,,ii  #aad? ,,congress  #a/ ,session    
,s4 #aiij  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,augu/ #e1 #bjae ,mr4  
,hat* 7= himself & ,mr4 ,c>p]7 introduc$
 ! foll[+ bill2 :i* 0 read twice &      
ref]r$ to ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs  ,a    
,,bill  ,to require ,inspectors ,g5]al &
 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates 
to submit reports on ! use ( logical    
access controls & o!r security practices
 to safegu>d classifi$ & p]sonally      
id5tifiable in=mation on ,f$]al comput] 
sy/ems1 & = o!r purposes4  #a4 ,%ort    
title  ,?is ,act may be cit$ z ! ,f$]al 
,comput] ,security ,act4  #b4           
,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! 
t]m ag5cy has ! mean+ giv5 ! t]m 9      
section #cejb ( title #dd1 ,unit$ ,/ates
 ,code4  7#b7 ,cov]$ ag5cy ,! t]m cov]$ 
ag5cy means an ag5cy t op]ates a ,f$]al 
comput] sy/em t provides access to      
classifi$ in=mation or p]sonally        
id5tifiable in=mation4  7#c7 ,logical   
access control ,! t]m logical access    

control means a process ( grant+ or d5y+
 specific reque/s to obta9 & use        
in=mation & relat$ in=mation process+   
s]vices4  7#d7 ,multi-factor logical    
access controls ,! t]m multi-factor     
logical access controls means a set ( n 
less ?an #b ( ! foll[+ logical access   
controls3 7,a7 ,in=mation t is kn[n to !
 us]1 su* z a password or p]sonal       
id5tification numb]4  7,b7 ,an access   
device t is provid$ to ! us]1 su* z a   
cryptographic id5tification device or   
tok54  7,c7 ,a unique biometric         
*>act]i/ic ( ! us]4  #c4 ,inspector     
,g5]al report on ,f$]al comput] sy/ems  
7a7 ,9 g5]al ,n lat] ?an #bdj days aft] 
! date ( enactm5t ( ?is ,act1 !         
,inspector ,g5]al ( ea* cov]$ ag5cy %all
 ea* submit to ! ,comptroll] ,g5]al ( ! 
,unit$ ,/ates & ! appropriate committees
 ( jurisdiction 9 ! ,s5ate & ! ,h\se (  
,repres5tatives a report1 :i* %all      
include in=mation collect$ f ! cov]$    
ag5cy = ! cont5ts describ$ 9 subsection 
7b7 reg>d+ ! ,f$]al comput] sy/ems ( !  

cov]$ ag5cy4  7b7 ,cont5ts ,! report    
submitt$ by ea* ,inspector ,g5]al ( a   
cov]$ ag5cy "u subsection 7a7 %all      
include1 ) respect to ! cov]$ ag5cy1 !  
foll[+3  7#a7 ,a description ( ! logical
 access /&>ds us$ by ! cov]$ ag5cy to   
access a ,f$]al comput] sy/em t provides
 access to classifi$ or p]sonally       
id5tifiable in=mation1 includ+--  7,a7 9
 aggregate1 a li/ & description (       
logical access controls us$ to access   
su* a ,f$]al comput] sy/em2 &  7,b7 :e!r
 ! cov]$ ag5cy is us+ multi-factor      
logical access controls to access su* a 
,f$]al comput] sy/em4  7#b7 ,if ! cov]$ 
ag5cy does n use logical access controls
 or multi-factor logical access controls
 to access a ,f$]al comput] sy/em t     
provides access to classifi$ or         
p]sonally id5tifiable in=mation1 a      
description ( ! reasons = n us+ su*     
logical access controls or multi-factor 
logical access controls4  7#c7 ,a       
description ( ! foll[+ data security    
managem5t practices us$ by ! cov]$      

ag5cy3 7,a7 ,! policies & proc$ures     
foll[$ to conduct inv5tories ( ! s(tw>e 
pres5t on ! ,f$]al comput] sy/ems ( !   
cov]$ ag5cy & ! lic5ses associat$ ) su* 
s(tw>e4  7,b7 ,:e!r ! cov]$ ag5cy has   
ent]$ into a lic5s+ agreem5t = ! use (  
s(tw>e security controls to monitor &   
detect exfiltration & o!r ?reats1       
includ+--  7i7 data loss prev5tion      
s(tw>e2 or  7ii7 digital rights         
managem5t s(tw>e4  7,c7 ,a description (
 h[ ! cov]$ ag5cy is us+ s(tw>e describ$
 9 subp>agraph 7,b74  7,d7 ,if ! cov]$  
ag5cy has n ent]$ into a lic5s+ agreem5t
 = ! use (1 or is o!rwise n us+1 s(tw>e 
describ$ 9 subp>agraph 7,b71 a          
description ( ! reasons = n ent]+ into  
su* a lic5s+ agreem5t or us+ su* s(tw>e4
  7#d7 ,a description ( ! policies &    
proc$ures ( ! cov]$ ag5cy ) respect to  
ensur+ t entities1 includ+ contractors1 
t provide s]vices to ! cov]$ ag5cy are  
implem5t+ ! data security managem5t     
practices describ$ 9 p>agraph 7#c74  7c7
 ,exi/+ review ,! report requir$ "u ?is 

section may be bas$ 9 :ole or 9 "p on an
 audit1 evaluation1 or report relat+ to 
programs or practices ( ! cov]$ ag5cy1 &
 may be submitt$ z "p ( ano!r report1   
includ+ ! report requir$ "u section     
#ceee ( title #dd1 ,unit$ ,/ates ,code4 
7d7 ,classifi$ in=mation ,a report      
submitt$ "u ?is section %all be 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  7e7 ,availability to  
memb]s ( ,congress ,a report submitt$ "u
 ?is section %all be made available ^u  
reque/ by any ,memb] ( ,congress4  #d4  
,,gao economic analysis & report on     
,f$]al comput] sy/ems  7a7 ,report ,n   
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 ! ,comptroll] ,g5]al ( !     
,unit$ ,/ates %all submit to ,congress a
 report exam9+1 includ+ an economic     
analysis (1 any imp$im5ts to ag5cy use (
 effective security s(tw>e & security   
devices4  7b7 ,classifi$ in=mation ,a   
report submitt$ "u ?is section %all be 9
 unclassifi$ =m1 b may include a        
classifi$ annex4