,,ii  #aae? ,,congress  #b;d ,session   
,s4 #bbhi  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,janu>y #aj1 #bjah ,ms4
 ,w>r5 7= h]self & ,mr4 ,w>n]7 introduc$
 ! foll[+ bill2 :i* 0 read twice &      
ref]r$ to ! ,committee on ,bank+1 ,h\s+1
 & ,urban ,affairs  ,a ,,bill  ,to      
create an ,(fice ( ,cyb]security at !   
,f$]al ,trade ,commission = sup]vision (
 data security at consum] report+       
ag5cies1 to require ! promulgation (    
regulations e/abli%+ /&>ds = effective  
cyb]security at consum] report+ ag5cies1
 to impose p5alties on cr$it report+    
ag5cies = cyb]security brea*es t put    
s5sitive consum] data at risk1 & = o!r  
purposes4  #a4 ,%ort title  ,?is ,act   
may be cit$ z ! ,data ,brea* ,prev5tion 
& ,comp5sation ,act ( #bjah4  #b4       
,def9itions ,9 ?is ,act3 7#a7 ,c>e]     
appo9tee ,! t]m c>e] appo9tee has !     
mean+ giv5 ! t]m 9 section #cacb7;a7 (  
title #e1 ,unit$ ,/ates ,code4  7#b7    
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#c7 ,cov]$ 

brea* ,! t]m cov]$ brea* means any      
in/ance 9 :i* at lea/ #a piece (        
p]sonally id5tify+ in=mation is expos$  
or is reasonably likely to h be5 expos$ 
to an unau?oriz$ p>ty4  7#d7 ,cov]$     
consum] report+ ag5cy ,! t]m cov]$      
consum] report+ ag5cy means-- 7,a7 a    
consum] report+ ag5cy describ$ 9 section
 #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 
7#ae ,u4,s4,c4 #afha;a7p772 or  7,b7 a  
consum] report+ ag5cy t e>ns n less ?an 
#g1jjj1jjj 9 annual rev5ue f ! sales (  
consum] reports4  7#e7 ,director ,! t]m 
,director means ! ,director ( ! ,(fice (
 ,cyb]security4  7#f7 ,detail ,! t]m    
detail means a tempor>y assignm5t ( an  
employee to a diff]5t position = a      
specifi$ p]iod1 ) ! employee return+ to 
8 or h] regul> duties at ! end ( !      
detail4  7#g7 ,p]sonally id5tify+       
in=mation ,! t]m p]sonally id5tify+     
in=mation means-- 7,a7 a ,social        
,security numb]2  7,b7 a driv]'s lic5se 
numb]2  7,c7 a passport numb]2  7,d7 an 
ali5 regi/ration numb] or o!r           

gov]nm5t-issu$ unique id5tification     
numb]2  7,e7 unique biometric data1 su* 
z facepr9t1 f+]pr9t1 voice pr9t1 iris   
image1 or o!r unique physical           
repres5tations2  7,f7 an individual's   
fir/ & la/ "n or fir/ initial & la/ "n 9
 comb9ation ) any in=mation t relates to
 ! individual's pa/1 pres5t1 or future  
physical or m5tal heal? or condition1 or
 to ! provision ( heal? c>e to or       
diagnosis ( ! individual2  7,g7 7i7 a   
f9ancial acc\nt numb]1 debit c>d numb]1 
or cr$it c>d numb] ( ! consum]2 or  7ii7
 any passcode requir$ to access an      
acc\nt describ$ 9 clause 7i72 &  7,h7   
su* additional in=mation1 z det]m9$ by !
 ,director4  #c4 ,cyb]security /&>ds &  
,,ftc au?ority  7a7 ,e/abli%m5t ,!re is 
e/abli%$ 9 ! ,commission an ,(fice (    
,cyb]security1 :i* %all be head$ by a   
,director1 :o %all be a c>e] appo9tee4  
7b7 ,duties ,! ,(fice ( ,cyb]security-- 
7#a7 %all--  7,a7 sup]vise cov]$ consum]
 report+ ag5cies ) respect to data      
security2  7,b7 promulgate regulations =

 effective data security = cov]$ consum]
 report+ ag5cies1 includ+ regulations t 
require cov]$ consum] report+ ag5cies   
to--  7i7 provide ! ,commission )       
descriptions ( te*nical & organizational
 security measures1 includ+--  7,i7     
sy/em & network security measures1      
includ+-- 7aa7 asset managem5t1         
includ+-- 7,,aa7 an inv5tory ( au?oriz$ 
& unau?oriz$ devices2 7,,bb7 an inv5tory
 ( au?oriz$ & unau?oriz$ s(tw>e1 includ+
 application :iteli/+2 & 7,,cc7 secure  
configurations = h>dw>e & s(tw>e2  7bb7 
network managem5t & monitor+1 includ+-- 
7,,aa7 mapp$ data fl[s1 includ+         
functional mission mapp+2 7,,bb7        
ma9t5ance1 monitor+1 & analysis ( audit 
logs2 7,,cc7 network segm5tation2 &     
7,,dd7 local & remote access privileges1
 def9$ & manag$2 &  7cc7 application    
managem5t1 includ+-- 7,,aa7 cont9u\s    
vuln]ability assessm5t & rem$iation2    
7,,bb7 s]v] application h>d5+2 7,,cc7   
vuln]ability h&l+ su* z coord9at$       
vuln]ability disclosure policy2 & 7,,dd7

 pat* managem5t1 includ+ at1 or ne>1    
real-"t da%bo>ds ( pat* implem5tation   
across network ho/s2 &  7,,ii7 data     
security1 includ+-- 7aa7 data-c5tric    
security me*anisms su* z =mat-pres]v+   
encryption1 cryptographic data-splitt+1 
& data-tagg+ & l9eage2  7bb7 encryption 
= data at re/2  7cc7 encryption = data 9
 transit2  7dd7 sy/emwide data          
m9imization evaluations & policies2 &   
7ee7 data recov]y capability2 &  7ii7   
create & ma9ta9 docum5tation demon/rat+ 
t ! cov]$ consum] report+ ag5cy is      
employ+ reasonable te*nical measures &  
corporate gov]nance processes = cont9u\s
 monitor+ ( data1 intrusion detection1 &
 cont9u\s evaluation & timely pat*+ (   
vuln]abilities2  7,c7 annually exam9e ! 
data security measures ( cov]$ consum]  
report+ ag5cies = compliance ) ! /&>ds  
promulgat$ "u subp>agraph 7,b72  7,d7   
inve/igate any cov]$ consum] report+    
ag5cy if ! ,(fice has reason to suspect 
a pot5tial cov]$ brea* or noncompliance 
) ! /&>ds promulgat$ "u subp>agraph     

7,b72  7,e7 aft] consultation ) memb]s (
 ! te*nical & academic communities1     
develop a rigor\s1 repeatable me?odology
 = evaluat+1 te/+1 & measur+ effective  
data security practices ( cov]$ consum] 
report+ ag5cies1 t employs =ms ( /atic &
 dynamic s(tw>e analysis & p5etration   
te/+2  7,f7 submit to ,congress an      
annual report on ! f9d+s on any         
inve/igation "u subp>agraph 7,c72  7,g7 
det]m9e :e!r cov]$ consum] report+      
ag5cies are comply+ ) ! regulations     
promulgat$ "u subp>agraph 7,b72 &  7,h7 
coord9ate ) ! ,national ,in/itute (     
,/&>ds & ,te*nology & ! ,national       
,cyb]security & ,communications         
,integration ,c5t] ( ! ,dep>tm5t (      
,homel& ,security2 &  7#b7 may-- 7,a7   
inve/igate any brea* to det]m9e if !    
cov]$ consum] report+ ag5cy 0 9         
compliance ) ! regulations promulgat$ "u
 p>agraph 7#a77;,b72 &  7,b7 if !       
,commission has reason to believe t any 
cov]$ consum] report+ ag5cy is violat+1 
or is ab\t to violate1 a regulation     

promulgat$ "u p>agraph 7#a77;,b71 br+ a 
suit 9 a di/rict c\rt ( ! ,unit$ ,/ates 
to enjo9 any su* act or practice4  7c7  
,/aff  7#a7 ,9 g5]al ,! ,director %all1 
)\t reg>d to ! civil s]vice laws &      
regulations1 appo9t su* p]sonnel1       
includ+ comput] security rese>*]s &     
practition]s ) te*nical exp]tise 9      
comput] sci5ce1 eng9e]+1 & cyb]security1
 z ! ,director det]m9es are necess>y to 
c>ry out ! duties ( ! ,(fice4  7#b7     
,details ,an employee ( ! ,national     
,in/itute ( ,/&>ds & ,te*nology1 !      
,bureau ( ,consum] ,f9ancial            
,protection1 or ! ,national             
,cyb]security & ,communications         
,integration ,c5t] ( ! ,dep>tm5t (      
,homel& ,security may be detail$ to !   
,(fice1 )\t reimbursem5t1 & su* detail  
%all be )\t int]ruption or loss ( civil 
s]vice /atus or privilege4  #d4         
,notification & en=cem5t  7a7           
,notification ,n lat] ?an #aj days aft] 
a cov]$ brea*1 ! cov]$ consum] report+  
ag5cy t 0 subject to ! cov]$ brea* %all 

notify ! ,commission ( ! cov]$ brea*4   
7b7 ,p5alty  7#a7 ,9 g5]al ,9 ! ev5t ( a
 cov]$ brea*1 ! ,commission %all1 n lat]
 ?an #cj days aft] ! date on :i* !      
,commission receives notification ( !   
cov]$ brea*1 comm5ce a civil action to  
recov] a civil p5alty 9 a di/rict c\rt (
 ! ,unit$ ,/ates aga9/ ! cov]$ consum]  
report+ ag5cy t 0 subject to ! cov]$    
brea*4  7#b7 ,det]m9+ p5alty am\nt  7,a7
 ,9 g5]al ,except z provid$ 9           
subp>agraph 7,b71 9 det]m9+ ! am\nt ( a 
civil p5alty "u p>agraph 7#a71 ! c\rt   
%all impose a civil p5alty on a cov]$   
consum] report+ ag5cy (--  7i7 #ajj =   
ea* consum] ^: fir/ & la/ "n1 or fir/   
initial & la/ "n1 & at lea/ #a item (   
p]sonally id5tify+ in=mation 0          
compromis$2 &  7ii7 an additional #ej = 
ea* additional item ( p]sonally id5tify+
 in=mation compromis$ = ea* consum]4    
7,b7 ,exception  7i7 ,9 g5]al ,except z 
provid$ 9 clause 7ii71 a c\rt may n     
impose a civil p5alty "u ?is subsection 
9 an am\nt great] ?an #ej p]c5t ( !     

gross rev5ue ( ! cov]$ consum] report+  
ag5cy = ! previ\s fiscal ye> be=e ! date
 on :i* ! cov]$ consum] report+ ag5cy   
became aw>e ( ! cov]$ brea*4  7ii7      
,p5alty d\bl$ ,a c\rt %all impose a     
civil p5alty on a cov]$ consum] report+ 
ag5cy d\ble ! p5alty describ$ 9         
subp>agraph 7,a71 b n great] ?an #ge    
p]c5t ( ! gross rev5ue ( ! cov]$ consum]
 report+ ag5cy = ! previ\s fiscal ye>   
be=e ! date on :i* ! cov]$ consum]      
report+ ag5cy became aw>e ( ! cov]$     
brea* if--  7,i7 ! cov]$ consum] report+
 ag5cy fails to notify ! ,commission ( a
 cov]$ brea* be=e ! deadl9e e/abli%$ "u 
subsection 7a72 or  7,,ii7 ! cov]$      
consum] report+ ag5cy violates any      
regulation promulgat$ "u section        
#c7;b77#a77;,c74  7#c7 ,proce$s ( !     
p5alties ,( ! p5alties assess$ "u ?is   
subsection--  7,a7 #ej p]c5t %all be us$
 = cyb]security rese>* & inspections by 
! ,(fice ( ,cyb]security2 &  7,b7 #ej   
p]c5t %all be us$ by ! ,commission to be
 divid$ fairly among consum]s affect$ by

 ! cov]$ brea*4  7#d7 ,no preemption    
,no?+ 9 ?is subsection %all preclude an 
action by a consum] "u ,/ate or o!r     
,f$]al law4  7c7 ,injunctive relief ,!  
,commission may br+ suit 9 a di/rict    
c\rt ( ! ,unit$ ,/ates or 9 ! ,unit$    
,/ates c\rt ( any ,t]ritory to enjo9 a  
cov]$ consum] report+ ag5cy to implem5t 
or correct a p>ticul> security measure 9
 ord] to promote effective security4    
#e4 ,au?orization ( appropriations ,!re 
are au?oriz$ to be appropriat$          
#ajj1jjj1jjj to c>ry out ?is ,act1 to   
rema9 available until exp5d$4