,i  #aae? ,,congress  #b;d ,session  ,h4
 ,r4 #gbhc  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,decemb] #ab1         
#bjah,ms4 ,kelly ( ,ill9ois 7= h]self & 
,mr4 ,t$ ,lieu ( ,cali=nia7 introduc$ ! 
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,ov]sight & ,gov]nm5t     
,re=m1 & 9 addition to ! ,committee on  
,sci5ce1 ,space1 & ,te*nology1 = a p]iod
 to be subsequ5tly det]m9$ by ! ,speak]1
 9 ea* case = consid]ation ( su*        
provisions z fall )9 ! jurisdiction ( ! 
committee conc]n$  ,a ,,bill  ,to       
provide m9imal cyb]security op]ational  
/&>ds = ,int]net-connect$ devices       
pur*as$ by ,f$]al ag5cies1 & = o!r      
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,int]net ( ,?+s 7,io,t7    
,f$]al ,cyb]security ,improvem5t ,act ( 
#bjah4  #b4 ,f9d+s2 s5se ( ,congress    
7a7 ,f9d+s ,congress f9ds ! foll[+3     
7#a7 ,! tru/ ( ! ,am]ican p 9 ! safety &
 security ( _! ,gov]nm5t's digital      
te*nologies1 includ+ ! ,int]net ( ,?+s1 
is vital = advanc+ digital te*nology    

trans=mation4  7#b7 ,digital te*nology  
trans=mation port5ds trem5d\s           
opportunity = our nation to improve !   
daily lives ( ! ,am]ican p & gr[ !      
economy4  7#c7 ,! risk ( exposure (     
,gov]nm5t1 bus9esses1 & individual      
citiz5s to malici\s cyb]attacks gr[s    
dramatically if digital trans=mation is 
n manag$ ) vigor\s att5tion to          
cyb]security conc]ns1 & failure to      
protect ! ,gov]nm5t sy/ems t control our
 critical infra/ructure & ess5tial      
,gov]nm5t networks c\ld h deva/at+      
consequ5ces4  7#d7 ,intellig5ce &       
national security lead]s1 includ+ !     
,director ( ! ,def5se ,intellig5ce      
,ag5cy1 h describ$ ,int]net ( ,?+s      
7,io,t7 devices z among ! mo/ important 
em]g+ cyb]?reats to our national        
security4  7#e7 ,! ,f$]al ,gov]nm5t _c  
a*ieve a high level ( cyb]security      
unless cyb]security becomes ! task ( e  
p]son involv$ ) ,f$]al networks &       
devices4  7#f7 ,an*or+ responsibility = 
cyb]security at ! top ( gov]nm5tal      

organizations is critical to set !      
correct m9dset t enhanc+ cyb]security ( 
! ,f$]al ,gov]nm5t's networks & devices 
is ! responsibility ( e ,gov]nm5t       
employee to ! ext5t practicable4  7b7   
,s5se ( ,congress ,x is ! s5se (        
,congress t-- 7#a7 ensur+ ! highe/ level
 ( cyb]security at ,gov]nm5t ag5cies is 
! responsibility ( ! ,presid5t1 foll[$  
by ! ,director ( ! ,(fice ( ,managem5t &
 ,budget1 & ! head ( ea* executive      
ag5cy2  7#b7 ?is responsibility is to be
 c>ri$ out by work+ collaboratively )9 &
 among executive ag5cies1 indu/ry1 &    
academia2 &  7#c7 ! /r5g? ( !           
,gov]nm5t's cyb]security & ! positive   
b5efits ( digital te*nology trans=mation
 dep5d on proactively address+          
cyb]security ?r\gh\t ! ,gov]nm5t's      
acquisition & op]ation ( ,io,t devices4 
#c4 ,contractor m9imum security         
requirem5ts = cov]$ devices  7a7 ,/&>d  
security clause requir$ 9 cov]$ devices 
7#a7 ,9 g5]al ,n lat] ?an #ahj days aft]
 ! date ( ! enactm5t ( ?is ,act1 !      

,director 9 consultation ) ! ,secret>y (
 ,def5se1 ! ,adm9i/rator ( ,g5]al       
,s]vices1 ! ,secret>y ( ,comm]ce1 !     
,secret>y ( ,homel& ,security1 & any o!r
 intellig5ce or national security ag5cy 
t ! ,director det]m9es to be necess>y   
%all issue guidel9es = ea* executive    
ag5cy t require ! inclusion ( a /&>d    
security clause 9 any contract 7except z
 provid$ 9 p>agraph 7#d77 = !           
acquisition ( cov]$ devices4  7#b7      
,cont5ts ( /&>d security clause ,! /&>d 
security clause requir$ "u p>agraph 7#a7
 %all-- 7,a7 e/abli% basel9e security   
requirem5ts t address aspects ( device  
security relat+ to cov]$ devices1       
includ+--  7i7 a requirem5t t s(tw>e or 
firmw>e compon5ts accept prop]ly        
au!nticat$ & tru/$ updates f ! v5dor2   
7ii7 requirem5ts relat+ to id5tity &    
access managem5t1 includ+ a prohibition 
( ! use ( fix$ or h>d-cod$ cr$5tials us$
 = remote adm9i/ration1 ! deliv]y (     
updates1 or communication2  7iii7 a     
requirem5t t ! contractor p>ticipate 9 a

 coord9at$ vuln]ability disclosure      
program tra9+ on ! guidel9es issu$      
pursuant to subsection 7f72 &  7iv7 any 
o!r requirem5t ! ,director det]m9es to  
be appropriate2  7,b7 require           
contractors to provide writt5 atte/ation
 t ! device meets su* requirem5ts z     
e/abli%$ "u subp>agraph 7,a72  7,c7 to !
 maximum ext5t practicable1 ensure t !  
requirem5ts e/abli%$ "u subp>agraph 7,a7
 are--  7i7 tailor$ to address !        
*>act]i/ics ( diff]5t types ( devices1  
includ+ risk & int5d$ function2  7ii7   
bas$ on te*nology-neutral1 outcome-bas$ 
security pr9ciples2  7iii7 develop$     
?r\gh a transp>5t process t incorporates
 input f relevant /akehold]s 9 indu/ry &
 academia2  7iv7 align$ ) int]nationally
 recogniz$ te*nical /&>ds2 &  7v7 updat$
 regul>ly bas$ on developm5ts 9         
te*nology & security me?odologies2  7,d7
 an id5tification ( contractor          
responsibilities to ensure t a cov]$    
device s(tw>e or firmw>e compon5t is    
updat$ or replac$1 consi/5t ) o!r       

provisions 9 ! contract gov]n+ ! t]m (  
support1 9 a mann] t all[s = any future 
security vuln]ability or defect 9 any "p
 ( ! s(tw>e or firmw>e to be pat*$1 bas$
 on risk1 9 ord] to fix or remove a     
vuln]ability or defect 9 ! s(tw>e or    
firmw>e compon5t 9 a prop]ly au!nticat$ 
& secure mann]2 &  7,e7 a requirem5t = !
 contractor to provide ! pur*as+ ag5cy )
 g5]al in=mation on ! ability ( ! device
 to be updat$1 su* z--  7i7 ! mann] 9   
:i* ! device receives security updates2 
7ii7 ! bus9ess t]ms1 includ+ any fees = 
ongo+ security support1 "u :i* security 
updates w be provid$ = a cov]$ device2  
7iii7 ! anticipat$ timel9e = end+       
security support associat$ ) ! cov]$    
device2  7iv7 =mal notification :5      
security support has ceas$2 &  7v7 any  
o!r in=mation ! ,director det]m9es to be
 necess>y4  7#c7 ,volunt>y cons5sus     
/&>ds ,! ,director %all ensure t1 to !  
maximum ext5t practicable1 ! basel9e    
security describ$ 9 p>agraph 7#b77;,a7  
reflects & aligns ) exi/+ volunt>y      

cons5sus /&>ds4  7#d7 ,waiv] (          
requirem5t by ag5cies ,! ,director may  
e/abli% a process = ! ,*ief ,in=mation  
,(fic] ( an executive ag5cy to waive !  
requirem5ts "u ?is subsection = a case 9
 :i* a petition is submitt$ by an entity
 seek+ to ent] into a contract ) !      
executive ag5cy & ! foll[+ requirem5ts  
are met3  7,a7 ,a waiv] is grant$ only 9
 limit$ circum/ances1 includ+ :5 an     
entity demon/rates t a cov]$ device     
meets a desir$ level ( security ?r\gh   
means o!r ?an ^? requir$ "u p>agraph    
7#b77;,a7 or :5 ! executive ag5cy       
reasonably believes t procurem5t ( a    
cov]$ device ) limit$ data process+ &   
s(tw>e functionality w\ld be unfeasible 
or economically impractical4  7,b7 ,!   
,*ief ,in=mation ,(fic] ( an executive  
ag5cy t approves a waiv] "u ?is p>agraph
 %all provide ! entity a writt5 /atem5t 
t ! executive ag5cy accepts any risk    
result+ f use ( ! cov]$ device4  7#e7   
,alignm5t ) ,,fisma ,9 issu+ ! guidel9es
 requir$ "u p>agraph 7#a71 ! ,director1 

9 consultation ) ! ,adm9i/rator ( ,g5]al
 ,s]vices1 %all ensure t su* guidel9es  
are1 to ! greate/ ext5t practicable1    
consi/5t )1 non-duplicative (1 & 9      
compliance ) any applicable e/abli%$    
in=mation security policies1 proc$ures1 
/&>ds1 & compliance requirem5ts "u !    
sub*apt] ,,ii ( *apt] #ce ( title #dd1  
,unit$ ,/ates ,code4  7b7 ,alt]nate     
conditions ,to mitigate cyb]security    
risks  7#a7 ,9 g5]al ,n lat] ?an "o ye> 
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,director1 9 consultation ) ,,ni/1 %all 
def9e a set ( conditions t--  7,a7      
ensure a non-compliant device c be us$ )
 a level ( security t is equival5t or   
great] to ! basel9e security requirem5ts
 describ$ 9 subsection 7a77#b72 &  7,b7 
%all be met 9 ord] = an executive ag5cy 
to pur*ase su* a non-compliant device4  
7#b7 ,requirem5ts ,9 def9+ ! set (      
conditions t mu/ be met = non-compliant 
devices requir$ "u p>agraph 7#a71 !     
,director1 9 consultation ) ,,ni/ &     
relevant indu/ry entities1 may consid] !

 use ( conditions1 includ+--  7,a7      
network segm5tation or                  
micro-segm5tation2  7,b7 ! adoption (   
sy/em level security controls1 includ+  
op]at+ sy/em conta9]s & micros]vices2   
7,c7 multi-factor au!ntication2 &  7,d7 
network access control & edge sy/ems1   
su* z gateways1 t c isolate1 disable1 or
 rem$iate connect$ devices4  7#c7       
,specification ( additional precautions 
,to address ! long-t]m risk (           
non-compliant devices acquir$ 9         
accordance ) an exception "u ?is        
subsection1 ! ,director1 9 consultation 
) ,,ni/ & private-sector indu/ry exp]ts 
&1 ) respect to m$ical devices regulat$ 
"u ! ,f$]al ,food1 ,drug1 & ,cosmetics  
,act1 9 consultation ) ! ,commission] ( 
,food & ,drugs1 may /ipulate additional 
requirem5ts = managem5t & use (         
non-compliant devices1 includ+ deadl9es 
= ! removal1 replacem5t1 or disabl+ (   
non-compliant devices 7or _!            
,int]net-connectivity71 z well z m9imal 
requirem5ts = gateway products to ensure

 ! integrity & security ( !             
non-compliant devices4  7#d7 ,exi/+     
?ird-p>ty security /&>d  7,a7 ,9 g5]al  
,if a volunt>y cons5sus /&>d = !        
security ( cov]$ devices provides an    
equival5t or great] level ( security to 
t describ$ 9 subsection 7a77#b71 !      
,director %all modify ! requirem5ts "u  
subsection 7a77#a7 & ! security clause  
"u subsection 7a77#b7 to reflect        
con=mity ) t volunt>y cons5sus /&>d4    
7,b7 ,writt5 c]tification ,a contractor 
provid+ a cov]$ device %all provide     
?ird-p>ty writt5 c]tification t ! device
 complies ) ! security requirem5ts ( !  
indu/ry c]tification me?od ( ! ?ird     
p>ty4  7,c7 ,,ni/ ,,ni/1 9 consultation 
) ! ,director & ! heads ( o!r           
appropriate executive ag5cies1 %all     
det]m9e--  7i7 accr$itation /&>ds =     
?ird-p>ty c]tifi]s2 &  7ii7 :e!r ! /&>ds
 describ$ 9 clause 7i7 provide          
appropriate security & are align$ ) !   
guidel9es issu$ "u subsection 7a74  7#e7
 ,exi/+ ag5cy security evaluation /&>ds 

7,a7 ,9 g5]al ,if an executive ag5cy    
employs a security evaluation process or
 crit]ia = cov]$ devices t ! ag5cy      
believes provides an equival5t or great]
 level ( security to ! basel9e security 
requirem5ts describ$ 9 subsection       
7a77#b71 an executive ag5cy may1 ^u !   
approval ( ! ,director1 cont9ue to use t
 process or crit]ia 9 lieu ( !          
requirem5ts "u subsection 7a77#b74  7,b7
 ,,ni/ ,,ni/1 9 consultation ) !        
,director & ! heads ( o!r appropriate   
executive ag5cies1 %all det]m9e :e!r !  
process or crit]ia describ$ 9           
subp>agraph 7,a7 provides appropriate   
security & is align$ ) ! guidel9es issu$
 "u subsection 7a74  7c7 ,guidel9es =   
l[e/ price te*nically acceptable s\rce  
selection ,n lat] ?an #ahj days aft] !  
date ( ! enactm5t ( ?is ,act1 !         
,director1 9 consultation ) !           
,adm9i/rator ( ,g5]al ,s]vices1 %all    
issue guidel9es = ea* executive ag5cy to
 limit1 to ! maximum ext5t practicable1 
! use ( l[e/ price te*nically acceptable

 s\rce selection crit]ia 9 ! case ( a   
procurem5t t is pr$om9ately = !         
acquisition ( a cov]$ device4  7d7      
,report to ,congress ,n lat] ?an #e ye>s
 aft] ! date ( ! enactm5t ( ?is ,act1 ! 
,director %all submit to ,congress a    
report on ! effectiv5ess ( ! guidel9es  
requir$ to be issu$ "u subsections 7a7 &
 7c71 :i* %all include recomm5dations1  
if any1 = legislation necess>y to       
improve cyb]security 9 executive ag5cy  
acquisition ( cov]$ devices4  7e7 ,g5]al
 waiv] au?ority = ,director ,beg9n+ on !
 date t is #e ye>s aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,director may    
waive1 9 :ole or 9 "p1 ! requirem5ts ( !
 guidel9es or set ( conditions issu$ "u 
?is section1 = an executive ag5cy4  7f7 
,guidel9es reg>d+ ! coord9at$ disclosure
 ( security vuln]abilities & defects    
7#a7 ,9 g5]al ,n lat] ?an #ahj days aft]
 ! date ( ! enactm5t ( ?is ,act1 !      
,director1 9 consultation ) ! ,dep>tm5t 
( ,homel& ,security & ! ,dep>tm5t (     
,ju/ice1 & cyb]security rese>*]s &      

private-sector indu/ry exp]ts1 %all     
issue guidel9es = ea* executive ag5cy ) 
respect to any cov]$ device 9 use by !  
,unit$ ,/ates ,gov]nm5t reg>d+          
cyb]security coord9at$ disclosure       
requirem5ts t %all be requir$ (         
contractors provid+ su* cov]$ devices to
 ^? executive ag5cies4  7#b7 ,cont5ts ,!
 guidel9es requir$ "u p>agraph 7#a7 %all
 include policies & proc$ures = !       
process+ & resolv+ ( pot5tial           
vuln]ability in=mation relat+ to a cov]$
 device1 :i* %all be1 to ! maximum ext5t
 practicable1 align$ ) ,/&>ds #biadg &  
#cjaaa ( ! ,int]national ,/&>ds         
,organization1 or any successor /&>d1   
su* z--  7,a7 proc$ures = ! provision ( 
a cov]$ device to executive ag5cies by a
 contractor on h[ to-- 7i7 receive      
in=mation ab\t pot5tial vuln]abilities 9
 ! product or onl9e s]vice ( !          
contractor2 &  7ii7 dissem9ate          
resolution in=mation ab\t vuln]abilities
 9 ! product or onl9e s]vice ( !        
contractor2 &  7,b7 guidance1 includ+   

example cont5t1 on ! in=mation items t  
%\ld be produc$ ?r\gh ! implem5tation ( 
! vuln]ability disclosure process ( !   
contractor4  7g7 ,revision ( ,,f> ,!    
,f$]al ,acquisition ,regulations ,sy/em 
%all be revis$ to require ! inclusion ( 
a /&>d security clause consi/5t ) !     
requirem5ts ( ?is section4  #d4         
,inv5tory ( devices  7a7 ,9 g5]al ,n    
lat] ?an "o ye> aft] ! date ( ! enactm5t
 ( ?is ,act1 ! head ( ea* executive     
ag5cy %all e/abli% & ma9ta9 an inv5tory 
( cov]$ devices us$ by ! ag5cy procur$  
"u ! requirem5ts ( ?is ,act4  7b7       
,guidel9es ,n lat] ?an #cj days aft] !  
date ( ! enactm5t ( ?is ,act1 !         
,director1 9 consultation ) ! ,secret>y 
( ,homel& ,security1 %all issue         
guidel9es = executive ag5cies to develop
 & manage ! inv5tories requir$ "u       
subsection 7a71 bas$ on ! ,cont9u\s     
,diagno/ics & ,mitigation program us$ by
 ! ,dep>tm5t ( ,homel& ,security4  7c7  
,device databases  7#a7 ,9 g5]al ,n lat]
 ?an #ahj days aft] ! date ( ! enactm5t 

( ?is ,act1 ! ,secret>y ( ,homel&       
,security1 9 consultation ) ! ,director 
%all e/abli% & ma9ta9--  7,a7 a database
 ( non-compliant devices & !            
manufactur]s ( su* devices2 &  7,b7 a   
database ( cov]$ devices & !            
manufactur]s ( su* devices ab\t :i* !   
,gov]nm5t has receiv$ =mal notification 
( security support ceas+1 z requir$ "u  
section #c7;a77#b77;,e77iv74  7#b7      
,updates ,! ,secret>y ( ,homel&         
,security %all update ! databases       
e/abli%$ "u p>agraph 7#a7 n less        
frequ5tly ?an e #cj days4  #e4 ,use (   
be/ practices 9 id5tification & track+ (
 vuln]abilities = purposes ( ! national 
vuln]ability database ,! ,director (    
,,ni/ %all ensure t ,,ni/ e/abli%es1    
ma9ta9s1 & uses be/ practices 9 !       
id5tification & track+ ( vuln]abilities 
= purposes ( ! ,national ,vuln]ability  
,database ( ,,ni/4  #f4 ,def9itions ,9  
?is ,act3 7#a7 ,cov]$ device  7,a7 ,9   
g5]al ,! t]m cov]$ device--  7i7 means a
 physical object t-- 7,i7 is capable (  

connect+ to & is 9 regul> connection ) !
 ,int]net2 &  7,,ii7 has comput]        
process+ capabilities t c collect1 s5d1 
or receive data2 &  7ii7 does n include 
advanc$ or g5]al-purpose comput+        
devices1 includ+ p]sonal comput+ sy/ems1
 sm>t mobile communications devices1    
programmable logic controls1 & ma9frame 
comput+ sy/ems4  7,b7 ,,omb exemption ,!
 ,director may exempt additional devices
 "u subp>agraph 7,a77ii7 ?r\gh a process
 9 :i* int]e/$ p>ties may submit a      
petition = ! exemption4 ,! ,director    
%all act 9 an exp$it$ mann] on any su*  
petition submitt$4  7#b7 ,director ,!   
t]m ,director means ! ,director ( !     
,(fice ( ,managem5t & ,budget4  7#c7    
,executive ag5cy ,! t]m executive ag5cy 
has ! mean+ giv5 ! t]m 9 section #acc ( 
title #da1 ,unit$ ,/ates ,code4  7#d7   
,firmw>e ,! t]m firmw>e means a comput] 
program & ! data /or$ 9 h>dw>e1         
typically 9 read-only memory or         
programmable read-only memory1 su* t !  
program & data _c be dynamically writt5 

or modifi$ dur+ execution ( ! program4  
7#e7 ,fix$ or h>d-cod$ cr$5tial ,! t]m  
fix$ or h>d-cod$ cr$5tial means a value1
 su* z a password1 tok51 cryptographic  
key1 or o!r data elem5t us$ z "p ( an   
au!ntication me*anism = grant+ remote   
access to an in=mation sy/em or !       
in=mation ( ! sy/em1 t is--  7,a7       
e/abli%$ by a product v5dor or s]vice   
provid]2 &  7,b7 incapable ( be+ modifi$
 or revok$ by ! us] or manufactur]      
lawfully op]at+ ! in=mation sy/em1      
except ?r\gh a firmw>e update4  7#f7    
,gateway product ,! t]m gateway product 
means a node or device t connects to    
multiple networks us+ /&>d protocols4   
7#g7 ,h>dw>e ,! t]m h>dw>e means !      
physical compon5ts ( an in=mation sy/em4
  7#h7 ,,ni/ ,! t]m ,,ni/ means !       
,national ,in/itute ( ,/&>ds &          
,te*nology4  7#i7 ,non-compliant device 
,! t]m non-compliant device means a     
cov]$ device t does n meet ! basel9e    
security requirem5ts e/abli%$ 9 section 
#c7;a77#b77;,a74  7#aj7 ,prop]ly        

au!nticat$ update ,! t]m prop]ly        
au!nticat$ update means an update1      
rem$iation1 or te*nical fix to a h>dw>e1
 firmw>e1 or s(tw>e compon5t issu$ by a 
product v5dor or s]vice provid] us$ to  
correct p>ticul> problems ) ! compon5t1 
& t1 9 ! case ( s(tw>e or firmw>e1      
conta9s "s me?od ( au!nticity           
protection1 su* z a digital signature1 s
 t unau?oriz$ updates & rollbacks (     
au?oriz$ updates c be automatically     
detect$ & reject$4  7#aa7 ,security     
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 firmw>e1 s(tw>e1 process1 or    
proc$ure or a comb9ation ( #b or m ( ^! 
attributes t c\ld enable or facilitate !
 defeat or compromise ( !               
confid5tiality1 integrity1 or           
availability ( an in=mation sy/em or !  
in=mation or physical devices ( an      
in=mation sy/em to :i* an in=mation     
sy/em is connect$4  7#ab7 ,s(tw>e ,! t]m
 s(tw>e means a comput] program &       
associat$ data t may be dynamically     

writt5 or modifi$4  7#ac7 ,v5dor ,! t]m 
v5dor1 ) respect to a te*nology1        
product1 sy/em1 s]vice1 or application1 
means--  7,a7 9 ! case ( a pur*ase by ! 
,gov]nm5t1 ! entity t develop$ !        
te*nology1 product1 sy/em1 s]vice1 or   
application2 or  7,b7 9 ! case ( a      
pur*ase by a contractor1 ! entity t is  
responsible = ma9ta9+ ! te*nology1      
product1 sy/em1 s]vice1 or application4 
#g4 ,applicability ,?is ,act %all apply 
) respect to any contract ent]$ into on 
& aft] ! date on :i* ! guidel9es are    
issu$ pursuant to section #c7;a74