,i  #aaeth ,,congress  #b;d ,session    
,h4 ,r4 #gbhc  ,,in ,,the ,,house ,,of  
,,representatives  ,december #ab1       
#bjah,ms4 ,kelly of ,illinois 7for      
herself and ,mr4 ,ted ,lieu of          
,california7 introduced the following   
bill2 which was referred to the         
,committee on ,oversight and ,government
 ,reform1 and in addition to the        
,committee on ,science1 ,space1 and     
,technology1 for a period to be         
subsequently determined by the ,speaker1
 in each case for consideration of such 
provisions as fall within the           
jurisdiction of the committee concerned 
,a ,,bill  ,to provide minimal          
cybersecurity operational standards for 
,internet-connected devices purchased by
 ,federal agencies1 and for other       
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,internet of ,things
 7,io,t7 ,federal ,cybersecurity        
,improvement ,act of #bjah4  #b4        
,findings2 sense of ,congress  7a7      
,findings ,congress finds the following3

  7#a7 ,the trust of the ,american      
people in the safety and security of    
their ,government's digital             
technologies1 including the ,internet of
 ,things1 is vital for advancing digital
 technology transformation4  7#b7       
,digital technology transformation      
portends tremendous opportunity for our 
nation to improve the daily lives of the
 ,american people and grow the economy4 
7#c7 ,the risk of exposure of           
,government1 businesses1 and individual 
citizens to malicious cyberattacks grows
 dramatically if digital transformation 
is not managed with vigorous attention  
to cybersecurity concerns1 and failure  
to protect the ,government systems that 
control our critical infrastructure and 
essential ,government networks could    
have devastating consequences4  7#d7    
,intelligence and national security     
leaders1 including the ,director of the 
,defense ,intelligence ,agency1 have    
described ,internet of ,things 7,io,t7  
devices as among the most important     

emerging cyberthreats to our national   
security4  7#e7 ,the ,federal           
,government cannot achieve a high level 
of cybersecurity unless cybersecurity   
becomes the task of every person        
involved with ,federal networks and     
devices4  7#f7 ,anchoring responsibility
 for cybersecurity at the top of        
governmental organizations is critical  
to set the correct mindset that         
enhancing cybersecurity of the ,federal 
,government's networks and devices is   
the responsibility of every ,government 
employee to the extent practicable4  7b7
 ,sense of ,congress ,it is the sense of
 ,congress that-- 7#a7 ensuring the     
highest level of cybersecurity at       
,government agencies is the             
responsibility of the ,president1       
followed by the ,director of the ,office
 of ,management and ,budget1 and the    
head of each executive agency2  7#b7    
this responsibility is to be carried out
 by working collaboratively within and  
among executive agencies1 industry1 and 

academia2 and  7#c7 the strength of the 
,government's cybersecurity and the     
positive benefits of digital technology 
transformation depend on proactively    
addressing cybersecurity throughout the 
,government's acquisition and operation 
of ,io,t devices4  #c4 ,contractor      
minimum security requirements for       
covered devices  7a7 ,standard security 
clause required in covered devices  7#a7
 ,in general ,not later than #ahj days  
after the date of the enactment of this 
,act1 the ,director in consultation with
 the ,secretary of ,defense1 the        
,administrator of ,general ,services1   
the ,secretary of ,commerce1 the        
,secretary of ,homeland ,security1 and  
any other intelligence or national      
security agency that the ,director      
determines to be necessary shall issue  
guidelines for each executive agency    
that require the inclusion of a standard
 security clause in any contract 7except
 as provided in paragraph 7#d77 for the 
acquisition of covered devices4  7#b7   

,contents of standard security clause   
,the standard security clause required  
under paragraph 7#a7 shall-- 7,a7       
establish baseline security requirements
 that address aspects of device security
 relating to covered devices1           
including--  7i7 a requirement that     
software or firmware components accept  
properly authenticated and trusted      
updates from the vendor2  7ii7          
requirements relating to identity and   
access management1 including a          
prohibition of the use of fixed or      
hard-coded credentials used for remote  
administration1 the delivery of updates1
 or communication2  7iii7 a requirement 
that the contractor participate in a    
coordinated vulnerability disclosure    
program training on the guidelines      
issued pursuant to subsection 7f72 and  
7iv7 any other requirement the ,director
 determines to be appropriate2  7,b7    
require contractors to provide written  
attestation that the device meets such  
requirements as established under       

subparagraph 7,a72  7,c7 to the maximum 
extent practicable1 ensure that the     
requirements established under          
subparagraph 7,a7 are--  7i7 tailored to
 address the characteristics of         
different types of devices1 including   
risk and intended function2  7ii7 based 
on technology-neutral1 outcome-based    
security principles2  7iii7 developed   
through a transparent process that      
incorporates input from relevant        
stakeholders in industry and academia2  
7iv7 aligned with internationally       
recognized technical standards2 and  7v7
 updated regularly based on developments
 in technology and security             
methodologies2  7,d7 an identification  
of contractor responsibilities to ensure
 that a covered device software or      
firmware component is updated or        
replaced1 consistent with other         
provisions in the contract governing the
 term of support1 in a manner that      
allows for any future security          
vulnerability or defect in any part of  

the software or firmware to be patched1 
based on risk1 in order to fix or remove
 a vulnerability or defect in the       
software or firmware component in a     
properly authenticated and secure       
manner2 and  7,e7 a requirement for the 
contractor to provide the purchasing    
agency with general information on the  
ability of the device to be updated1    
such as--  7i7 the manner in which the  
device receives security updates2  7ii7 
the business terms1 including any fees  
for ongoing security support1 under     
which security updates will be provided 
for a covered device2  7iii7 the        
anticipated timeline for ending security
 support associated with the covered    
device2  7iv7 formal notification when  
security support has ceased2 and  7v7   
any other information the ,director     
determines to be necessary4  7#c7       
,voluntary consensus standards ,the     
,director shall ensure that1 to the     
maximum extent practicable1 the baseline
 security described in paragraph        

7#b77;,a7 reflects and aligns with      
existing voluntary consensus standards4 
7#d7 ,waiver of requirement by agencies 
,the ,director may establish a process  
for the ,chief ,information ,officer of 
an executive agency to waive the        
requirements under this subsection for a
 case in which a petition is submitted  
by an entity seeking to enter into a    
contract with the executive agency and  
the following requirements are met3     
7,a7 ,a waiver is granted only in       
limited circumstances1 including when an
 entity demonstrates that a covered     
device meets a desired level of security
 through means other than those required
 under paragraph 7#b77;,a7 or when the  
executive agency reasonably believes    
that procurement of a covered device    
with limited data processing and        
software functionality would be         
unfeasible or economically impractical4 
7,b7 ,the ,chief ,information ,officer  
of an executive agency that approves a  
waiver under this paragraph shall       

provide the entity a written statement  
that the executive agency accepts any   
risk resulting from use of the covered  
device4  7#e7 ,alignment with ,,fisma   
,in issuing the guidelines required     
under paragraph 7#a71 the ,director1 in 
consultation with the ,administrator of 
,general ,services1 shall ensure that   
such guidelines are1 to the greatest    
extent practicable1 consistent with1    
non-duplicative of1 and in compliance   
with any applicable established         
information security policies1          
procedures1 standards1 and compliance   
requirements under the subchapter ,,ii  
of chapter #ce of title #dd1 ,united    
,states ,code4  7b7 ,alternate          
conditions ,to mitigate cybersecurity   
risks  7#a7 ,in general ,not later than 
one year after the date of the enactment
 of this ,act1 the ,director1 in        
consultation with ,,nist1 shall define a
 set of conditions that--  7,a7 ensure a
 non-compliant device can be used with a
 level of security that is equivalent or

 greater to the baseline security       
requirements described in subsection    
7a77#b72 and  7,b7 shall be met in order
 for an executive agency to purchase    
such a non-compliant device4  7#b7      
,requirements ,in defining the set of   
conditions that must be met for         
non-compliant devices required under    
paragraph 7#a71 the ,director1 in       
consultation with ,,nist and relevant   
industry entities1 may consider the use 
of conditions1 including--  7,a7 network
 segmentation or micro-segmentation2    
7,b7 the adoption of system level       
security controls1 including operating  
system containers and microservices2    
7,c7 multi-factor authentication2 and   
7,d7 network access control and edge    
systems1 such as gateways1 that can     
isolate1 disable1 or remediate connected
 devices4  7#c7 ,specification of       
additional precautions ,to address the  
long-term risk of non-compliant devices 
acquired in accordance with an exception
 under this subsection1 the ,director1  

in consultation with ,,nist and         
private-sector industry experts and1    
with respect to medical devices         
regulated under the ,federal ,food1     
,drug1 and ,cosmetics ,act1 in          
consultation with the ,commissioner of  
,food and ,drugs1 may stipulate         
additional requirements for management  
and use of non-compliant devices1       
including deadlines for the removal1    
replacement1 or disabling of            
non-compliant devices 7or their         
,internet-connectivity71 as well as     
minimal requirements for gateway        
products to ensure the integrity and    
security of the non-compliant devices4  
7#d7 ,existing third-party security     
standard  7,a7 ,in general ,if a        
voluntary consensus standard for the    
security of covered devices provides an 
equivalent or greater level of security 
to that described in subsection 7a77#b71
 the ,director shall modify the         
requirements under subsection 7a77#a7   
and the security clause under subsection

 7a77#b7 to reflect conformity with that
 voluntary consensus standard4  7,b7    
,written certification ,a contractor    
providing a covered device shall provide
 third-party written certification that 
the device complies with the security   
requirements of the industry            
certification method of the third party4
  7,c7 ,,nist ,,nist1 in consultation   
with the ,director and the heads of     
other appropriate executive agencies1   
shall determine--  7i7 accreditation    
standards for third-party certifiers2   
and  7ii7 whether the standards         
described in clause 7i7 provide         
appropriate security and are aligned    
with the guidelines issued under        
subsection 7a74  7#e7 ,existing agency  
security evaluation standards  7,a7 ,in 
general ,if an executive agency employs 
a security evaluation process or        
criteria for covered devices that the   
agency believes provides an equivalent  
or greater level of security to the     
baseline security requirements described

 in subsection 7a77#b71 an executive    
agency may1 upon the approval of the    
,director1 continue to use that process 
or criteria in lieu of the requirements 
under subsection 7a77#b74  7,b7 ,,nist  
,,nist1 in consultation with the        
,director and the heads of other        
appropriate executive agencies1 shall   
determine whether the process or        
criteria described in subparagraph 7,a7 
provides appropriate security and is    
aligned with the guidelines issued under
 subsection 7a74  7c7 ,guidelines for   
lowest price technically acceptable     
source selection ,not later than #ahj   
days after the date of the enactment of 
this ,act1 the ,director1 in            
consultation with the ,administrator of 
,general ,services1 shall issue         
guidelines for each executive agency to 
limit1 to the maximum extent            
practicable1 the use of lowest price    
technically acceptable source selection 
criteria in the case of a procurement   
that is predominately for the           

acquisition of a covered device4  7d7   
,report to ,congress ,not later than #e 
years after the date of the enactment of
 this ,act1 the ,director shall submit  
to ,congress a report on the            
effectiveness of the guidelines required
 to be issued under subsections 7a7 and 
7c71 which shall include                
recommendations1 if any1 for legislation
 necessary to improve cybersecurity in  
executive agency acquisition of covered 
devices4  7e7 ,general waiver authority 
for ,director ,beginning on the date    
that is #e years after the date of the  
enactment of this ,act1 the ,director   
may waive1 in whole or in part1 the     
requirements of the guidelines or set of
 conditions issued under this section1  
for an executive agency4  7f7           
,guidelines regarding the coordinated   
disclosure of security vulnerabilities  
and defects  7#a7 ,in general ,not later
 than #ahj days after the date of the   
enactment of this ,act1 the ,director1  
in consultation with the ,department of 

,homeland ,security and the ,department 
of ,justice1 and cybersecurity          
researchers and private-sector industry 
experts1 shall issue guidelines for each
 executive agency with respect to any   
covered device in use by the ,united    
,states ,government regarding           
cybersecurity coordinated disclosure    
requirements that shall be required of  
contractors providing such covered      
devices to those executive agencies4    
7#b7 ,contents ,the guidelines required 
under paragraph 7#a7 shall include      
policies and procedures for the         
processing and resolving of potential   
vulnerability information relating to a 
covered device1 which shall be1 to the  
maximum extent practicable1 aligned with
 ,standards #biadg and #cjaaa of the    
,international ,standards ,organization1
 or any successor standard1 such as--   
7,a7 procedures for the provision of a  
covered device to executive agencies by 
a contractor on how to-- 7i7 receive    
information about potential             

vulnerabilities in the product or online
 service of the contractor2 and  7ii7   
disseminate resolution information about
 vulnerabilities in the product or      
online service of the contractor2 and   
7,b7 guidance1 including example        
content1 on the information items that  
should be produced through the          
implementation of the vulnerability     
disclosure process of the contractor4   
7g7 ,revision of ,,far ,the ,federal    
,acquisition ,regulations ,system shall 
be revised to require the inclusion of a
 standard security clause consistent    
with the requirements of this section4  
#d4 ,inventory of devices  7a7 ,in      
general ,not later than one year after  
the date of the enactment of this ,act1 
the head of each executive agency shall 
establish and maintain an inventory of  
covered devices used by the agency      
procured under the requirements of this 
,act4  7b7 ,guidelines ,not later than  
#cj days after the date of the enactment
 of this ,act1 the ,director1 in        

consultation with the ,secretary of     
,homeland ,security1 shall issue        
guidelines for executive agencies to    
develop and manage the inventories      
required under subsection 7a71 based on 
the ,continuous ,diagnostics and        
,mitigation program used by the         
,department of ,homeland ,security4  7c7
 ,device databases  7#a7 ,in general    
,not later than #ahj days after the date
 of the enactment of this ,act1 the     
,secretary of ,homeland ,security1 in   
consultation with the ,director shall   
establish and maintain--  7,a7 a        
database of non-compliant devices and   
the manufacturers of such devices2 and  
7,b7 a database of covered devices and  
the manufacturers of such devices about 
which the ,government has received      
formal notification of security support 
ceasing1 as required under section      
#c7;a77#b77;,e77iv74  7#b7 ,updates ,the
 ,secretary of ,homeland ,security shall
 update the databases established under 
paragraph 7#a7 not less frequently than 

every #cj days4  #e4 ,use of best       
practices in identification and tracking
 of vulnerabilities for purposes of the 
national vulnerability database ,the    
,director of ,,nist shall ensure that   
,,nist establishes1 maintains1 and uses 
best practices in the identification and
 tracking of vulnerabilities for        
purposes of the ,national ,vulnerability
 ,database of ,,nist4  #f4 ,definitions 
,in this ,act3 7#a7 ,covered device     
7,a7 ,in general ,the term covered      
device--  7i7 means a physical object   
that-- 7,i7 is capable of connecting to 
and is in regular connection with the   
,internet2 and  7,,ii7 has computer     
processing capabilities that can        
collect1 send1 or receive data2 and     
7ii7 does not include advanced or       
general-purpose computing devices1      
including personal computing systems1   
smart mobile communications devices1    
programmable logic controls1 and        
mainframe computing systems4  7,b7 ,,omb
 exemption ,the ,director may exempt    

additional devices under subparagraph   
7,a77ii7 through a process in which     
interested parties may submit a petition
 for the exemption4 ,the ,director shall
 act in an expedited manner on any such 
petition submitted4  7#b7 ,director ,the
 term ,director means the ,director of  
the ,office of ,management and ,budget4 
7#c7 ,executive agency ,the term        
executive agency has the meaning given  
the term in section #acc of title #da1  
,united ,states ,code4  7#d7 ,firmware  
,the term firmware means a computer     
program and the data stored in hardware1
 typically in read-only memory or       
programmable read-only memory1 such that
 the program and data cannot be         
dynamically written or modified during  
execution of the program4  7#e7 ,fixed  
or hard-coded credential ,the term fixed
 or hard-coded credential means a value1
 such as a password1 token1             
cryptographic key1 or other data element
 used as part of an authentication      
mechanism for granting remote access to 

an information system or the information
 of the system1 that is--  7,a7         
established by a product vendor or      
service provider2 and  7,b7 incapable of
 being modified or revoked by the user  
or manufacturer lawfully operating the  
information system1 except through a    
firmware update4  7#f7 ,gateway product 
,the term gateway product means a node  
or device that connects to multiple     
networks using standard protocols4  7#g7
 ,hardware ,the term hardware means the 
physical components of an information   
system4  7#h7 ,,nist ,the term ,,nist   
means the ,national ,institute of       
,standards and ,technology4  7#i7       
,non-compliant device ,the term         
non-compliant device means a covered    
device that does not meet the baseline  
security requirements established in    
section #c7;a77#b77;,a74  7#aj7         
,properly authenticated update ,the term
 properly authenticated update means an 
update1 remediation1 or technical fix to
 a hardware1 firmware1 or software      

component issued by a product vendor or 
service provider used to correct        
particular problems with the component1 
and that1 in the case of software or    
firmware1 contains some method of       
authenticity protection1 such as a      
digital signature1 so that unauthorized 
updates and rollbacks of authorized     
updates can be automatically detected   
and rejected4  7#aa7 ,security          
vulnerability ,the term security        
vulnerability means any attribute of    
hardware1 firmware1 software1 process1  
or procedure or a combination of #b or  
more of these attributes that could     
enable or facilitate the defeat or      
compromise of the confidentiality1      
integrity1 or availability of an        
information system or the information or
 physical devices of an information     
system to which an information system is
 connected4  7#ab7 ,software ,the term  
software means a computer program and   
associated data that may be dynamically 
written or modified4  7#ac7 ,vendor ,the

 term vendor1 with respect to a         
technology1 product1 system1 service1 or
 application1 means--  7,a7 in the case 
of a purchase by the ,government1 the   
entity that developed the technology1   
product1 system1 service1 or            
application2 or  7,b7 in the case of a  
purchase by a contractor1 the entity    
that is responsible for maintaining the 
technology1 product1 system1 service1 or
 application4  #g4 ,applicability ,this 
,act shall apply with respect to any    
contract entered into on and after the  
date on which the guidelines are issued 
pursuant to section #c7;a74