,,ib ,union ,calendar ,no4 #djb #aafth  
,,congress  #b;d ,session  ,h4 ,r4 #affh
 ,report ,no4 #aaf-eja1 ,part ,i ,,in   
,,the ,,house ,,of ,,representatives    
,march #aa1 #bjai,ms4 ,kelly of         
,illinois 7for herself1 ,mr4 ,hurd of   
,texas1 ,mr4 ,khanna1 ,mr4 ,budd1 ,mr4  
,ruppersberger1 ,mr4 ,marshall1 ,mr4    
,ted ,lieu of ,california1 ,mr4         
,ratcliffe1 ,mr4 ,meadows1 ,mr4 ,soto1  
,mr4 ,walker1 ,mr4 ,connolly1 ,mr4      
,foster1 and ,mr4 ,baird7 introduced the
 following bill2 which was referred to  
the ,committee on ,oversight and        
,reform1 and in addition to the         
,committee on ,science1 ,space1 and     
,technology1 for a period to be         
subsequently determined by the ,speaker1
 in each case for consideration of such 
provisions as fall within the           
jurisdiction of the committee concerned 
,september #ad1 #bjbj;,additional       
sponsors3 ,mr4 ,olson1 ,ms4 ,hill of    
,california1 ,mr4 ,fitzpatrick1 ,mr4    
,o',halleran1 ,mrs4 ,brooks of ,indiana1

 ,ms4 ,clarke of ,new ,york1 ,ms4       
,stevens1 ,mr4 ,harder of ,california1  
,mr4 ,norman1 ,mr4 ,rouda1 ,mr4 ,graves 
of ,georgia1 ,ms4 ,wasserman ,schultz1  
and ,ms4 ,del,bene  ,september #ad1     
#bjbj,reported from the ,committee on   
,oversight and ,reform with an          
amendment,strike out all after the      
enacting clause and insert the part     
printed in italic  ,september #ad1      
#bjbj;,committee on ,science1 ,space1   
and ,technology discharged2 committed to
 the ,committee of the ,whole ,house on 
the ,state of the ,union and ordered to 
be printed,for text of introduced bill1 
see copy of bill as introduced on ,march
 #aa1 #bjai  ,a ,,bill  ,to leverage    
,federal ,government procurement power  
to encourage increased cybersecurity for
 ,internet of ,things devices1 and for  
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,internet of   
,things ,cybersecurity ,improvement ,act
 of #bjai or the ,io,t ,cybersecurity   
,improvement ,act of #bjai4  #b4        

,definitions ,in this ,act3 7#a7 ,agency
 ,the term agency has the meaning given 
such term in section #cejb of title #dd1
 ,united ,states ,code4  7#b7 ,covered  
device ,the term covered device means a 
physical object that-- 7,a7 is capable  
of being in regular connection with--   
7i7 the ,internet2 or  7ii7 a network   
that is connected to the ,internet on a 
recurring basis2  7,b7 has computer     
processing capabilities of collecting1  
sending1 or receiving data2 and  7,c7 is
 not a-- 7i7 general-purpose computing  
device2  7ii7 personal computing system2
  7iii7 smart mobile communications     
device2  7iv7 programmable logic        
controller with an industrial control   
system specifically not designed for    
connection to the internet2  7v7        
mainframe computing system2 or  7vi7    
subcomponent of a device4  7#c7         
,director of ,,omb ,the term ,director  
of ,,omb means the ,director of the     
,office of ,management and ,budget4     
7#d7 ,director of the ,institute ,the   

term ,director of the ,institute means  
the ,director of the ,national          
,institute of ,standards and            
,technology4  7#e7 ,security            
vulnerability ,the term security        
vulnerability has the meaning given that
 term under section #ajb7ag7 of the     
,cybersecurity ,information ,sharing    
,act of #bjae 7#f ,u4,s4,c4 #aeja7ag774 
#c4 ,completion of ongoing efforts      
relating to considerations for managing 
,internet of things cybersecurity risks 
,not later than ,december #ca1 #bjai1   
the ,director of the ,national          
,institute of ,standards and ,technology
 shall complete the efforts of the      
,institute in effect on the date of the 
enactment of this ,act regarding        
considerations for managing the security
 vulnerabilities of ,internet of ,things
 devices and examples of possible       
cybersecurity capabilities of such      
devices by publishing a report that     
includes1 at a minimum1 the following   
considerations for covered devices3 7#a7

 ,secure development4  7#b7 ,identity   
management4  7#c7 ,patching4  7#d7      
,configuration management4  #d4         
,security standards for use of covered  
devices by the ,federal ,government  7a7
 ,guidelines required  7#a7 ,guidelines 
,not later than #f months after the date
 on which the report under section #c is
 completed1 the ,director of the        
,institute shall develop under section  
#bj of the ,national ,institute of      
,standards and ,technology ,act 7#ae    
,u4,s4,c4 #bgh;g-#c71 and submit to the 
,director of ,,omb1 guidelines on-- 7,a7
 the appropriate use and management by  
the agencies of covered devices owned or
 controlled by the agencies2 and  7,b7  
minimum information security            
requirements for managing security      
vulnerabilities associated with such    
devices4  7#b7 ,development of          
guidelines ,in developing the guidelines
 submitted under paragraph 7#a71 the    
,director of the ,institute shall-- 7,a7
 consider relevant standards and best   

practices developed by the private      
sector1 agencies1 and public-private    
partnerships2 and  7,b7 ensure that such
 guidelines are consistent with the     
considerations published in the report  
described under section #c4  7b7        
,promulgation of standards  7#a7        
,standards ,not later than #ahj days    
after the date on which the ,director of
 the ,institute completes the           
development of the guidelines required  
under subsection 7a71 the ,director of  
,,omb1 in consultation with the         
,director of the ,cybersecurity and     
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security1    
shall-- 7,a7 promulgate standards on the
 basis of the guidelines submitted under
 subsection 7a7 pertaining to covered   
devices owned or controlled by agencies1
 except those considered national       
security systems as defined by section  
#ceeb7;b77#f7 of title #dd1 ,united     
,states ,code2 and  7,b7 ensure such    
standards are consistent with the       

information security requirements under 
subchapter ,,ii of chapter #ce of title 
#dd1 ,united ,states ,code4  7#b7       
,quinquennial review and revision ,not  
later than #e years after the date on   
which the ,director of ,,omb promulgates
 the standards under paragraph 7#a71 and
 not less frequently than once every #e 
years thereafter1 the ,director of      
,,omb1 in consultation with and the     
,director of the ,institute and the     
,director of the ,cybersecurity and     
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security1    
shall-- 7,a7 review such standards2 and 
7,b7 revise such standards as           
appropriate4  7c7 ,revision of ,federal 
,acquisition ,regulation ,the ,federal  
,acquisition ,regulation shall be       
revised to implement any standard       
promulgated under subsection 7b74  #e4  
,petition to exclude certain devices    
7a7 ,petition ,the ,director of ,,omb   
shall establish a process by which an   
interested party may petition the       

,director of ,,omb for a device         
described in section #b7b7 to not be    
considered a covered device for the     
purpose of standards promulgated under  
section #d7;b74  7b7 ,grants of petition
 ,the ,director of ,,omb shall grant a  
petition under subsection 7a7-- 7#a7 on 
a limited basis2  7#b7 in a timely      
manner2 and  7#c7 only if the interested
 party demonstrates that-- 7,a7 the     
procurement of such a covered device    
with limited data processing and        
software functionality would be         
unfeasible2 or  7,b7 the procurement of 
a covered device that does not meet the 
standards promulgated by the ,director  
of ,,omb under this ,act is necessary   
for national security or for research   
purposes4  7c7 ,report  7#a7 ,in general
 ,not later than one year after the date
 of the enactment of this ,act1 and     
annually thereafter for each of the     
following four years1 the ,director of  
,,omb shall submit to the appropriate   
congressional committees a report on the

 process established by the ,director of
 ,,omb for granting or denying waivers  
under this section4  7#b7 ,assessment of
 implementation ,the reports required   
under paragraph 7#a7 shall include1 at a
 minimum1 the following3 7,a7 ,an       
assessment of the waiver evaluation     
process4  7,b7 ,a description of the    
methods established to carry out such   
assessment4  7,c7 ,a classified appendix
 listing the types and number of devices
 for each agency granted a waiver and   
the reasons for such waiver4  7#c7      
,appropriate congressional committees   
defined ,in this subsection1 the term   
appropriate congressional committees    
means the ,committees on ,oversight and 
,reform and ,homeland ,security of the  
,house of ,representatives and the      
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate4  
#f4 ,coordinated disclosure of security 
vulnerabilities relating to covered     
devices  7a7 ,in general ,not later than
 #ahj days after the date of the        

enactment of this ,act1 the ,director of
 the ,institute1 in consultation with   
the ,director of ,cybersecurity and     
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security1    
shall develop under section #bj of the  
,national ,institute of ,standards and  
,technology ,act 7#ae ,u4,s4,c4         
#bgh;g-#c7 and submit to the ,director  
of ,,omb1 guidelines-- 7#a7 for the     
reporting1 coordinating1 publishing1 and
 receiving of information about-- 7,a7 a
 security vulnerability relating to a   
covered device owned or controlled by an
 agency2 and  7,b7 the resolution of    
such security vulnerability2  7#b7 for  
contractors providing a covered device  
to the ,federal ,government1 and any    
subcontractor thereof at any tier       
providing such device to such           
contractors on-- 7,a7 receiving         
information about a potential security  
vulnerability relating to the covered   
device2 and  7,b7 disseminating         
information about the resolution of a   

security vulnerability relating to the  
covered device2 and  7#c7 on the type of
 information about security             
vulnerabilities that should be reported 
to the ,federal ,government1 including  
examples thereof4  7b7 ,development of  
guidelines ,in developing the guidelines
 under subsection 7a71 the ,director of 
the ,institute shall-- 7#a7 consult with
 such cybersecurity researchers and     
private sector industry experts as the  
,director considers appropriate2  7#b7  
to the maximum extent practicable1 align
 such guidelines with ,standards #biadg 
and #cjaaa of the ,international        
,standards ,organization1 or any        
successor standards thereof2 and  7#c7  
ensure such guidelines are consistent   
with the policies and procedures        
developed under section #bbji7m7 of the 
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #fei7m774  7c7 ,promulgation  
of standards  7#a7 ,in general ,not     
later than #ahj days after the date on  
which the guidelines under subsection   

7a7 are submitted1 the ,director of     
,,omb1 in consultation with the         
,administrator of ,general ,services and
 the ,secretary of ,homeland ,security1 
shall promulgate standards on the basis 
of such guidelines4  7#b7 ,contract     
requirement for subcontracts ,the       
standards promulgated under paragraph   
7#a7 shall include a requirement for any
 contract related to a covered device to
 include a clause that requires each    
contractor that provides a covered      
device under the contract to an agency  
to ensure that any covered device       
obtained through a subcontract1 at any  
tier1 complies with the standards and   
regulations promulgated under this      
section with respect to such covered    
device4  7#c7 ,consistency with the     
,strengthening and ,enhancing           
,cyber-capabilities by ,utilizing ,risk 
,exposure ,technology ,act ,the         
,director of ,,omb shall ensure that the
 standards promulgated under paragraph  
7#a7 are consistent with section #aja of

 the ,strengthening and ,enhancing      
,cyber-capabilities by ,utilizing ,risk 
,exposure ,technology ,act 7#f ,u4,s4,c4
 #ffc note2 ,public ,law #aae-cij74  7d7
 ,revision of ,federal ,acquisition     
,regulation ,the ,federal ,acquisition  
,regulation shall be revised to         
implement the standards promulgated     
under subsection 7c74  #g4 ,contractor  
compliance with standards and           
regulations  7a7 ,in general  7#a7      
,determination  7,a7 ,compliance        
required ,before awarding a contract to 
an offeror for the procurement of a     
covered device1 or renewing a contract  
to procure or obtain a covered device   
from a contractor1 the agency ,chief    
,information ,officer shall determine if
 such offeror or contractor has complied
 with each standard promulgated under   
section #f7;c7 with respect to such     
covered device4  7,b7 ,simplified       
acquisition threshold ,notwithstanding  
section #aije of title #da1 ,united     
,states ,code1 the requirements under   

subparagraph 7,a7 shall apply to a      
contract or subcontract in amounts not  
greater than the simplified acquisition 
threshold4  7#b7 ,prohibition on use or 
procurement ,the head of an agency may  
not procure or obtain1 or renew a       
contract to procure or obtain1 a covered
 device if the agency ,chief            
,information ,officer determines under  
paragraph 7#a77;,a7 that such offeror or
 contractor has not complied with a     
standard promulgated under section      
#f7;c7 with respect to such covered     
device4  7b7 ,waiver ,the head of an    
agency may waive the prohibition under  
subsection 7a77#b7 if the procurement of
 such covered device is necessary for   
national security or for research       
purposes4  7c7 ,effective date ,the     
prohibition under subsection 7a7 shall  
take effect one year after the date of  
the enactment of this ,act4  #h4        
,institute report on cybersecurity      
considerations stemming from the        
convergence of information technology1  

internet of things1 and operational     
technology devices1 networks and systems
 ,not later than #a year after the date 
of the enactment of this ,act1 the      
,director of the ,institute shall       
publish a report on the increasing      
convergence1 including considerations   
for managing potential security         
vulnerabilities associated with such    
convergence1 of traditional information 
technology devices1 networks1 and       
systems with-- 7#a7 covered devices1    
networks and systems2 and  7#b7         
operational technology devices1 networks
 and systems4  ,september #ad1          
#bjbj,reported from the ,committee on   
,oversight and ,reform with an          
amendment,september #ad1                
#bjbj;,committee on ,science1 ,space1   
and ,technology discharged2 committed to
 the ,committee of the ,whole ,house on 
the ,state of the ,union and ordered to 
be printed