,i  #aafth ,,congress  #ast ,session    
,h4 ,r4 #affh  ,,in ,,the ,,house ,,of  
,,representatives  ,march #aa1 #bjai,ms4
 ,kelly of ,illinois 7for herself1 ,mr4 
,hurd of ,texas1 ,mr4 ,khanna1 ,mr4     
,budd1 ,mr4 ,ruppersberger1 ,mr4        
,marshall1 ,mr4 ,ted ,lieu of           
,california1 ,mr4 ,ratcliffe1 ,mr4      
,meadows1 ,mr4 ,soto1 ,mr4 ,walker1 ,mr4
 ,connolly1 ,mr4 ,foster1 and ,mr4      
,baird7 introduced the following bill2  
which was referred to the ,committee on 
,oversight and ,reform1 and in addition 
to the ,committee on ,science1 ,space1  
and ,technology1 for a period to be     
subsequently determined by the ,speaker1
 in each case for consideration of such 
provisions as fall within the           
jurisdiction of the committee concerned 
,a ,,bill  ,to leverage ,federal        
,government procurement power to        
encourage increased cybersecurity for   
,internet of ,things devices1 and for   
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,internet of   

,things ,cybersecurity ,improvement ,act
 of #bjai or the ,io,t ,cybersecurity   
,improvement ,act of #bjai4  #b4        
,definitions ,in this ,act3  7#a7       
,agency ,the term agency has the meaning
 given such term in section #cejb of    
title #dd1 ,united ,states ,code4  7#b7 
,covered device  7,a7 ,in general ,the  
term covered device means a physical    
object that--  7i7 is capable of        
connecting to and is in regular         
connection with the internet2  7ii7 has 
computer processing capabilities that   
can collect1 send1 or receive data2 and 
7iii7 is not a general-purpose computing
 device1 including personal computing   
systems1 smart mobile communications    
devices1 programmable logic controls1   
and mainframe computing systems4  7,b7  
,modification of definition ,the        
,director of the ,office of ,management 
and ,budget shall establish a process by
 which-- 7i7 interested parties may     
petition for a device that is not       
described in subparagraph 7,a7 to be    

considered a device that is not a       
covered device2 and  7ii7 the ,director 
acts upon any petition submitted under  
clause 7i7 in a timely manner4  7#c7    
,security vulnerability ,the term       
security vulnerability means any        
attribute of hardware1 firmware1        
software1 or combination of #b or more  
of these factors that could enable the  
compromise of the confidentiality1      
integrity1 or availability of an        
information system or its information or
 physical devices to which it is        
connected4  #c4 ,national ,institute of 
,standards and ,technology              
considerations and recommendations      
regarding managing ,internet of ,things 
cybersecurity risks  7a7 ,completion of 
ongoing efforts relating to             
considerations for managing ,internet of
 ,things cybersecurity risks  7#a7 ,in  
general ,the ,director of the ,national 
,institute of ,standards and ,technology
 shall ensure that the efforts of the   
,institute in effect on the date of the 

enactment of this ,act regarding        
considerations for managing ,internet of
 ,things cybersecurity risks1 especially
 regarding examples of possible         
cybersecurity capabilities of ,internet 
of ,things devices1 are completed no    
later than ,september #cj1 #bjai4  7#b7 
,matters addressed ,in ensuring efforts 
are completed under paragraph 7#a71 the 
,director shall also ensure that such   
efforts address1 at a minimum1 the      
following considerations for covered    
devices3  7,a7 ,secure ,development4    
7,b7 ,identity management4  7,c7        
,patching4  7,d7 ,configuration         
management4  7b7 ,development of        
recommended standards for use of        
,internet of ,things devices by ,federal
 ,government  7#a7 ,in general ,not     
later than ,march #ca1 #bjbj1 the       
,director of the ,institute shall       
develop recommendations for the ,federal
 ,government on the appropriate use and 
management by the ,federal ,government  
of ,internet of ,things devices owned or

 controlled by the ,federal ,government1
 including minimum information security 
requirements for managing cybersecurity 
risks associated with such devices4     
7#b7 ,consistency with ongoing efforts  
,the ,director of the ,institute shall  
ensure that the recommendations and     
standards developed under paragraph 7#a7
 are consistent with the efforts        
referred to in subsection 7a71          
especially with respect to the examples 
of possible cybersecurity capabilities  
referred to in such subsection4  7c7    
,institute ,report on cybersecurity     
considerations stemming from the        
convergence of ,information ,technology1
 ,internet of ,things1 and ,operational 
,technology devices1 networks and       
systems ,not later than #ahj days       
following the enactment of this ,act1   
the ,director of the ,institute shall   
publish a draft report related to the   
increasing convergence of traditional   
,information ,technology devices1       
networks1 and systems with ,internet of 

,things devices1 networks and systems   
and ,operational ,technology devices1   
networks and systems1 including         
considerations for managing             
cybersecurity risks associated with such
 trends4  #d4 ,policies for ,federal    
agencies on use and management of       
,internet of ,things devices  7a7       
,revisions to the ,federal acquisition  
regulation ,not later than #ahj days    
after the date on which the ,director of
 the ,national ,institute of ,standards 
and ,technology completes the           
development of the recommendations      
required under section #c7;b71 the      
,director of the ,office of ,management 
and ,budget shall issue guidelines for  
each agency that are consistent with    
such recommendations4  7b7 ,requirement 
,in issuing the guidelines required     
under subsection 7a71 the ,director of  
the ,office of ,management and ,budget  
shall ensure that the guidelines are    
consistent with the information security
 requirements in subchapter ,,ii of     

chapter #ce of title #dd1 ,united       
,states ,code4  7c7 ,quinquennial       
reviews and revisions ,not less         
frequently than once every #e years--   
7#a7 the ,director of the ,office of    
,management and ,budget and the         
,director of the ,national ,institute of
 ,standards and ,technology shall review
 the policies issued under subsection   
7a72 and  7#b7 the ,director of the     
,office of ,management and ,budget      
shall1 in consultation with the         
,director of the ,national ,institute of
 ,standards and ,technology1 revise such
 policies4  #e4 ,national ,institute of 
,standards and ,technology guidance on  
coordinated disclosure of security      
vulnerabilities relating to ,internet of
 ,things devices  7a7 ,in general ,not  
later than #ahj days after the date of  
the enactment of this ,act1 the         
,director of the ,national ,institute of
 ,standards and ,technology shall1 in   
consultation with such cybersecurity    
researchers and private-sector industry 

experts as the ,director considers      
appropriate1 publish guidance on        
policies and procedures for the         
reporting1 coordinating1 publishing1 and
 receiving of information about--  7#a7 
a security vulnerability relating to a  
covered device used by the ,federal     
,government2 and  7#b7 the resolution of
 such security vulnerability4  7b7      
,elements ,the guidance published under 
subsection 7a7 shall include the        
following3 7#a7 ,policies and procedures
 described in subsection 7a7 that1 to   
the maximum extent practicable1 are     
aligned with ,standards #biadg and      
#cjaaa of the ,international ,standards 
,organization1 or any successor         
standards4 ,such policies and procedures
 shall include policies and procedures  
for a contractor or vendor providing a  
covered device to the ,federal          
,government on--  7,a7 receiving        
information about a potential security  
vulnerability relating to the covered   
device2 and  7,b7 disseminating         

information about the resolution of a   
security vulnerability relating to the  
covered device4  7#b7 ,guidance1        
including example content1 on the       
information items that should be        
produced through the implementation of  
the security vulnerability disclosure   
process of the contractor4  #f4         
,guidelines for ,federal agencies on    
coordinated disclosure of security      
vulnerabilities relating to ,internet of
 ,things devices  7a7 ,agency guidelines
 required ,not later than #ahj days     
after the date on which the guidance    
required under section #d is published1 
the ,director of the ,office of         
,management and ,budget shall1 in       
consultation with the ,administrator of 
the ,general ,services ,administration1 
issue guidelines for each agency on     
reporting1 coordinating1 publishing1 and
 receiving information about--  7#a7 a  
security vulnerability relating to a    
covered device used by the agency2 and  
7#b7 the resolution of such security    

vulnerability4  7b7 ,contractor and     
vendor compliance with ,national        
,institute of ,standards and ,technology
 guidance ,the guidelines required by   
subsection 7a7 shall include a          
limitation that prohibits an agency from
 acquiring or using any covered device  
from a contractor or vendor if the      
contractor or vendor fails to comply    
with the guidance published under       
section #e7;a74  7c7 ,consistency with  
guidance from ,national ,institute of   
,standards and ,technology ,the         
,director shall ensure that the         
guidelines issued under subsection 7a7  
are consistent with the guidance        
published under section #e7;a74