,,ii  #aadth ,,congress  #ast ,session  
,s4 #aiij  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,august #e1    
#bjae ,mr4 ,hatch 7for himself and ,mr4 
,carper7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,homeland ,security and  
,governmental ,affairs  ,a ,,bill  ,to  
require ,inspectors ,general and the    
,comptroller ,general of the ,united    
,states to submit reports on the use of 
logical access controls and other       
security practices to safeguard         
classified and personally identifiable  
information on ,federal computer        
systems1 and for other purposes4  #a4   
,short title  ,this ,act may be cited as
 the ,federal ,computer ,security ,act4 
#b4 ,definitions ,in this ,act3 7#a7    
,agency ,the term agency has the meaning
 given the term in section #cejb of     
title #dd1 ,united ,states ,code4  7#b7 
,covered agency ,the term covered agency
 means an agency that operates a        
,federal computer system that provides  

access to classified information or     
personally identifiable information4    
7#c7 ,logical access control ,the term  
logical access control means a process  
of granting or denying specific requests
 to obtain and use information and      
related information processing services4
  7#d7 ,multi-factor logical access     
controls ,the term multi-factor logical 
access controls means a set of not less 
than #b of the following logical access 
controls3 7,a7 ,information that is     
known to the user1 such as a password or
 personal identification number4  7,b7  
,an access device that is provided to   
the user1 such as a cryptographic       
identification device or token4  7,c7 ,a
 unique biometric characteristic of the 
user4  #c4 ,inspector ,general report on
 ,federal computer systems  7a7 ,in     
general ,not later than #bdj days after 
the date of enactment of this ,act1 the 
,inspector ,general of each covered     
agency shall each submit to the         
,comptroller ,general of the ,united    

,states and the appropriate committees  
of jurisdiction in the ,senate and the  
,house of ,representatives a report1    
which shall include information         
collected from the covered agency for   
the contents described in subsection 7b7
 regarding the ,federal computer systems
 of the covered agency4  7b7 ,contents  
,the report submitted by each ,inspector
 ,general of a covered agency under     
subsection 7a7 shall include1 with      
respect to the covered agency1 the      
following3  7#a7 ,a description of the  
logical access standards used by the    
covered agency to access a ,federal     
computer system that provides access to 
classified or personally identifiable   
information1 including--  7,a7 in       
aggregate1 a list and description of    
logical access controls used to access  
such a ,federal computer system2 and    
7,b7 whether the covered agency is using
 multi-factor logical access controls to
 access such a ,federal computer system4
  7#b7 ,if the covered agency does not  

use logical access controls or          
multi-factor logical access controls to 
access a ,federal computer system that  
provides access to classified or        
personally identifiable information1 a  
description of the reasons for not using
 such logical access controls or        
multi-factor logical access controls4   
7#c7 ,a description of the following    
data security management practices used 
by the covered agency3 7,a7 ,the        
policies and procedures followed to     
conduct inventories of the software     
present on the ,federal computer systems
 of the covered agency and the licenses 
associated with such software4  7,b7    
,whether the covered agency has entered 
into a licensing agreement for the use  
of software security controls to monitor
 and detect exfiltration and other      
threats1 including--  7i7 data loss     
prevention software2 or  7ii7 digital   
rights management software4  7,c7 ,a    
description of how the covered agency is
 using software described in            

subparagraph 7,b74  7,d7 ,if the covered
 agency has not entered into a licensing
 agreement for the use of1 or is        
otherwise not using1 software described 
in subparagraph 7,b71 a description of  
the reasons for not entering into such a
 licensing agreement or using such      
software4  7#d7 ,a description of the   
policies and procedures of the covered  
agency with respect to ensuring that    
entities1 including contractors1 that   
provide services to the covered agency  
are implementing the data security      
management practices described in       
paragraph 7#c74  7c7 ,existing review   
,the report required under this section 
may be based in whole or in part on an  
audit1 evaluation1 or report relating to
 programs or practices of the covered   
agency1 and may be submitted as part of 
another report1 including the report    
required under section #ceee of title   
#dd1 ,united ,states ,code4  7d7        
,classified information ,a report       
submitted under this section shall be in

 unclassified form1 but may include a   
classified annex4  7e7 ,availability to 
members of ,congress ,a report submitted
 under this section shall be made       
available upon request by any ,member of
 ,congress4  #d4 ,,gao economic analysis
 and report on ,federal computer systems
  7a7 ,report ,not later than #a year   
after the date of enactment of this     
,act1 the ,comptroller ,general of the  
,united ,states shall submit to         
,congress a report examining1 including 
an economic analysis of1 any impediments
 to agency use of effective security    
software and security devices4  7b7     
,classified information ,a report       
submitted under this section shall be in
 unclassified form1 but may include a   
classified annex4