,,ib  ,union ,cal5d> ,no4 #bgf  #aae?   
,,congress  #a/ ,session  ,h4 ,r4 #abbd 
,report ,no4 #aae-cgf  ,,9 ,,! ,,h\se   
,,( ,,repres5tatives  ,febru>y #bg1     
#bjag ,mr4 ,abraham 7= himself1 ,mr4    
,smi? ( ,texas1 ,mr4 ,lucas1 ,mrs4      
,com/ock1 & ,mr4 ,knight7 introduc$ !   
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,sci5ce1 ,space1 &        
,te*nology  ,octob] #ca1                
#bjag;,additional sponsor3 ,mr4         
,sessions  ,octob] #ca1 #bjag ,report$ )
 an am5dm5t1 committ$ to ! ,committee ( 
! ,:ole ,h\se on ! ,/ate ( ! ,union1 &  
ord]$ to be pr9t$ ,/rike out all aft] ! 
enact+ clause & ins]t ! "p pr9t$ 9      
italic ,= text ( introduc$ bill1 see    
copy ( bill z introduc$ on ,febru>y #bg1
 #bjag  ,a ,,bill  ,to am5d ! ,national 
,in/itute ( ,/&>ds & ,te*nology ,act to 
implem5t a framework1 assessm5t1 &      
audits = improv+ ,unit$ ,/ates          
cyb]security4  #a4 ,%ort title ,?is ,act
 may be cit$ z ! ,,ni/ ,cyb]security    
,framework1 ,assessm5t1 & ,audit+ ,act (

 #bjag4  #b4 ,,ni/ mission to address   
cyb]security ?reats ,section #bj7;a77#a7
 ( ! ,national ,in/itute ( ,/&>ds &     
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7;a77#a77 is am5d$ by ins]t+ 1 
emphasiz+ ! pr9ciple t exp&+            
cyb]security ?reats require eng9e]+     
security f ! beg9n+ ( an in=mation      
sy/em's life cycle1 build+ m tru/wor?y &
 secure compon5ts & sy/ems f ! />t1 &   
apply+ well-def9$ security design       
pr9ciples ?r\gh\t be=e ! semicolon4  #c4
 ,implem5tation ( ,cyb]security         
,framework ,! ,national ,in/itute (     
,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 
#bga et seq47 is am5d$ by ins]t+ aft]   
section #bj ! foll[+3  #bj;,a4          
,framework = ,improv+ ,critical         
,infra/ructure ,cyb]security  7a7       
,implem5tation by ,f$]al ag5cies ,!     
,in/itute %all promote ! implem5tation  
by ,f$]al ag5cies ( ! ,framework =      
,improv+ ,critical ,infra/ructure       
,cyb]security 79 ?is section & section  
#bj;,b ref]r$ to z ! ,framework7 by     

provid+ to ! ,(fice ( ,managem5t &      
,budget1 ! ,(fice ( ,sci5ce & ,te*nology
 ,policy1 & all o!r ,f$]al ag5cies1 n   
lat] ?an #f mon?s aft] ! date ( enactm5t
 ( ! ,,ni/ ,cyb]security ,framework1    
,assessm5t1 & ,audit+ ,act ( #bjag1     
guidance t ,f$]al ag5cies may use to    
incorporate ! ,framework into _!        
in=mation security risk managem5t ef=ts1
 includ+ practices relat$ to compliance 
) *apt] #ce ( title #dd1 ,unit$ ,/ates  
,code1 & any o!r applicable ,f$]al law4 
7b7 ,guidance ,! guidance requir$ "u    
subsection 7a7 %all-- 7#a7 describe h[ !
 ,framework aligns ) or augm5ts exi/+   
ag5cy practices relat$ to compliance )  
*apt] #ce ( title #dd1 ,unit$ ,/ates    
,code1 & any o!r applicable ,f$]al law2 
7#b7 id5tify any areas ( conflict or    
ov]lap betwe5 ! ,framework & exi/+      
cyb]security requirem5ts1 includ+ gap   
areas :]e additional policies1 /&>ds1   
guidel9es1 or programs may be ne$$ to   
enc\rage ,f$]al ag5cies to use !        
,framework & improve ! ability ( ,f$]al 

ag5cies to manage cyb]security risk2    
7#c7 include a template = ,f$]al ag5cies
 on h[ to use ! ,framework1 & recomm5d  
proc$ures = /reaml9+ & h>moniz+ exi/+ & 
future cyb]security-relat$ requirem5ts1 
9 support ( ! goal ( us+ ! ,framework to
 supplant ,f$]al ag5cy practices 9      
compliance ) *apt] #ce ( title #dd1     
,unit$ ,/ates ,code2  7#d7 recomm5d o!r 
proc$ures = compliance ) cyb]security   
report+1 ov]sight1 & policy review &    
creation requirem5ts "u su* *apt] #ce & 
any o!r applicable ,f$]al law2 &  7#e7  
be updat$1 z ! ,in/itute consid]s       
necess>y1 to reflect :at ! ,in/itute    
le>ns f ongo+ rese>*1 ! audits conduct$ 
pursuant to section #bj;,b7c71 !        
in=mation compil$ by ! ,f$]al work+ gr\p
 e/abli%$ pursuant to subsection 7c71 & 
! annual reports publi%$ pursuant to    
subsection 7d74  7c7 ,f$]al work+ gr\p  
,n lat] ?an #c mon?s aft] ! date (      
enactm5t ( ! ,,ni/ ,cyb]security        
,framework1 ,assessm5t1 & ,audit+ ,act (
 #bjag1 ! ,in/itute %all e/abli% & *air 

a work+ gr\p 79 ?is section ref]r$ to z 
! ,f$]al work+ gr\p71 includ+           
repres5tatives ( ! ,(fice ( ,managem5t &
 ,budget1 ! ,(fice ( ,sci5ce &          
,te*nology ,policy1 & o!r appropriate   
,f$]al ag5cies1 :i* %all--  7#a7 n lat] 
?an #f mon?s aft] ! date ( enactm5t ( ! 
,,ni/ ,cyb]security ,framework1         
,assessm5t1 & ,audit+ ,act ( #bjag1     
develop outcome-bas$ & quantifiable     
metrics to help ,f$]al ag5cies 9 _!     
analysis & assessm5t ( ! effectiv5ess ( 
! ,framework 9 protect+ _! in=mation &  
in=mation sy/ems2  7#b7 update su*      
metrics z ! ,f$]al work+ gr\p consid]s  
necess>y2  7#c7 compile in=mation f     
,f$]al ag5cies on _! use ( ! ,framework 
& ! results ( ! analysis & assessm5t    
describ$ 9 p>agraph 7#a72 &  7#d7 assi/ 
! ,(fice ( ,managem5t & ,budget & !     
,(fice ( ,sci5ce & ,te*nology ,policy 9 
publi%+ ! annual report requir$ "u      
subsection 7d74  7d7 ,report ,! ,(fice (
 ,managem5t & ,budget & ! ,(fice (      
,sci5ce & ,te*nology ,policy %all       

develop & make publicly available an    
annual report on ag5cy adoption rates & 
! effectiv5ess ( ! ,framework4 ,9 prep>+
 su* report1 ! ,(fices %all use !       
in=mation compil$ by ! ,f$]al work+ gr\p
 pursuant to subsection 7c77#c74        
#bj;,b4 ,cyb]security audits  7a7       
,initial assessm5t  7#a7 ,requirem5t ,n 
lat] ?an #f mon?s aft] ! date ( enactm5t
 ( ! ,,ni/ ,cyb]security ,framework1    
,assessm5t1 & ,audit+ ,act ( #bjag1 !   
,in/itute %all complete an initial      
assessm5t ( ! cyb]security prep>$ness ( 
! ag5cies describ$ 9 p>agraph 7#b74 ,su*
 assessm5t %all be bas$ on in=mation    
security /&>ds develop$ "u section #bj1 
& may also be in=m$ by "w done or       
reports publi%$ by o!r ,f$]al ag5cies or
 (ficials4  7#b7 ,ag5cies ,! ag5cies    
ref]r$ to 9 p>agraph 7#a7 are ! ag5cies 
ref]r$ to 9 section #ija7;b7 ( title    
#ca1 ,unit$ ,/ates ,code1 & any o!r     
ag5cy t has report$ a major incid5t 7z  
def9$ 9 ! ,(fice ( ,managem5t & ,budget 
,memor&um--#af--jc1 publi%$ on ,octob]  

#cj1 #bjae1 or any successor docum5t74  
7#c7 ,national security sy/ems ,!       
requirem5t "u p>agraph 7#a7 %all n apply
 to national security sy/ems 7z def9$ 9 
section #ceeb7;b7 ( title #dd1 ,unit$   
,/ates ,code74  7b7 ,audit plan ,n lat] 
?an #f mon?s aft] ! date ( enactm5t (   
?is ,act1 ! ,in/itute %all prep>e a     
ne$s-bas$ plan = c>ry+ out ! audits (   
ag5cies z requir$ "u subsection 7c74    
,su* plan %all include a description (  
/aff+ plans1 work=ce capabilities1      
me?ods = conduct+ su* audits1           
coord9ation ) ag5cies to support su*    
audits1 expect$ timeframes = !          
completion ( audits1 & o!r in=mation !  
,in/itute consid]s relevant4 ,! plan    
%all be transmitt$ by ! ,in/itute to !  
congressional entities describ$ 9       
subsection 7c77#d77;,f74  7c7 ,audits   
7#a7 ,requirem5t ,n lat] ?an #f mon?s   
aft] ! date ( enactm5t ( ! ,,ni/        
,cyb]security ,framework1 ,assessm5t1 & 
,audit+ ,act ( #bjag1 ! ,in/itute %all  
initiate an individual cyb]security     

audit ( ea* ag5cy describ$ 9 subsection 
7a77#b71 to assess ! ext5t to :i* !     
ag5cy is meet+ ! in=mation security     
/&>ds develop$ "u section #bj4  7#b7    
,relation to ,framework ,audits conduct$
 "u ?is subsection %all-- 7,a7 to !     
ext5t applicable & available1 be in=m$  
by ! report on ag5cy adoption rates & ! 
effectiv5ess ( ! ,framework describ$ 9  
section #bj;,a7d72 &  7,b7 if ! ag5cy is
 requir$ by law or executive ord] to    
adopt ! ,framework1 be bas$ on !        
guidance describ$ 9 section #bj;,a7b7 & 
metrics develop$ "u section             
#bj;,a7c77#a74  7#c7 ,s*$ule ,!         
,in/itute %all e/abli% a s*$ule =       
completion ( audits "u ?is subsection to
 ensure t--  7,a7 audits ( ag5cies ^:   
in=mation security risk is high1 bas$ on
 ! assessm5t conduct$ "u subsection 7a71
 are complet$ n lat] ?an #a ye> aft] !  
date ( enactm5t ( ! ,,ni/ ,cyb]security 
,framework1 ,assessm5t1 & ,audit+ ,act (
 #bjag1 & are audit$ annually !reaft]2 &
  7,b7 audits ( all o!r ag5cies describ$

 9 subsection 7a77#b7 are complet$ n    
lat] ?an #b ye>s aft] ! date ( enactm5t 
( ! ,,ni/ ,cyb]security ,framework1     
,assessm5t1 & ,audit+ ,act ( #bjag1 &   
are audit$ bi5nially !reaft]4  7#d7     
,report ,a report ( ea* audit conduct$  
"u ?is subsection %all be transmitt$ by 
! ,in/itute to-- 7,a7 ! ,(fice (        
,managem5t & ,budget2  7,b7 ! ,(fice (  
,sci5ce & ,te*nology ,policy2  7,c7 !   
,gov]nm5t ,acc\ntability ,(fice2  7,d7 !
 ag5cy be+ audit$2  7,e7 ! ,inspector   
,g5]al ( su* ag5cy1 if !re is "o2 &     
7,f7 ,congress1 includ+ ! ,committee on 
,sci5ce1 ,space1 & ,te*nology ( ! ,h\se 
( ,repres5tatives & ! ,committee on     
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate4  4  ,octob] #ca1 #bjag ,report$
 ) an am5dm5t1 committ$ to ! ,committee 
( ! ,:ole ,h\se on ! ,/ate ( ! ,union1 &
 ord]$ to be pr9t$