=m = individuals access+ ea* public 
website ( ! ag5cy t requires us]        
au!ntication1 z develop$ by !           
,adm9i/rator ( ,g5]al ,s]vices 9        
collaboration ) ! ,secret>y2 &  7,e7    
implem5t multi-factor au!ntication      
consi/5t ) /&>ds & guidel9es promulgat$ 

"u section #aacca ( title #dj1 ,unit$   
,/ates ,code1 =--  7i7 remote access to 
an ag5cy in=mation sy/em2 &  7ii7 ea*   
us] acc\nt ) elevat$ privileges on an   
ag5cy in=mation sy/em4  7#b7 ,exception 
,! requirem5ts "u p>agraph 7#a7 %all n  
apply to ! ,dep>tm5t ( ,def5se or an    
elem5t ( ! intellig5ce community4  #f4  
,assessm5t2 reports  7a7 ,def9itions ,9 
?is section-- 7#a7 ! t]m intrusion      
assessm5ts means actions tak5 "u !      
intrusion assessm5t plan to id5tify &   
remove intrud]s 9 ag5cy in=mation       
sy/ems2  7#b7 ! t]m intrusion assessm5t 
plan means ! plan requir$ "u section    
#bbh7;b77#a7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by section #c7;a7 ( ?is 
,act2 &  7#c7 ! t]m intrusion detection 
& prev5tion capabilities means !        
capabilities requir$ "u section #bcj7;b7
 ( ! ,homel& ,security ,act ( #bjjb1 z  
add$ by section #c7;a7 ( ?is ,act4  7b7 
,?ird-,p>ty assessm5t ,n lat] ?an #c    
ye>s aft] ! date ( enactm5t ( ?is ,act1 
! ,gov]nm5t ,acc\ntability ,(fice %all  

conduct a /udy & publi% a report on !   
effectiv5ess ( ! approa* & /rategy ( !  
,f$]al ,gov]nm5t to secur+ ag5cy        
in=mation sy/ems1 includ+ ! intrusion   
detection & prev5tion capabilities & !  
intrusion assessm5t plan4  7c7 ,reports 
to ,congress  7#a7 ,intrusion detection 
& prev5tion capabilities  7,a7 ,secret>y
 ( ,homel& ,security report ,n lat] ?an 
#f mon?s aft] ! date ( enactm5t ( ?is   
,act1 & annually !reaft]1 ! ,secret>y   
%all submit to ! appropriate            
congressional committees a report on !  
/atus ( implem5tation ( ! intrusion     
detection & prev5tion capabilities1     
includ+--  7i7 a description ( privacy  
controls2  7ii7 a description ( !       
te*nologies & capabilities utiliz$ to   
detect cyb]security risks 9 network     
traffic1 includ+ ! ext5t to :i* ^?      
te*nologies & capabilities include exi/+
 comm]cial & non-comm]cial te*nologies2 
7iii7 a description ( ! te*nologies &   
capabilities utiliz$ to prev5t network  
traffic associat$ ) cyb]security risks f

 transit+ or travel+ to or f ag5cy      
in=mation sy/ems1 includ+ ! ext5t to :i*
 ^? te*nologies & capabilities include  
exi/+ comm]cial & non-comm]cial         
te*nologies2  7iv7 a li/ ( ! types (    
indicators or o!r id5tifi]s or te*niques
 us$ to detect cyb]security risks 9     
network traffic transit+ or travel+ to  
or f ag5cy in=mation sy/ems on ea*      
it]ation ( ! intrusion detection &      
prev5tion capabilities & ! numb] ( ea*  
su* type ( indicator1 id5tifi]1 &       
te*nique2  7v7 ! numb] ( in/ances 9 :i* 
! intrusion detection & prev5tion       
capabilities detect$ a cyb]security risk
 9 network traffic transit+ or travel+  
to or f ag5cy in=mation sy/ems & ! numb]
 ( times ! intrusion detection &        
prev5tion capabilities block$ network   
traffic associat$ ) cyb]security risk2 &
  7vi7 a description ( ! pilot e/abli%$ 
"u section #bcj7;c77#e7 ( ! ,homel&     
,security ,act ( #bjjb1 z add$ by       
section #c7;a7 ( ?is ,act1 includ+ !    
numb] ( new te*nologies te/$ & ! numb] (

 p>ticipat+ ag5cies4  7,b7 ,,omb report 
,n lat] ?an #ah mon?s aft] ! date (     
enactm5t ( ?is ,act1 & annually !reaft]1
 ! ,director %all submit to ,congress1 z
 "p ( ! report requir$ "u section       
#ceec7;c7 ( title #dd1 ,unit$ ,/ates    
,code1 an analysis ( ag5cy application (
 ! intrusion detection & prev5tion      
capabilities1 includ+--  7i7 a li/ ( ea*
 ag5cy & ! degree to :i* ea* ag5cy has  
appli$ ! intrusion detection & prev5tion
 capabilities to an ag5cy in=mation     
sy/em2 &  7ii7 a li/ by ag5cy (-- 7,i7 !
 numb] ( in/ances 9 :i* ! intrusion     
detection & prev5tion capabilities      
detect$ a cyb]security risk 9 network   
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em & ! types (       
indicators1 id5tifi]s1 & te*niques us$  
to detect su* cyb]security risks2 &     
7,,ii7 ! numb] ( in/ances 9 :i* !       
intrusion detection & prev5tion         
capabilities prev5t$ network traffic    
associat$ ) a cyb]security risk f       
transit+ or travel+ to or f an ag5cy    

in=mation sy/em & ! types ( indicators1 
id5tifi]s1 & te*niques us$ to detect su*
 ag5cy in=mation sy/ems4  7#b7 ,,omb    
report on developm5t & implem5tation (  
intrusion assessm5t plan1 advanc$       
int]nal def5ses1 & ,f$]al cyb]security  
be/ practices ,! ,director %all-- 7,a7 n
 lat] ?an #f mon?s aft] ! date (        
enactm5t ( ?is ,act1 & #cj days aft] any
 update !reto1 submit ! intrusion       
assessm5t plan to ! appropriate         
congressional committees2  7,b7 n lat]  
?an #a ye> aft] ! date ( enactm5t ( ?is 
,act1 & annually !reaft]1 submit to     
,congress1 z "p ( ! report requir$ "u   
section #ceec7;c7 ( title #dd1 ,unit$   
,/ates ,code--  7i7 a description ( !   
implem5tation ( ! intrusion assessm5t   
plan2  7ii7 ! f9d+s ( ! intrusion       
assessm5ts conduct$ pursuant to !       
intrusion assessm5t plan2  7iii7 advanc$
 network security tools includ$ 9 !     
,cont9u\s ,diagno/ics & ,mitigation     
,program pursuant to section #d7;a77#a72
  7iv7 ! results ( ! assessm5t ( !      

,secret>y ( be/ practices = ,f$]al      
cyb]security pursuant to section #e7;a72
 &  7v7 a li/ by ag5cy ( compliance ) ! 
requirem5ts ( section #e7;b72 &  7,c7 n 
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 submit to ! appropriate      
congressional committees--  7i7 a copy (
 ! plan develop$ pursuant to section    
#d7;a77#b72 &  7ii7 ! improv$ metrics   
develop$ pursuant to section #d7;b74    
#g4 ,t]m9ation  7a7 ,9 g5]al ,! au?ority
 provid$ "u section #bcj ( ! ,homel&    
,security ,act ( #bjjb1 z add$ by       
section #c7;a7 ( ?is ,act1 & ! report+  
requirem5ts "u section #f7;c7 %all      
t]m9ate on ! date t is #g ye>s aft] !   
date ( enactm5t ( ?is ,act4  7b7 ,rule (
 con/ruction ,no?+ 9 subsection 7a7 %all
 be con/ru$ to affect ! limitation (    
liability ( a private entity = assi/ance
 provid$ to ! ,secret>y "u section      
#bcj7;d77#b7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by section #c7;a7 ( ?is 
,act1 if su* assi/ance 0 r5d]$ be=e !   
t]m9ation date "u subsection 7a7 or     

o!rwise dur+ a p]iod 9 :i* ! assi/ance 0
 au?oriz$4