,,ib ,union ,calendar ,no4 #bgf #aaeth ,,congress #ast ,session ,h4 ,r4 #abbd ,report ,no4 #aae-cgf ,,in ,,the ,,house ,,of ,,representatives ,february #bg1 #bjag ,mr4 ,abraham 7for himself1 ,mr4 ,smith of ,texas1 ,mr4 ,lucas1 ,mrs4 ,comstock1 and ,mr4 ,knight7 introduced the following bill2 which was referred to the ,committee on ,science1 ,space1 and ,technology ,october #ca1 #bjag;,additional sponsor3 ,mr4 ,sessions ,october #ca1 #bjag ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,strike out all after the enacting clause and insert the part printed in italic ,for text of introduced bill1 see copy of bill as introduced on ,february #bg1 #bjag ,a ,,bill ,to amend the ,national ,institute of ,standards and ,technology ,act to implement a framework1 assessment1 and audits for improving ,united ,states cybersecurity4 #a4 ,short title ,this ,act may be cited as the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag4 #b4 ,,nist mission to address cybersecurity threats ,section #bj7;a77#a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a77#a77 is amended by inserting 1 emphasizing the principle that expanding cybersecurity threats require engineering security from the beginning of an information system's life cycle1 building more trustworthy and secure components and systems from the start1 and applying well-defined security design principles throughout before the semicolon4 #c4 ,implementation of ,cybersecurity ,framework ,the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bga et seq47 is amended by inserting after section #bj the following3 #bj;,a4 ,framework for ,improving ,critical ,infrastructure ,cybersecurity 7a7 ,implementation by ,federal agencies ,the ,institute shall promote the implementation by ,federal agencies of the ,framework for ,improving ,critical ,infrastructure ,cybersecurity 7in this section and section #bj;,b referred to as the ,framework7 by providing to the ,office of ,management and ,budget1 the ,office of ,science and ,technology ,policy1 and all other ,federal agencies1 not later than #f months after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 guidance that ,federal agencies may use to incorporate the ,framework into their information security risk management efforts1 including practices related to compliance with chapter #ce of title #dd1 ,united ,states ,code1 and any other applicable ,federal law4 7b7 ,guidance ,the guidance required under subsection 7a7 shall-- 7#a7 describe how the ,framework aligns with or augments existing agency practices related to compliance with chapter #ce of title #dd1 ,united ,states ,code1 and any other applicable ,federal law2 7#b7 identify any areas of conflict or overlap between the ,framework and existing cybersecurity requirements1 including gap areas where additional policies1 standards1 guidelines1 or programs may be needed to encourage ,federal agencies to use the ,framework and improve the ability of ,federal agencies to manage cybersecurity risk2 7#c7 include a template for ,federal agencies on how to use the ,framework1 and recommend procedures for streamlining and harmonizing existing and future cybersecurity-related requirements1 in support of the goal of using the ,framework to supplant ,federal agency practices in compliance with chapter #ce of title #dd1 ,united ,states ,code2 7#d7 recommend other procedures for compliance with cybersecurity reporting1 oversight1 and policy review and creation requirements under such chapter #ce and any other applicable ,federal law2 and 7#e7 be updated1 as the ,institute considers necessary1 to reflect what the ,institute learns from ongoing research1 the audits conducted pursuant to section #bj;,b7c71 the information compiled by the ,federal working group established pursuant to subsection 7c71 and the annual reports published pursuant to subsection 7d74 7c7 ,federal working group ,not later than #c months after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 the ,institute shall establish and chair a working group 7in this section referred to as the ,federal working group71 including representatives of the ,office of ,management and ,budget1 the ,office of ,science and ,technology ,policy1 and other appropriate ,federal agencies1 which shall-- 7#a7 not later than #f months after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 develop outcome-based and quantifiable metrics to help ,federal agencies in their analysis and assessment of the effectiveness of the ,framework in protecting their information and information systems2 7#b7 update such metrics as the ,federal working group considers necessary2 7#c7 compile information from ,federal agencies on their use of the ,framework and the results of the analysis and assessment described in paragraph 7#a72 and 7#d7 assist the ,office of ,management and ,budget and the ,office of ,science and ,technology ,policy in publishing the annual report required under subsection 7d74 7d7 ,report ,the ,office of ,management and ,budget and the ,office of ,science and ,technology ,policy shall develop and make publicly available an annual report on agency adoption rates and the effectiveness of the ,framework4 ,in preparing such report1 the ,offices shall use the information compiled by the ,federal working group pursuant to subsection 7c77#c74 #bj;,b4 ,cybersecurity audits 7a7 ,initial assessment 7#a7 ,requirement ,not later than #f months after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 the ,institute shall complete an initial assessment of the cybersecurity preparedness of the agencies described in paragraph 7#b74 ,such assessment shall be based on information security standards developed under section #bj1 and may also be informed by work done or reports published by other ,federal agencies or officials4 7#b7 ,agencies ,the agencies referred to in paragraph 7#a7 are the agencies referred to in section #ija7;b7 of title #ca1 ,united ,states ,code1 and any other agency that has reported a major incident 7as defined in the ,office of ,management and ,budget ,memorandum--#af--jc1 published on ,october #cj1 #bjae1 or any successor document74 7#c7 ,national security systems ,the requirement under paragraph 7#a7 shall not apply to national security systems 7as defined in section #ceeb7;b7 of title #dd1 ,united ,states ,code74 7b7 ,audit plan ,not later than #f months after the date of enactment of this ,act1 the ,institute shall prepare a needs-based plan for carrying out the audits of agencies as required under subsection 7c74 ,such plan shall include a description of staffing plans1 workforce capabilities1 methods for conducting such audits1 coordination with agencies to support such audits1 expected timeframes for the completion of audits1 and other information the ,institute considers relevant4 ,the plan shall be transmitted by the ,institute to the congressional entities described in subsection 7c77#d77;,f74 7c7 ,audits 7#a7 ,requirement ,not later than #f months after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 the ,institute shall initiate an individual cybersecurity audit of each agency described in subsection 7a77#b71 to assess the extent to which the agency is meeting the information security standards developed under section #bj4 7#b7 ,relation to ,framework ,audits conducted under this subsection shall-- 7,a7 to the extent applicable and available1 be informed by the report on agency adoption rates and the effectiveness of the ,framework described in section #bj;,a7d72 and 7,b7 if the agency is required by law or executive order to adopt the ,framework1 be based on the guidance described in section #bj;,a7b7 and metrics developed under section #bj;,a7c77#a74 7#c7 ,schedule ,the ,institute shall establish a schedule for completion of audits under this subsection to ensure that-- 7,a7 audits of agencies whose information security risk is high1 based on the assessment conducted under subsection 7a71 are completed not later than #a year after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 and are audited annually thereafter2 and 7,b7 audits of all other agencies described in subsection 7a77#b7 are completed not later than #b years after the date of enactment of the ,,nist ,cybersecurity ,framework1 ,assessment1 and ,auditing ,act of #bjag1 and are audited biennially thereafter4 7#d7 ,report ,a report of each audit conducted under this subsection shall be transmitted by the ,institute to-- 7,a7 the ,office of ,management and ,budget2 7,b7 the ,office of ,science and ,technology ,policy2 7,c7 the ,government ,accountability ,office2 7,d7 the agency being audited2 7,e7 the ,inspector ,general of such agency1 if there is one2 and 7,f7 ,congress1 including the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate4 4 ,october #ca1 #bjag ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed