,,ii  #aae? ,,congress  #a/ ,session    
,s4 #afia  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,augu/ #a1 #bjag ,mr4  
,w>n] 7= himself1 ,mr4 ,g>dn]1 ,mr4     
,wyd51 & ,mr4 ,da9es7 introduc$ ! foll[+
 bill2 :i* 0 read twice & ref]r$ to !   
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
provide m9imal cyb]security op]ational  
/&>ds = ,int]net-connect$ devices       
pur*as$ by ,f$]al ag5cies1 & = o!r      
purposes4  #a4 ,%ort title  ,?is ,act   
may be cit$ z ! ,int]net ( ,?+s 7,io,t7 
,cyb]security ,improvem5t ,act ( #bjag4 
#b4 ,def9itions ,9 ?is ,act3 7#a7       
,director ,! t]m ,director means !      
,director ( ! ,(fice ( ,managem5t &     
,budget4  7#b7 ,executive ag5cy ,! t]m  
executive ag5cy has ! mean+ giv5 ! t]m 9
 section #acc ( title #da1 ,unit$ ,/ates
 ,code4  7#c7 ,firmw>e ,! t]m firmw>e   
means a comput] program & ! data /or$ 9 
h>dw>e1 typically 9 read-only memory    
7,,rom7 or programmable read-only memory
 7,,prom71 su* t ! program & data _c be 

dynamically writt5 or modifi$ dur+      
execution ( ! program4  7#d7 ,fix$ or   
h>d-cod$ cr$5tial ,! t]m fix$ or        
h>d-cod$ cr$5tial means a value1 su* z a
 password1 tok51 cryptographic key1 or  
o!r data elem5t us$ z "p ( an           
au!ntication me*anism = grant+ remote   
access to an in=mation sy/em or its     
in=mation1 t is--  7,a7 e/abli%$ by a   
product v5dor or s]vice provid]2 &  7,b7
 incapable ( be+ modifi$ or revok$ by ! 
us] or manufactur] lawfully op]at+ !    
in=mation sy/em1 except via a firmw>e   
update4  7#e7 ,h>dw>e ,! t]m h>dw>e     
means ! physical compon5ts ( an         
in=mation sy/em4  7#f7 ,int]net-connect$
 device ,! t]m ,int]net-connect$ device 
means a physical object t--  7,a7 is    
capable ( connect+ to & is 9 regul>     
connection ) ! ,int]net2 &  7,b7 has    
comput] process+ capabilities t c       
collect1 s5d1 or receive data4  7#g7    
,,ni/ ,! t]m ,,ni/ means ! ,national    
,in/itute ( ,/&>ds & ,te*nology4  7#h7  
,prop]ly au!nticat$ update ,! t]m       

prop]ly au!nticat$ update means an      
update1 rem$iation1 or te*nical fix to a
 h>dw>e1 firmw>e1 or s(tw>e compon5t    
issu$ by a product v5dor or s]vice      
provid] us$ to correct p>ticul> problems
 ) ! compon5t1 & t1 9 ! case ( s(tw>e or
 firmw>e1 conta9s "s me?od ( au!nticity 
protection1 su* z a digital signature1 s
 t unau?oriz$ updates c be automatically
 detect$ & reject$4  7#i7 ,security     
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 firmw>e1 s(tw>e1 process1 or    
proc$ure or comb9ation ( #b or m ( ^!   
factors t c\ld enable or facilitate !   
defeat or compromise ( ! confid5tiality1
 integrity1 or availability ( an        
in=mation sy/em or its in=mation or     
physical devices to :i* x is connect$4  
7#aj7 ,s(tw>e ,! t]m s(tw>e means a     
comput] program & associat$ data t may  
be dynamically writt5 or modifi$4  #c4  
,contractor responsibilities ) respect  
to ,int]net-connect$ device cyb]security
  7a7 ,clauses requir$ 9                

,int]net-,connect$ devices  7#a7 ,9     
g5]al ,n lat] ?an #ahj days aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,director1 9 
consultation ) ! ,secret>y ( ,def5se1 ! 
,adm9i/rator ( ,g5]al ,s]vices1 !       
,secret>y ( ,comm]ce1 ! ,secret>y (     
,homel& ,security1 & any o!r intellig5ce
 or national security ag5cy t !         
,director det]m9es to be necess>y1 %all 
issue guidel9es = ea* executive ag5cy to
 require ! foll[+ clauses 9 any         
contract1 except z provid$ 9 p>agraph   
7#b71 = ! acquisition (                 
,int]net-connect$ devices3  7,a7        
,v]ification requir$  7i7 ,9 g5]al ,a   
clause t requires ! contractor provid+ !
 ,int]net-connect$ device to provide    
writt5 c]tification t ! device--  7,i7  
except z provid$ "u clause 7ii71 does n 
conta91 at ! "t ( submitt+ ! proposal1  
any h>dw>e1 s(tw>e1 or firmw>e compon5t 
) any kn[n security vuln]abilities or   
defects li/$ 9--  7aa7 ! ,national      
,vuln]ability ,database ( ,,ni/2 &  7bb7
 any additional database select$ by !   

,director t tracks security             
vuln]abilities & defects1 is cr$ible1 & 
is simil> to ! ,national ,vuln]ability  
,database2  7,,ii7 relies on s(tw>e or  
firmw>e compon5ts capable ( accept+     
prop]ly au!nticat$ & tru/$ updates f !  
v5dor2  7,,iii7 uses only non-deprecat$ 
indu/ry-/&>d protocols & te*nologies =  
functions su* z-- 7aa7 communications1  
su* z /&>d ports = network traffic2     
7bb7 encryption2 &  7cc7 int]connection 
) o!r devices or p]iph]als2 &  7,,iv7   
does n include any fix$ or h>d-cod$     
cr$5tials us$ = remote adm9i/ration1 !  
deliv]y ( updates1 or communication4    
7ii7 ,limit$ exception = disclos$       
vuln]abilities  7,i7 ,application =     
waiv] ,at ! "t ( submitt+ a proposal to 
an executive ag5cy1 a contractor may    
submit a writt5 application = a waiv] f 
! requirem5t "u clause 7i77,i7 = !      
purpose ( disclos+ a kn[n vuln]ability  
to ! executive ag5cy4  7,,ii7 ,cont5ts  
,an application submitt$ "u subclause   
7,i7 %all-- 7aa7 id5tify ! specific kn[n

 vuln]ability2  7bb7 include any        
mitigation actions t may limit or       
elim9ate ! ability = an adv]s>y to      
exploit ! vuln]ability2 &  7cc7 include 
a ju/ification = secure use ( ! device  
not)/&+ ! p]si/+ vuln]ability4  7,,iii7 
,approval ,if ! head ( ! pur*as+        
executive ag5cy approves ! waiv]1 ! head
 ( ! pur*as+ executive ag5cy %all       
provide ! contractor a writt5 /atem5t t 
! executive ag5cy accepts su* risks     
result+ f use ( ! device ) ! kn[n       
vuln]ability z repres5t$ by !           
contractor4  7,b7 ,notification requir$ 
,a clause t requires ! contractor       
provid+ ! ,int]net-connect$ device      
s(tw>e or firmw>e compon5t to notify !  
pur*as+ ag5cy ( any kn[n security       
vuln]abilities or defects subsequ5tly   
disclos$ to ! v5dor by a security       
rese>*] or ( :i* ! v5dor o!rwise becomes
 aw>e = ! duration ( ! contract4  7,c7  
,updates ,a clause t requires su*       
,int]net-connect$ device s(tw>e or      
firmw>e compon5t to be updat$ or        

replac$1 consi/5t ) o!r provisions 9 !  
contract gov]n+ ! t]m ( support1 9 a    
mann] t all[s = any future security     
vuln]ability or defect 9 any "p ( !     
s(tw>e or firmw>e to be pat*$ 9 ord] to 
fix or remove a vuln]ability or defect 9
 ! s(tw>e or firmw>e compon5t 9 a       
prop]ly au!nticat$ & secure mann]4  7,d7
 ,timely repair ,a clause t requires !  
contractor to provide a repair or       
replacem5t 9 a timely mann] 9 respect to
 any new security vuln]ability discov]$ 
?r\gh any ( ! databases describ$ 9      
subp>agraph 7,a77i77,i7 or f ! coord9at$
 disclosure program describ$ 9          
subsection 7b7 9 ! ev5t ! vuln]ability  
_c be rem$iat$ ?r\gh an update describ$ 
9 subp>agraph 7,c74  7,e7 ,cont9uation (
 s]vices ,a clause t requires !         
contractor to provide ! pur*as+ ag5cy ) 
g5]al in=mation on ! ability ( ! device 
to be updat$1 su* z--  7i7 ! mann] 9 :i*
 ! device receives security updates2    
7ii7 ! anticipat$ timel9e = end+        
security support associat$ ) !          

,int]net-connect$ device2  7iii7 =mal   
notification :5 security support has    
ceas$2 &  7iv7 any additional in=mation 
recomm5d$ by ! ,national                
,telecommunications & ,in=mation        
,adm9i/ration4  7#b7 ,exceptions  7,a7  
,devices ) sev]ely limit$ functionality 
7i7 ,9 g5]al ,if an executive ag5cy     
reasonably believes t procurem5t ( an   
,int]net-connect$ device ) limit$ data  
process+ & s(tw>e functionality consi/5t
 ) p>agraph 7#a7 w\ld be unfeasible or  
economically impractical1 ! executive   
ag5cy may petition ! ,director = a waiv]
 to ! requirem5ts conta9$ 9 p>agraph    
7#a7 9 ord] to pur*ase a non-compliant  
,int]net-connect$ device4  7ii7         
,alt]nate conditions to mitigate        
cyb]security risks  7,i7 ,9 g5]al ,n    
lat] ?an #ahj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,director1 9     
close coord9ation ) ,,ni/1 %all def9e a 
set ( conditions t--  7aa7 ensure an    
,int]net-connect$ device t does n comply
 ) p>agraph 7#a7 c be us$ ) a level (   

security t is equival5t to ! level (    
security describ$ 9 p>agraph 7#a77;,a72 
&  7bb7 %all be met 9 ord] = an         
executive ag5cy to pur*ase su* a        
non-compliant device4  7,,ii7           
,requirem5ts ,9 def9+ a set ( conditions
 t mu/ be met = non-compliant devices z 
requir$ "u subclause 7,i71 ! ,director1 
9 close coord9ation ) ,,ni/ & relevant  
indu/ry entities1 may consid] ! use (   
conditions includ+--  7aa7 network      
segm5tation or micro-segm5tation2  7bb7 
! adoption ( sy/em level security       
controls1 includ+ op]at+ sy/em conta9]s 
& micros]vices2  7cc7 multi-factor      
au!ntication2 &  7dd7 intellig5t network
 solutions & edge sy/ems1 su* z         
gateways1 t c isolate1 disable1 or      
rem$iate connect$ devices4  7iii7       
,specification ( additional precautions 
,to address ! long-t]m risk (           
non-compliant ,int]net-connect$ devices 
acquir$ 9 accordance ) an exception "u  
?is p>agraph1 ! ,director1 9 coord9ation
 ) ,,ni/ & private-sector indu/ry       

exp]ts1 may /ipulate additional         
requirem5ts = managem5t & use (         
non-compliant devices1 includ+ deadl9es 
= ! removal1 replacem5t1 or disabl+ (   
non-compliant devices 7or _!            
,int]net-connectivity71 z well z m9imal 
requirem5ts = gateway products to ensure
 ! integrity & security ( !             
non-compliant devices4  7,b7 ,exi/+     
?ird-p>ty security /&>d  7i7 ,9 g5]al   
,if an exi/+ ?ird-p>ty security /&>d =  
,int]net-connect$ devices provides an   
equival5t or great] level ( security to 
t describ$ 9 p>agraph 7#a77;,a71 an     
executive ag5cy may all[ a contractor to
 demon/rate compliance ) t /&>d 9 lieu (
 ! requirem5ts "u p>agraph 7#a74  7ii7  
,writt5 c]tification ,a contractor      
provid+ ! ,int]net-connect$ device %all 
provide ?ird-p>ty writt5 c]tification t 
! device complies ) ! security          
requirem5ts ( ! indu/ry c]tification    
me?od ( ! ?ird p>ty4  7iii7 ,,ni/ ,,ni/1
 9 coord9ation ) ! ,director & o!r      
appropriate executive ag5cies1 %all     

det]m9e-- 7,i7 accr$itation /&>ds =     
?ird-p>ty c]tifi]s2 &  7,,ii7 :e!r !    
/&>ds describ$ 9 subclause 7,i7 provide 
appropriate security & is align$ ) !    
guidel9es issu$ "u ?is subsection4  7,c7
 ,exi/+ ag5cy security evaluation /&>ds 
7i7 ,9 g5]al ,if an executive ag5cy     
employs a security evaluation process or
 crit]ia = ,int]net-connect$ devices t !
 ag5cy believes provides an equival5t or
 great] level ( security to t describ$ 9
 p>agraph 7#a77;,a71 an executive ag5cy 
may1 ^u ! approval ( ! ,director1       
cont9ue to use t process or /&>d 9 lieu 
( ! requirem5ts "u p>agraph 7#a74  7ii7 
,,ni/ ,,ni/1 9 coord9ation ) ! ,director
 & o!r appropriate executive ag5cies1   
%all det]m9e :e!r ! process or crit]ia  
describ$ 9 clause 7i7 provides          
appropriate security & are align$ ) !   
guidel9es issu$ "u ?is subsection4  7#c7
 ,report to ,congress ,n lat] ?an #e    
ye>s aft] ! date ( enactm5t ( ?is ,act1 
! ,director %all submit to ,congress a  
report on ! effectiv5ess ( ! guidel9es  

requir$ to be issu$ "u p>agraph 7#a71   
:i* %all include recomm5dations =       
legislative language ne$$ to update !   
guidel9e requirem5ts describ$ 9 p>agraph
 7#a74  7#d7 ,waiv] au?ority ,beg9n+ on 
! date t is #e ye>s aft] ! date (       
enactm5t ( ?is ,act1 ! ,director may    
waive1 9 :ole or 9 "p1 ! requirem5ts ( !
 guidel9es issu$ "u ?is subsection1 = an
 executive ag5cy4  7b7 ,guidel9es reg>d+
 ! coord9at$ disclosure ( security      
vuln]abilities & defects  7#a7 ,9 g5]al 
,n lat] ?an #fj days aft] ! date ( !    
enactm5t ( ?is ,act1 ! ,national        
,protection & ,programs ,directorate1 9 
consultation ) cyb]security rese>*]s &  
private-sector indu/ry exp]ts1 %all     
issue guidel9es = ea* ag5cy ) respect to
 any ,int]net-connect$ device 9 use by !
 ,unit$ ,/ates ,gov]nm5t reg>d+         
cyb]security coord9at$ disclosure       
requirem5ts t %all be requir$ (         
contractors provid+ su* s(tw>e devices  
to ! ,unit$ ,/ates ,gov]nm5t4  7#b7     
,cont5ts ,! guidel9es requir$ to be     

issu$ "u p>agraph 7#a7 %all-- 7,a7      
include policies & proc$ures = conduct+ 
rese>* on ! cyb]security ( an           
,int]net-connect$ device1 :i* %all be   
bas$1 9 "p1 on ,/&>d #biadg ( !         
,int]national ,/&>ds ,organization1 or  
any successor /&>d1 relat+ to ! process+
 & resolv+ ( pot5tial vuln]ability      
in=mation 9 a product or onl9e s]vice1  
su* z--  7i7 proc$ures = a contractor   
provid+ an ,int]net-connect$ device to !
 ,unit$ ,/ates ,gov]nm5t on h[ to--     
7,i7 receive in=mation ab\t pot5tial    
vuln]abilities 9 ! product or onl9e     
s]vice ( ! contractor2 &  7,,ii7        
dissem9ate resolution in=mation ab\t    
vuln]abilities 9 ! product or onl9e     
s]vice ( ! contractor2 &  7ii7 guidance1
 includ+ example cont5t1 on ! in=mation 
items t %\ld be produc$ ?r\gh !         
implem5tation ( ! vuln]ability          
disclosure process ( ! contractor2 &    
7,b7 require t rese>* on ! cyb]security 
( an ,int]net-connect$ device provid$ by
 a contractor to ! ,unit$ ,/ates        

,gov]nm5t %all be conduct$ on ! same    
class1 model1 or type ( ! device provid$
 to ! ,unit$ ,/ates ,gov]nm5t & n on !  
actual device provid$ to ! ,unit$ ,/ates
 ,gov]nm5t4  7c7 ,limitation ( liability
  7#a7 ,rule ( con/ruction ,no?+ 9 ?is  
subsection1 or ! am5dm5ts made by ?is   
subsection1 %all be con/ru$ to e/abli%  
additional obligations or crim9al       
p5alties = individuals engag$ 9 rese>*+ 
! cyb]security ( ,int]net-connect$      
devices4  7#b7 ,comput] fraud & abuse   
act ,section #ajcj ( title #ah1 ,unit$  
,/ates ,code1 is am5d$-- 7,a7 9         
subsection 7j77#b71 by add+ a p]iod at !
 end2 &  7,b7 by add+ at ! end ! foll[+ 
new subsection3  7k7 ,?is section %all n
 apply to a p]son :o--  7#a7 9 good     
fai?1 engag$ 9 rese>*+ ! cyb]security ( 
an ,int]net-connect$ device ( ! class1  
model1 or type provid$ by a contractor  
to a dep>tm5t or ag5cy ( ! ,unit$       
,/ates2 &  7#b7 act$ 9 compliance ) !   
guidel9es requir$ to be issu$ by !      
,national ,protection & ,programs       

,directorate1 & adopt$ by ! contractor  
describ$ 9 p>agraph 7#a71 "u section    
#c7;b7 ( ! ,int]net ( ,?+s 7,io,t7      
,cyb]security ,improvem5t ,act ( #bjag4 
4  7#c7 ,digital mill5nium copyright act
 ,*apt] #ab ( title #ag1 ,unit$ ,/ates  
,code1 is am5d$-- 7,a7 9 section #abjc1 
by add+ at ! end ! foll[+ new           
subsection3  7d7 ,limitation ( liability
 ,a p]son %all n be held liable "u ?is  
section if ! individual-- 7#a7 9 good   
fai?1 engag$ 9 rese>*+ ! cyb]security ( 
an ,int]net-connect$ device ( ! class1  
model1 or type provid$ by a contractor  
to a dep>tm5t or ag5cy ( ! ,unit$       
,/ates2 &  7#b7 act$ 9 compliance ) !   
guidel9es requir$ to be issu$ by !      
,national ,protection & ,programs       
,directorate1 & adopt$ by ! contractor  
describ$ 9 p>agraph 7#a71 "u section    
#c7;b7 ( ! ,int]net ( ,?+s 7,io,t7      
,cyb]security ,improvem5t ,act ( #bjag4 
2 &  7,b7 9 section #abjd1 by add+ at ! 
end ! foll[+ new subsection3  7d7       
,limitation ( liability ,subsection 7a7 

%all n apply to a p]son :o--  7#a7 9    
good fai?1 engag$ 9 rese>*+ !           
cyb]security ( an ,int]net-connect$     
device ( ! class1 model1 or type provid$
 by a contractor to a dep>tm5t or ag5cy 
( ! ,unit$ ,/ates2 &  7#b7 act$ 9       
compliance ) ! guidel9es requir$ to be  
issu$ by ! ,national ,protection &      
,programs ,directorate1 & adopt$ by !   
contractor describ$ 9 p>agraph 7#a71 "u 
section #c7;b7 ( ! ,int]net ( ,?+s      
7,io,t7 ,cyb]security ,improvem5t ,act (
 #bjag4  4  7d7 ,inv5tory ( devices     
7#a7 ,9 g5]al ,n lat] ?an #ahj days aft]
 ! date ( ! enactm5t ( ?is ,act1 ! head 
( ea* executive ag5cy %all e/abli% &    
ma9ta9 an inv5tory ( ,int]net-connect$  
devices us$ by ! ag5cy procur$ "u ?is   
,act4  7#b7 ,guidel9es ,n lat] ?an #cj  
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,(fice (          
,managem5t & ,budget1 9 consultation ) !
 ,secret>y ( ,homel& ,security1 %all    
issue guidel9es = executive ag5cies to  
develop & manage ! inv5tories requir$ "u

 p>agraph 7#a71 bas$ on ! ,cont9u\s     
,diagno/ics & ,mitigation 7,,cdm7       
program us$ by ! ,dep>tm5t ( ,homel&    
,security4  7#c7 ,device databases  7,a7
 ,9 g5]al ,n lat] ?an #ahj days aft] !  
date ( enactm5t ( ?is ,act1 ! ,director 
( ! ,(fice ( ,managem5t & ,budget %all  
e/abli% & ma9ta9--  7i7 a publicly      
accessible database ( devices & !       
respective manufactur]s ( su* devices = 
:i* limitations ( liability exi/ "u ?is 
,act2 &  7ii7 a publicly accessible     
database ( devices & ! respective       
manufactur]s ( su* devices ab\t :i* !   
gov]nm5t has receiv$ =mal notification (
 security support ceas+1 z requir$ "u   
section #c7;a77#a77;,e77iii74  7,b7     
,updates ,! ,director ( ! ,(fice (      
,managem5t & ,budget %all update !      
databases e/abli%$ "u subp>agraph 7,a7 n
 less frequ5tly ?an once e #cj days4    
#d4 ,use ( be/ practices 9 id5tification
 & track+ ( vuln]abilities = purposes ( 
! national vuln]ability database ,!     
,director ( ,,ni/ %all ensure t ,,ni/   

e/abli%es1 ma9ta9s1 & uses be/ practices
 9 ! id5tification & track+ (           
vuln]abilities = purposes ( ! ,national 
,vuln]ability ,database ( ,,ni/4