,,ii #aafth ,,congress #b;d ,session ,h4 ,r4 #affh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #ae1 #bjbj,received ,,an ,,act ,to establish minimum security standards for ,internet of ,things devices owned or controlled by the ,federal ,government1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj or the ,io,t ,cybersecurity ,improvement ,act of #bjbj4 #b4 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 ensuring the highest level of cybersecurity at agencies in the executive branch is the responsibility of the ,president1 followed by the ,director of the ,office of ,management and ,budget1 the ,secretary of ,homeland ,security1 and the head of each such agency2 7#b7 this responsibility is to be carried out by working collaboratively within and among agencies in the executive branch1 industry1 and academia2 7#c7 the strength of the cybersecurity of the ,federal ,government and the positive benefits of digital technology transformation depend on proactively addressing cybersecurity throughout the acquisition and operation of ,internet of ,things devices by the ,federal ,government2 and 7#d7 consistent with the second draft ,national ,institute for ,standards and ,technology ,interagency or ,internal ,report #hbei titled ,recommendations for ,io,t ,device ,manufacturers3 ,foundational ,activities and ,core ,device ,cybersecurity ,capability ,baseline1 published in ,january #bjbj1 ,internet of ,things devices are devices that-- 7,a7 have at least one transducer 7sensor or actuator7 for interacting directly with the physical world1 have at least one network interface1 and are not conventional ,information ,technology devices1 such as smartphones and laptops1 for which the identification and implementation of cybersecurity features is already well understood2 and 7,b7 can function on their own and are not only able to function when acting as a component of another device1 such as a processor4 #c4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,director of ,,omb ,the term ,director of ,,omb means the ,director of the ,office of ,management and ,budget4 7#c7 ,director of the ,institute ,the term ,director of the ,institute means the ,director of the ,national ,institute of ,standards and ,technology4 7#d7 ,information system ,the term information system has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#e7 ,national security system ,the term national security system has the meaning given that term in section #ceeb7;b77#f7 of title #dd1 ,united ,states ,code4 7#f7 ,operational technology ,the term operational technology means hardware and software that detects or causes a change through the direct monitoring or control of physical devices1 processes1 and events in the enterprise4 7#g7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#h7 ,security vulnerability ,the term security vulnerability has the meaning given that term in section #ajb7ag7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag774 #d4 ,security standards and guidelines for agencies on use and management of ,internet of ,things devices 7a7 ,national ,institute of ,standards and ,technology development of standards and guidelines for use of ,internet of ,things devices by agencies 7#a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,director of the ,institute shall develop and publish under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 standards and guidelines for the ,federal ,government on the appropriate use and management by agencies of ,internet of ,things devices owned or controlled by an agency and connected to information systems owned or controlled by an agency1 including minimum information security requirements for managing cybersecurity risks associated with such devices4 7#b7 ,consistency with ongoing efforts ,the ,director of the ,institute shall ensure that the standards and guidelines developed under paragraph 7#a7 are consistent with the efforts of the ,national ,institute of ,standards and ,technology in effect on the date of the enactment of this ,act-- 7,a7 regarding-- 7i7 examples of possible security vulnerabilities of ,internet of ,things devices2 and 7ii7 considerations for managing the security vulnerabilities of ,internet of ,things devices2 and 7,b7 with respect to the following considerations for ,internet of ,things devices3 7i7 ,secure ,development4 7ii7 ,identity management4 7iii7 ,patching4 7iv7 ,configuration management4 7#c7 ,considering relevant standards ,in developing the standards and guidelines under paragraph 7#a71 the ,director of the ,institute shall consider relevant standards1 guidelines1 and best practices developed by the private sector1 agencies1 and public-private partnerships4 7b7 ,review of agency information security policies and principles 7#a7 ,requirement ,not later than #ahj days after the date on which the ,director of the ,institute completes the development of the standards and guidelines required under subsection 7a71 the ,director of ,,omb shall review agency information security policies and principles on the basis of the standards and guidelines published under subsection 7a7 pertaining to ,internet of ,things devices owned or controlled by agencies 7excluding agency information security policies and principles pertaining to ,internet of ,things of devices owned or controlled by agencies that are or comprise a national security system7 for consistency with the standards and guidelines submitted under subsection 7a7 and issue such policies and principles as may be necessary to ensure those policies and principles are consistent with such standards and guidelines4 7#b7 ,review ,in reviewing agency information security policies and principles under paragraph 7#a7 and issuing policies and principles under such paragraph1 as may be necessary1 the ,director of ,,omb shall-- 7,a7 consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security2 and 7,b7 ensure such policies and principles are consistent with the information security requirements under subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code4 7#c7 ,national security systems ,any policy or principle issued by the ,director of ,,omb under paragraph 7#a7 shall not apply to national security systems4 7c7 ,quinquennial review and revision 7#a7 ,review and revision of ,,nist standards and guidelines ,not later than #e years after the date on which the ,director of the ,institute publishes the standards and guidelines under subsection 7a71 and not less frequently than once every #e years thereafter1 the ,director of the ,institute1 shall-- 7,a7 review such standards and guidelines2 and 7,b7 revise such standards and guidelines as appropriate4 7#b7 ,updated ,,omb policies and principles for agencies ,not later than #ahj days after the ,director of the ,institute makes a revision pursuant to paragraph 7#a71 the ,director of ,,omb1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 shall update any policy or principle issued under subsection 7b77#a7 as necessary to ensure those policies and principles are consistent with the review and any revision under paragraph 7#a7 under this subsection and paragraphs 7#b7 and 7#c7 of subsection 7b74 7d7 ,revision of ,federal ,acquisition ,regulation ,the ,federal ,acquisition ,regulation shall be revised as necessary to implement any standards and guidelines promulgated in this section4 #e4 ,guidelines on the disclosure process for security vulnerabilities relating to information systems1 including ,internet of ,things devices 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,institute1 in consultation with such cybersecurity researchers and private sector industry experts as the ,director considers appropriate1 and in consultation with the ,secretary1 shall develop and publish under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 guidelines-- 7#a7 for the reporting1 coordinating1 publishing1 and receiving of information about-- 7,a7 a security vulnerability relating to information systems owned or controlled by an agency 7including ,internet of ,things devices owned or controlled by an agency72 and 7,b7 the resolution of such security vulnerability2 and 7#b7 for a contractor providing to an agency an information system 7including an ,internet of ,things device7 and any subcontractor thereof at any tier providing such information system to such contractor1 on-- 7,a7 receiving information about a potential security vulnerability relating to the information system2 and 7,b7 disseminating information about the resolution of a security vulnerability relating to the information system4 7b7 ,elements ,the guidelines published under subsection 7a7 shall-- 7#a7 to the maximum extent practicable1 be aligned with industry best practices and ,standards #biadg and #cjaaa of the ,international ,standards ,organization 7or any successor standard7 or any other appropriate1 relevant1 and widely-used standard2 7#b7 incorporate guidelines on-- 7,a7 receiving information about a potential security vulnerability relating to an information system owned or controlled by an agency 7including an ,internet of ,things device72 and 7,b7 disseminating information about the resolution of a security vulnerability relating to an information system owned or controlled by an agency 7including an ,internet of ,things device72 and 7#c7 be consistent with the policies and procedures produced under section #bjji7m7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7m774 7c7 ,information items ,the guidelines published under subsection 7a7 shall include example content1 on the information items that should be reported1 coordinated1 published1 or received pursuant to this section by a contractor1 or any subcontractor thereof at any tier1 providing an information system 7including ,internet of ,things device7 to the ,federal ,government4 7d7 ,oversight ,the ,director of ,,omb shall oversee the implementation of the guidelines published under subsection 7a74 7e7 ,operational and technical assistance ,the ,secretary1 in consultation with the ,director of ,,omb1 shall administer the implementation of the guidelines published under subsection 7a7 and provide operational and technical assistance in implementing such guidelines4 #f4 ,implementation of coordinated disclosure of security vulnerabilities relating to agency information systems1 including internet of things devices 7a7 ,agency guidelines required ,not later than #b years after the date of the enactment of this ,act1 the ,director of ,,omb1 in consultation with the ,secretary1 shall develop and oversee the implementation of policies1 principles1 standards1 or guidelines as may be necessary to address security vulnerabilities of information systems 7including ,internet of ,things devices74 7b7 ,operational and technical assistance ,consistent with section #ceec7;b7 of title #dd1 ,united ,states ,code1 the ,secretary1 in consultation with the ,director of ,,omb1 shall provide operational and technical assistance to agencies on reporting1 coordinating1 publishing1 and receiving information about security vulnerabilities of information systems 7including ,internet of ,things devices74 7c7 ,consistency with guidelines from national institute of standards and technology ,the ,secretary shall ensure that the assistance provided under subsection 7b7 is consistent with applicable standards and publications developed by the ,director of the ,institute4 7d7 ,revision of federal acquisition regulation ,the ,federal ,acquisition ,regulation shall be revised as necessary to implement the provisions under this section4 #g4 ,contractor compliance with coordinated disclosure of security vulnerabilities relating to agency internet of things devices 7a7 ,prohibition on procurement and use 7#a7 ,in general ,the head of an agency is prohibited from procuring or obtaining1 renewing a contract to procure or obtain1 or using an ,internet of ,things device1 if the ,chief ,information ,officer of that agency determines during a review required by section #aacai7;b77#a77;,c7 of title #dj1 ,united ,states ,code1 of a contract for such device that the use of such device prevents compliance with the standards and guidelines developed under section #d or the guidelines published under section #e with respect to such device4 7#b7 ,simplified acquisition threshold ,notwithstanding section #aije of title #da1 ,united ,states ,code1 the requirements under paragraph 7#a7 shall apply to a contract or subcontract in amounts not greater than the simplified acquisition threshold4 7b7 ,waiver 7#a7 ,authority ,the head of an agency may waive the prohibition under subsection 7a77#a7 with respect to an ,internet of ,things device if the ,chief ,information ,officer of that agency determines that-- 7,a7 the waiver is necessary in the interest of national security2 7,b7 procuring1 obtaining1 or using such device is necessary for research purposes2 or 7,c7 such device is secured using alternative and effective methods appropriate to the function of such device4 7#b7 ,agency process ,the ,director of ,,omb shall establish a standardized process for the ,chief ,information ,officer of each agency to follow in determining whether the waiver under paragraph 7#a7 may be granted4 7c7 ,reports to ,congress 7#a7 ,report ,every #b years during the #f-year period beginning on the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report-- 7,a7 on the effectiveness of the process established under subsection 7b77#b72 7,b7 that contains recommended best practices for the procurement of ,internet of ,things devices2 and 7,c7 that lists-- 7i7 the number and type of each ,internet of ,things device for which a waiver under subsection 7b77#a7 was granted during the #b-year period prior to the submission of the report2 and 7ii7 the legal authority under which each such waiver was granted1 such as whether the waiver was granted pursuant to subparagraph 7,a71 7,b71 or 7,c7 of such subsection4 7#b7 ,classification of report ,each report submitted under this subsection shall be submitted in unclassified form1 but may include a classified annex that contains the information described under paragraph 7#a77;,c74 7d7 ,effective date ,the prohibition under subsection 7a77#a7 shall take effect #b years after the date of the enactment of this ,act4 #h4 ,government accountability office report on cybersecurity considerations stemming from the convergence of information technology1 ,internet of ,things1 and operational technology devices1 networks1 and systems 7a7 ,briefing ,not later than #a year after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall provide a briefing to the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate on broader ,internet of ,things efforts1 including projects designed to assist in managing potential security vulnerabilities associated with the use of traditional information technology devices1 networks1 and systems with-- 7#a7 ,internet of ,things devices1 networks1 and systems2 and 7#b7 operational technology devices1 networks1 and systems4 7b7 ,report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general shall submit a report to the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate on broader ,internet of ,things efforts addressed in subsection 7a74 ,passed the ,house of ,representatives ,september #ad1 #bjbj4;,cheryl ,l4 ,johnson1,clerk