,,ii  #aaf? ,,congress  #b;d ,session   
,h4 ,r4 #affh  ,,9 ,,! ,,s5ate ,,( ,,!  
,,unit$ ,,/ates  ,septemb] #ae1         
#bjbj,receiv$  ,,an ,,act  ,to e/abli%  
m9imum security /&>ds = ,int]net ( ,?+s 
devices own$ or controll$ by ! ,f$]al   
,gov]nm5t1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z ! ,int]net
 ( ,?+s ,cyb]security ,improvem5t ,act (
 #bjbj or ! ,io,t ,cyb]security         
,improvem5t ,act ( #bjbj4  #b4 ,s5se (  
,congress ,x is ! s5se ( ,congress t--  
7#a7 ensur+ ! highe/ level (            
cyb]security at ag5cies 9 ! executive   
bran* is ! responsibility ( ! ,presid5t1
 foll[$ by ! ,director ( ! ,(fice (     
,managem5t & ,budget1 ! ,secret>y (     
,homel& ,security1 & ! head ( ea* su*   
ag5cy2  7#b7 ?is responsibility is to be
 c>ri$ out by work+ collaboratively )9 &
 among ag5cies 9 ! executive bran*1     
indu/ry1 & academia2  7#c7 ! /r5g? ( !  
cyb]security ( ! ,f$]al ,gov]nm5t & !   
positive b5efits ( digital te*nology    
trans=mation dep5d on proactively       

address+ cyb]security ?r\gh\t !         
acquisition & op]ation ( ,int]net ( ,?+s
 devices by ! ,f$]al ,gov]nm5t2 &  7#d7 
consi/5t ) ! second draft ,national     
,in/itute = ,/&>ds & ,te*nology         
,int]ag5cy or ,int]nal ,report #hbei    
titl$ ,recomm5dations = ,io,t ,device   
,manufactur]s3 ,f\ndational ,activities 
& ,core ,device ,cyb]security           
,capability ,basel9e1 publi%$ 9 ,janu>y 
#bjbj1 ,int]net ( ,?+s devices are      
devices t-- 7,a7 h at lea/ "o transduc] 
7s5sor or actuator7 = int]act+ directly 
) ! physical _w1 h at lea/ "o network   
int]face1 & are n conv5tional ,in=mation
 ,te*nology devices1 su* z sm>tphones & 
laptops1 = :i* ! id5tification &        
implem5tation ( cyb]security features is
 already well und]/ood2 &  7,b7 c       
function on _! own & are n only able to 
function :5 act+ z a compon5t ( ano!r   
device1 su* z a processor4  #c4         
,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! 
t]m ag5cy has ! mean+ giv5 t t]m 9      
section #cejb ( title #dd1 ,unit$ ,/ates

 ,code4  7#b7 ,director ( ,,omb ,! t]m  
,director ( ,,omb means ! ,director ( ! 
,(fice ( ,managem5t & ,budget4  7#c7    
,director ( ! ,in/itute ,! t]m ,director
 ( ! ,in/itute means ! ,director ( !    
,national ,in/itute ( ,/&>ds &          
,te*nology4  7#d7 ,in=mation sy/em ,!   
t]m in=mation sy/em has ! mean+ giv5 t  
t]m 9 section #cejb ( title #dd1 ,unit$ 
,/ates ,code4  7#e7 ,national security  
sy/em ,! t]m national security sy/em has
 ! mean+ giv5 t t]m 9 section           
#ceeb7;b77#f7 ( title #dd1 ,unit$ ,/ates
 ,code4  7#f7 ,op]ational te*nology ,!  
t]m op]ational te*nology means h>dw>e & 
s(tw>e t detects or causes a *ange ?r\gh
 ! direct monitor+ or control ( physical
 devices1 processes1 & ev5ts 9 !        
ent]prise4  7#g7 ,secret>y ,! t]m       
,secret>y means ! ,secret>y ( ,homel&   
,security4  7#h7 ,security vuln]ability 
,! t]m security vuln]ability has ! mean+
 giv5 t t]m 9 section #ajb7ag7 ( !      
,cyb]security ,in=mation ,%>+ ,act (    
#bjae 7#f ,u4,s4,c4 #aeja7ag774  #d4    

,security /&>ds & guidel9es = ag5cies on
 use & managem5t ( ,int]net ( ,?+s      
devices  7a7 ,national ,in/itute (      
,/&>ds & ,te*nology developm5t ( /&>ds &
 guidel9es = use ( ,int]net ( ,?+s      
devices by ag5cies  7#a7 ,9 g5]al ,n    
lat] ?an #ij days aft] ! date ( !       
enactm5t ( ?is ,act1 ! ,director ( !    
,in/itute %all develop & publi% "u      
section #bj ( ! ,national ,in/itute (   
,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 
#bgh;g-#c7 /&>ds & guidel9es = ! ,f$]al 
,gov]nm5t on ! appropriate use &        
managem5t by ag5cies ( ,int]net ( ,?+s  
devices own$ or controll$ by an ag5cy & 
connect$ to in=mation sy/ems own$ or    
controll$ by an ag5cy1 includ+ m9imum   
in=mation security requirem5ts = manag+ 
cyb]security risks associat$ ) su*      
devices4  7#b7 ,consi/5cy ) ongo+ ef=ts 
,! ,director ( ! ,in/itute %all ensure t
 ! /&>ds & guidel9es develop$ "u        
p>agraph 7#a7 are consi/5t ) ! ef=ts ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology 9 effect on ! date ( !       

enactm5t ( ?is ,act-- 7,a7 reg>d+-- 7i7 
examples ( possible security            
vuln]abilities ( ,int]net ( ,?+s        
devices2 &  7ii7 consid]ations = manag+ 
! security vuln]abilities ( ,int]net (  
,?+s devices2 &  7,b7 ) respect to !    
foll[+ consid]ations = ,int]net ( ,?+s  
devices3 7i7 ,secure ,developm5t4  7ii7 
,id5tity managem5t4  7iii7 ,pat*+4  7iv7
 ,configuration managem5t4  7#c7        
,consid]+ relevant /&>ds ,9 develop+ !  
/&>ds & guidel9es "u p>agraph 7#a71 !   
,director ( ! ,in/itute %all consid]    
relevant /&>ds1 guidel9es1 & be/        
practices develop$ by ! private sector1 
ag5cies1 & public-private p>tn]%ips4    
7b7 ,review ( ag5cy in=mation security  
policies & pr9ciples  7#a7 ,requirem5t  
,n lat] ?an #ahj days aft] ! date on :i*
 ! ,director ( ! ,in/itute completes !  
developm5t ( ! /&>ds & guidel9es requir$
 "u subsection 7a71 ! ,director ( ,,omb 
%all review ag5cy in=mation security    
policies & pr9ciples on ! basis ( !     
/&>ds & guidel9es publi%$ "u subsection 

7a7 p]ta9+ to ,int]net ( ,?+s devices   
own$ or controll$ by ag5cies 7exclud+   
ag5cy in=mation security policies &     
pr9ciples p]ta9+ to ,int]net ( ,?+s (   
devices own$ or controll$ by ag5cies t  
are or comprise a national security     
sy/em7 = consi/5cy ) ! /&>ds & guidel9es
 submitt$ "u subsection 7a7 & issue su* 
policies & pr9ciples z may be necess>y  
to ensure ^? policies & pr9ciples are   
consi/5t ) su* /&>ds & guidel9es4  7#b7 
,review ,9 review+ ag5cy in=mation      
security policies & pr9ciples "u        
p>agraph 7#a7 & issu+ policies &        
pr9ciples "u su* p>agraph1 z may be     
necess>y1 ! ,director ( ,,omb %all--    
7,a7 consult ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy ( ! ,dep>tm5t ( ,homel&         
,security2 &  7,b7 ensure su* policies &
 pr9ciples are consi/5t ) ! in=mation   
security requirem5ts "u sub*apt] ,,ii ( 
*apt] #ce ( title #dd1 ,unit$ ,/ates    
,code4  7#c7 ,national security sy/ems  
,any policy or pr9ciple issu$ by !      

,director ( ,,omb "u p>agraph 7#a7 %all 
n apply to national security sy/ems4    
7c7 ,qu9qu5nial review & revision  7#a7 
,review & revision ( ,,ni/ /&>ds &      
guidel9es ,n lat] ?an #e ye>s aft] !    
date on :i* ! ,director ( ! ,in/itute   
publi%es ! /&>ds & guidel9es "u         
subsection 7a71 & n less frequ5tly ?an  
once e #e ye>s !reaft]1 ! ,director ( ! 
,in/itute1 %all-- 7,a7 review su* /&>ds 
& guidel9es2 &  7,b7 revise su* /&>ds & 
guidel9es z appropriate4  7#b7 ,updat$  
,,omb policies & pr9ciples = ag5cies ,n 
lat] ?an #ahj days aft] ! ,director ( ! 
,in/itute makes a revision pursuant to  
p>agraph 7#a71 ! ,director ( ,,omb1 9   
consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy ( ! ,dep>tm5t ( ,homel&         
,security1 %all update any policy or    
pr9ciple issu$ "u subsection 7b77#a7 z  
necess>y to ensure ^? policies &        
pr9ciples are consi/5t ) ! review & any 
revision "u p>agraph 7#a7 "u ?is        
subsection & p>agraphs 7#b7 & 7#c7 (    

subsection 7b74  7d7 ,revision ( ,f$]al 
,acquisition ,regulation ,! ,f$]al      
,acquisition ,regulation %all be revis$ 
z necess>y to implem5t any /&>ds &      
guidel9es promulgat$ 9 ?is section4  #e4
 ,guidel9es on ! disclosure process =   
security vuln]abilities relat+ to       
in=mation sy/ems1 includ+ ,int]net (    
,?+s devices  7a7 ,9 g5]al ,n lat] ?an  
#ahj days aft] ! date ( ! enactm5t ( ?is
 ,act1 ! ,director ( ! ,in/itute1 9     
consultation ) su* cyb]security rese>*]s
 & private sector indu/ry exp]ts z !    
,director consid]s appropriate1 & 9     
consultation ) ! ,secret>y1 %all develop
 & publi% "u section #bj ( ! ,national  
,in/itute ( ,/&>ds & ,te*nology ,act    
7#ae ,u4,s4,c4 #bgh;g-#c7 guidel9es--   
7#a7 = ! report+1 coord9at+1 publi%+1 & 
receiv+ ( in=mation ab\t-- 7,a7 a       
security vuln]ability relat+ to         
in=mation sy/ems own$ or controll$ by an
 ag5cy 7includ+ ,int]net ( ,?+s devices 
own$ or controll$ by an ag5cy72 &  7,b7 
! resolution ( su* security             

vuln]ability2 &  7#b7 = a contractor    
provid+ to an ag5cy an in=mation sy/em  
7includ+ an ,int]net ( ,?+s device7 &   
any subcontractor !re( at any ti]       
provid+ su* in=mation sy/em to su*      
contractor1 on-- 7,a7 receiv+ in=mation 
ab\t a pot5tial security vuln]ability   
relat+ to ! in=mation sy/em2 &  7,b7    
dissem9at+ in=mation ab\t ! resolution (
 a security vuln]ability relat+ to !    
in=mation sy/em4  7b7 ,elem5ts ,!       
guidel9es publi%$ "u subsection 7a7     
%all-- 7#a7 to ! maximum ext5t          
practicable1 be align$ ) indu/ry be/    
practices & ,/&>ds #biadg & #cjaaa ( !  
,int]national ,/&>ds ,organization 7or  
any successor /&>d7 or any o!r          
appropriate1 relevant1 & widely-us$     
/&>d2  7#b7 incorporate guidel9es on--  
7,a7 receiv+ in=mation ab\t a pot5tial  
security vuln]ability relat+ to an      
in=mation sy/em own$ or controll$ by an 
ag5cy 7includ+ an ,int]net ( ,?+s       
device72 &  7,b7 dissem9at+ in=mation   
ab\t ! resolution ( a security          

vuln]ability relat+ to an in=mation     
sy/em own$ or controll$ by an ag5cy     
7includ+ an ,int]net ( ,?+s device72 &  
7#c7 be consi/5t ) ! policies &         
proc$ures produc$ "u section #bjji7m7 ( 
! ,homel& ,security ,act ( #bjjb 7#f    
,u4,s4,c4 #fei7m774  7c7 ,in=mation     
items ,! guidel9es publi%$ "u subsection
 7a7 %all include example cont5t1 on !  
in=mation items t %\ld be report$1      
coord9at$1 publi%$1 or receiv$ pursuant 
to ?is section by a contractor1 or any  
subcontractor !re( at any ti]1 provid+  
an in=mation sy/em 7includ+ ,int]net (  
,?+s device7 to ! ,f$]al ,gov]nm5t4  7d7
 ,ov]sight ,! ,director ( ,,omb %all    
ov]see ! implem5tation ( ! guidel9es    
publi%$ "u subsection 7a74  7e7         
,op]ational & te*nical assi/ance ,!     
,secret>y1 9 consultation ) ! ,director 
( ,,omb1 %all adm9i/] ! implem5tation ( 
! guidel9es publi%$ "u subsection 7a7 & 
provide op]ational & te*nical assi/ance 
9 implem5t+ su* guidel9es4  #f4         
,implem5tation ( coord9at$ disclosure ( 

security vuln]abilities relat+ to ag5cy 
in=mation sy/ems1 includ+ int]net ( ?+s 
devices  7a7 ,ag5cy guidel9es requir$ ,n
 lat] ?an #b ye>s aft] ! date ( !       
enactm5t ( ?is ,act1 ! ,director (      
,,omb1 9 consultation ) ! ,secret>y1    
%all develop & ov]see ! implem5tation ( 
policies1 pr9ciples1 /&>ds1 or guidel9es
 z may be necess>y to address security  
vuln]abilities ( in=mation sy/ems       
7includ+ ,int]net ( ,?+s devices74  7b7 
,op]ational & te*nical assi/ance        
,consi/5t ) section #ceec7;b7 ( title   
#dd1 ,unit$ ,/ates ,code1 ! ,secret>y1 9
 consultation ) ! ,director ( ,,omb1    
%all provide op]ational & te*nical      
assi/ance to ag5cies on report+1        
coord9at+1 publi%+1 & receiv+ in=mation 
ab\t security vuln]abilities ( in=mation
 sy/ems 7includ+ ,int]net ( ,?+s        
devices74  7c7 ,consi/5cy ) guidel9es f 
national in/itute ( /&>ds & te*nology ,!
 ,secret>y %all ensure t ! assi/ance    
provid$ "u subsection 7b7 is consi/5t ) 
applicable /&>ds & publications develop$

 by ! ,director ( ! ,in/itute4  7d7     
,revision ( f$]al acquisition regulation
 ,! ,f$]al ,acquisition ,regulation %all
 be revis$ z necess>y to implem5t !     
provisions "u ?is section4  #g4         
,contractor compliance ) coord9at$      
disclosure ( security vuln]abilities    
relat+ to ag5cy int]net ( ?+s devices   
7a7 ,prohibition on procurem5t & use    
7#a7 ,9 g5]al ,! head ( an ag5cy is     
prohibit$ f procur+ or obta9+1 r5ew+ a  
contract to procure or obta91 or us+ an 
,int]net ( ,?+s device1 if ! ,*ief      
,in=mation ,(fic] ( t ag5cy det]m9es    
dur+ a review requir$ by section        
#aacai7;b77#a77;,c7 ( title #dj1 ,unit$ 
,/ates ,code1 ( a contract = su* device 
t ! use ( su* device prev5ts compliance 
) ! /&>ds & guidel9es develop$ "u       
section #d or ! guidel9es publi%$ "u    
section #e ) respect to su* device4     
7#b7 ,simplifi$ acquisition ?re%old     
,not)/&+ section #aije ( title #da1     
,unit$ ,/ates ,code1 ! requirem5ts "u   
p>agraph 7#a7 %all apply to a contract  

or subcontract 9 am\nts n great] ?an !  
simplifi$ acquisition ?re%old4  7b7     
,waiv]  7#a7 ,au?ority ,! head ( an     
ag5cy may waive ! prohibition "u        
subsection 7a77#a7 ) respect to an      
,int]net ( ,?+s device if ! ,*ief       
,in=mation ,(fic] ( t ag5cy det]m9es t--
 7,a7 ! waiv] is necess>y 9 ! int]e/ (  
national security2  7,b7 procur+1       
obta9+1 or us+ su* device is necess>y = 
rese>* purposes2 or  7,c7 su* device is 
secur$ us+ alt]native & effective me?ods
 appropriate to ! function ( su* device4
  7#b7 ,ag5cy process ,! ,director (    
,,omb %all e/abli% a /&>diz$ process = !
 ,*ief ,in=mation ,(fic] ( ea* ag5cy to 
foll[ 9 det]m9+ :e!r ! waiv] "u p>agraph
 7#a7 may be grant$4  7c7 ,reports to   
,congress  7#a7 ,report ,e #b ye>s dur+ 
! #f-ye> p]iod beg9n+ on ! date ( !     
enactm5t ( ?is ,act1 ! ,comptroll]      
,g5]al ( ! ,unit$ ,/ates %all submit to 
! ,committee on ,ov]sight & ,re=m ( !   
,h\se ( ,repres5tatives1 ! ,committee on
 ,homel& ,security ( ! ,h\se (          

,repres5tatives1 & ! ,committee on      
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate a report-- 7,a7 on !        
effectiv5ess ( ! process e/abli%$ "u    
subsection 7b77#b72  7,b7 t conta9s     
recomm5d$ be/ practices = ! procurem5t (
 ,int]net ( ,?+s devices2 &  7,c7 t     
li/s-- 7i7 ! numb] & type ( ea* ,int]net
 ( ,?+s device = :i* a waiv] "u         
subsection 7b77#a7 0 grant$ dur+ !      
#b-ye> p]iod prior to ! submission ( !  
report2 &  7ii7 ! legal au?ority "u :i* 
ea* su* waiv] 0 grant$1 su* z :e!r !    
waiv] 0 grant$ pursuant to subp>agraph  
7,a71 7,b71 or 7,c7 ( su* subsection4   
7#b7 ,classification ( report ,ea*      
report submitt$ "u ?is subsection %all  
be submitt$ 9 unclassifi$ =m1 b may     
include a classifi$ annex t conta9s !   
in=mation describ$ "u p>agraph          
7#a77;,c74  7d7 ,effective date ,!      
prohibition "u subsection 7a77#a7 %all  
take effect #b ye>s aft] ! date ( !     
enactm5t ( ?is ,act4  #h4 ,gov]nm5t     
acc\ntability (fice report on           

cyb]security consid]ations /emm+ f !    
conv]g5ce ( in=mation te*nology1        
,int]net ( ,?+s1 & op]ational te*nology 
devices1 networks1 & sy/ems  7a7 ,brief+
 ,n lat] ?an #a ye> aft] ! date ( !     
enactm5t ( ?is ,act1 ! ,comptroll]      
,g5]al ( ! ,unit$ ,/ates %all provide a 
brief+ to ! ,committee on ,ov]sight &   
,re=m ( ! ,h\se ( ,repres5tatives1 !    
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives1 & ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate on broad] ,int]net (
 ,?+s ef=ts1 includ+ projects design$ to
 assi/ 9 manag+ pot5tial security       
vuln]abilities associat$ ) ! use (      
traditional in=mation te*nology devices1
 networks1 & sy/ems )-- 7#a7 ,int]net ( 
,?+s devices1 networks1 & sy/ems2 &     
7#b7 op]ational te*nology devices1      
networks1 & sy/ems4  7b7 ,report ,n lat]
 ?an #b ye>s aft] ! date ( enactm5t (   
?is ,act1 ! ,comptroll] ,g5]al %all     
submit a report to ! ,committee on      
,ov]sight & ,re=m ( ! ,h\se (           

,repres5tatives1 ! ,committee on ,homel&
 ,security ( ! ,h\se ( ,repres5tatives1 
& ! ,committee on ,homel& ,security &   
,gov]nm5tal ,affairs ( ! ,s5ate on      
broad] ,int]net ( ,?+s ef=ts address$ 9 
subsection 7a74  ,pass$ ! ,h\se (       
,repres5tatives ,septemb] #ad1          
#bjbj4;,*]yl ,l4 ,johnson1,cl]k