,,ii #aaeth ,,congress #ast ,session ,s4 #afia ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #a1 #bjag ,mr4 ,warner 7for himself1 ,mr4 ,gardner1 ,mr4 ,wyden1 and ,mr4 ,daines7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to provide minimal cybersecurity operational standards for ,internet-connected devices purchased by ,federal agencies1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,internet of ,things 7,io,t7 ,cybersecurity ,improvement ,act of #bjag4 #b4 ,definitions ,in this ,act3 7#a7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#b7 ,executive agency ,the term executive agency has the meaning given the term in section #acc of title #da1 ,united ,states ,code4 7#c7 ,firmware ,the term firmware means a computer program and the data stored in hardware1 typically in read-only memory 7,,rom7 or programmable read-only memory 7,,prom71 such that the program and data cannot be dynamically written or modified during execution of the program4 7#d7 ,fixed or hard-coded credential ,the term fixed or hard-coded credential means a value1 such as a password1 token1 cryptographic key1 or other data element used as part of an authentication mechanism for granting remote access to an information system or its information1 that is-- 7,a7 established by a product vendor or service provider2 and 7,b7 incapable of being modified or revoked by the user or manufacturer lawfully operating the information system1 except via a firmware update4 7#e7 ,hardware ,the term hardware means the physical components of an information system4 7#f7 ,internet-connected device ,the term ,internet-connected device means a physical object that-- 7,a7 is capable of connecting to and is in regular connection with the ,internet2 and 7,b7 has computer processing capabilities that can collect1 send1 or receive data4 7#g7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#h7 ,properly authenticated update ,the term properly authenticated update means an update1 remediation1 or technical fix to a hardware1 firmware1 or software component issued by a product vendor or service provider used to correct particular problems with the component1 and that1 in the case of software or firmware1 contains some method of authenticity protection1 such as a digital signature1 so that unauthorized updates can be automatically detected and rejected4 7#i7 ,security vulnerability ,the term security vulnerability means any attribute of hardware1 firmware1 software1 process1 or procedure or combination of #b or more of these factors that could enable or facilitate the defeat or compromise of the confidentiality1 integrity1 or availability of an information system or its information or physical devices to which it is connected4 7#aj7 ,software ,the term software means a computer program and associated data that may be dynamically written or modified4 #c4 ,contractor responsibilities with respect to ,internet-connected device cybersecurity 7a7 ,clauses required in ,internet-,connected devices 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director1 in consultation with the ,secretary of ,defense1 the ,administrator of ,general ,services1 the ,secretary of ,commerce1 the ,secretary of ,homeland ,security1 and any other intelligence or national security agency that the ,director determines to be necessary1 shall issue guidelines for each executive agency to require the following clauses in any contract1 except as provided in paragraph 7#b71 for the acquisition of ,internet-connected devices3 7,a7 ,verification required 7i7 ,in general ,a clause that requires the contractor providing the ,internet-connected device to provide written certification that the device-- 7,i7 except as provided under clause 7ii71 does not contain1 at the time of submitting the proposal1 any hardware1 software1 or firmware component with any known security vulnerabilities or defects listed in-- 7aa7 the ,national ,vulnerability ,database of ,,nist2 and 7bb7 any additional database selected by the ,director that tracks security vulnerabilities and defects1 is credible1 and is similar to the ,national ,vulnerability ,database2 7,,ii7 relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor2 7,,iii7 uses only non-deprecated industry-standard protocols and technologies for functions such as-- 7aa7 communications1 such as standard ports for network traffic2 7bb7 encryption2 and 7cc7 interconnection with other devices or peripherals2 and 7,,iv7 does not include any fixed or hard-coded credentials used for remote administration1 the delivery of updates1 or communication4 7ii7 ,limited exception for disclosed vulnerabilities 7,i7 ,application for waiver ,at the time of submitting a proposal to an executive agency1 a contractor may submit a written application for a waiver from the requirement under clause 7i77,i7 for the purpose of disclosing a known vulnerability to the executive agency4 7,,ii7 ,contents ,an application submitted under subclause 7,i7 shall-- 7aa7 identify the specific known vulnerability2 7bb7 include any mitigation actions that may limit or eliminate the ability for an adversary to exploit the vulnerability2 and 7cc7 include a justification for secure use of the device notwithstanding the persisting vulnerability4 7,,iii7 ,approval ,if the head of the purchasing executive agency approves the waiver1 the head of the purchasing executive agency shall provide the contractor a written statement that the executive agency accepts such risks resulting from use of the device with the known vulnerability as represented by the contractor4 7,b7 ,notification required ,a clause that requires the contractor providing the ,internet-connected device software or firmware component to notify the purchasing agency of any known security vulnerabilities or defects subsequently disclosed to the vendor by a security researcher or of which the vendor otherwise becomes aware for the duration of the contract4 7,c7 ,updates ,a clause that requires such ,internet-connected device software or firmware component to be updated or replaced1 consistent with other provisions in the contract governing the term of support1 in a manner that allows for any future security vulnerability or defect in any part of the software or firmware to be patched in order to fix or remove a vulnerability or defect in the software or firmware component in a properly authenticated and secure manner4 7,d7 ,timely repair ,a clause that requires the contractor to provide a repair or replacement in a timely manner in respect to any new security vulnerability discovered through any of the databases described in subparagraph 7,a77i77,i7 or from the coordinated disclosure program described in subsection 7b7 in the event the vulnerability cannot be remediated through an update described in subparagraph 7,c74 7,e7 ,continuation of services ,a clause that requires the contractor to provide the purchasing agency with general information on the ability of the device to be updated1 such as-- 7i7 the manner in which the device receives security updates2 7ii7 the anticipated timeline for ending security support associated with the ,internet-connected device2 7iii7 formal notification when security support has ceased2 and 7iv7 any additional information recommended by the ,national ,telecommunications and ,information ,administration4 7#b7 ,exceptions 7,a7 ,devices with severely limited functionality 7i7 ,in general ,if an executive agency reasonably believes that procurement of an ,internet-connected device with limited data processing and software functionality consistent with paragraph 7#a7 would be unfeasible or economically impractical1 the executive agency may petition the ,director for a waiver to the requirements contained in paragraph 7#a7 in order to purchase a non-compliant ,internet-connected device4 7ii7 ,alternate conditions to mitigate cybersecurity risks 7,i7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director1 in close coordination with ,,nist1 shall define a set of conditions that-- 7aa7 ensure an ,internet-connected device that does not comply with paragraph 7#a7 can be used with a level of security that is equivalent to the level of security described in paragraph 7#a77;,a72 and 7bb7 shall be met in order for an executive agency to purchase such a non-compliant device4 7,,ii7 ,requirements ,in defining a set of conditions that must be met for non-compliant devices as required under subclause 7,i71 the ,director1 in close coordination with ,,nist and relevant industry entities1 may consider the use of conditions including-- 7aa7 network segmentation or micro-segmentation2 7bb7 the adoption of system level security controls1 including operating system containers and microservices2 7cc7 multi-factor authentication2 and 7dd7 intelligent network solutions and edge systems1 such as gateways1 that can isolate1 disable1 or remediate connected devices4 7iii7 ,specification of additional precautions ,to address the long-term risk of non-compliant ,internet-connected devices acquired in accordance with an exception under this paragraph1 the ,director1 in coordination with ,,nist and private-sector industry experts1 may stipulate additional requirements for management and use of non-compliant devices1 including deadlines for the removal1 replacement1 or disabling of non-compliant devices 7or their ,internet-connectivity71 as well as minimal requirements for gateway products to ensure the integrity and security of the non-compliant devices4 7,b7 ,existing third-party security standard 7i7 ,in general ,if an existing third-party security standard for ,internet-connected devices provides an equivalent or greater level of security to that described in paragraph 7#a77;,a71 an executive agency may allow a contractor to demonstrate compliance with that standard in lieu of the requirements under paragraph 7#a74 7ii7 ,written certification ,a contractor providing the ,internet-connected device shall provide third-party written certification that the device complies with the security requirements of the industry certification method of the third party4 7iii7 ,,nist ,,nist1 in coordination with the ,director and other appropriate executive agencies1 shall determine-- 7,i7 accreditation standards for third-party certifiers2 and 7,,ii7 whether the standards described in subclause 7,i7 provide appropriate security and is aligned with the guidelines issued under this subsection4 7,c7 ,existing agency security evaluation standards 7i7 ,in general ,if an executive agency employs a security evaluation process or criteria for ,internet-connected devices that the agency believes provides an equivalent or greater level of security to that described in paragraph 7#a77;,a71 an executive agency may1 upon the approval of the ,director1 continue to use that process or standard in lieu of the requirements under paragraph 7#a74 7ii7 ,,nist ,,nist1 in coordination with the ,director and other appropriate executive agencies1 shall determine whether the process or criteria described in clause 7i7 provides appropriate security and are aligned with the guidelines issued under this subsection4 7#c7 ,report to ,congress ,not later than #e years after the date of enactment of this ,act1 the ,director shall submit to ,congress a report on the effectiveness of the guidelines required to be issued under paragraph 7#a71 which shall include recommendations for legislative language needed to update the guideline requirements described in paragraph 7#a74 7#d7 ,waiver authority ,beginning on the date that is #e years after the date of enactment of this ,act1 the ,director may waive1 in whole or in part1 the requirements of the guidelines issued under this subsection1 for an executive agency4 7b7 ,guidelines regarding the coordinated disclosure of security vulnerabilities and defects 7#a7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 the ,national ,protection and ,programs ,directorate1 in consultation with cybersecurity researchers and private-sector industry experts1 shall issue guidelines for each agency with respect to any ,internet-connected device in use by the ,united ,states ,government regarding cybersecurity coordinated disclosure requirements that shall be required of contractors providing such software devices to the ,united ,states ,government4 7#b7 ,contents ,the guidelines required to be issued under paragraph 7#a7 shall-- 7,a7 include policies and procedures for conducting research on the cybersecurity of an ,internet-connected device1 which shall be based1 in part1 on ,standard #biadg of the ,international ,standards ,organization1 or any successor standard1 relating to the processing and resolving of potential vulnerability information in a product or online service1 such as-- 7i7 procedures for a contractor providing an ,internet-connected device to the ,united ,states ,government on how to-- 7,i7 receive information about potential vulnerabilities in the product or online service of the contractor2 and 7,,ii7 disseminate resolution information about vulnerabilities in the product or online service of the contractor2 and 7ii7 guidance1 including example content1 on the information items that should be produced through the implementation of the vulnerability disclosure process of the contractor2 and 7,b7 require that research on the cybersecurity of an ,internet-connected device provided by a contractor to the ,united ,states ,government shall be conducted on the same class1 model1 or type of the device provided to the ,united ,states ,government and not on the actual device provided to the ,united ,states ,government4 7c7 ,limitation of liability 7#a7 ,rule of construction ,nothing in this subsection1 or the amendments made by this subsection1 shall be construed to establish additional obligations or criminal penalties for individuals engaged in researching the cybersecurity of ,internet-connected devices4 7#b7 ,computer fraud and abuse act ,section #ajcj of title #ah1 ,united ,states ,code1 is amended-- 7,a7 in subsection 7j77#b71 by adding a period at the end2 and 7,b7 by adding at the end the following new subsection3 7k7 ,this section shall not apply to a person who-- 7#a7 in good faith1 engaged in researching the cybersecurity of an ,internet-connected device of the class1 model1 or type provided by a contractor to a department or agency of the ,united ,states2 and 7#b7 acted in compliance with the guidelines required to be issued by the ,national ,protection and ,programs ,directorate1 and adopted by the contractor described in paragraph 7#a71 under section #c7;b7 of the ,internet of ,things 7,io,t7 ,cybersecurity ,improvement ,act of #bjag4 4 7#c7 ,digital millennium copyright act ,chapter #ab of title #ag1 ,united ,states ,code1 is amended-- 7,a7 in section #abjc1 by adding at the end the following new subsection3 7d7 ,limitation of liability ,a person shall not be held liable under this section if the individual-- 7#a7 in good faith1 engaged in researching the cybersecurity of an ,internet-connected device of the class1 model1 or type provided by a contractor to a department or agency of the ,united ,states2 and 7#b7 acted in compliance with the guidelines required to be issued by the ,national ,protection and ,programs ,directorate1 and adopted by the contractor described in paragraph 7#a71 under section #c7;b7 of the ,internet of ,things 7,io,t7 ,cybersecurity ,improvement ,act of #bjag4 2 and 7,b7 in section #abjd1 by adding at the end the following new subsection3 7d7 ,limitation of liability ,subsection 7a7 shall not apply to a person who-- 7#a7 in good faith1 engaged in researching the cybersecurity of an ,internet-connected device of the class1 model1 or type provided by a contractor to a department or agency of the ,united ,states2 and 7#b7 acted in compliance with the guidelines required to be issued by the ,national ,protection and ,programs ,directorate1 and adopted by the contractor described in paragraph 7#a71 under section #c7;b7 of the ,internet of ,things 7,io,t7 ,cybersecurity ,improvement ,act of #bjag4 4 7d7 ,inventory of devices 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the head of each executive agency shall establish and maintain an inventory of ,internet-connected devices used by the agency procured under this ,act4 7#b7 ,guidelines ,not later than #cj days after the date of the enactment of this ,act1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,secretary of ,homeland ,security1 shall issue guidelines for executive agencies to develop and manage the inventories required under paragraph 7#a71 based on the ,continuous ,diagnostics and ,mitigation 7,,cdm7 program used by the ,department of ,homeland ,security4 7#c7 ,device databases 7,a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall establish and maintain-- 7i7 a publicly accessible database of devices and the respective manufacturers of such devices for which limitations of liability exist under this ,act2 and 7ii7 a publicly accessible database of devices and the respective manufacturers of such devices about which the government has received formal notification of security support ceasing1 as required under section #c7;a77#a77;,e77iii74 7,b7 ,updates ,the ,director of the ,office of ,management and ,budget shall update the databases established under subparagraph 7,a7 not less frequently than once every #cj days4 #d4 ,use of best practices in identification and tracking of vulnerabilities for purposes of the national vulnerability database ,the ,director of ,,nist shall ensure that ,,nist establishes1 maintains1 and uses best practices in the identification and tracking of vulnerabilities for purposes of the ,national ,vulnerability ,database of ,,nist4