,,ib ,union ,cal5d> ,no4 #djb #aaf? ,,congress #b;d ,session ,h4 ,r4 #affh ,report ,no4 #aaf-eja1 ,"p ,i ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,m>* #aa1 #bjai,ms4 ,kelly ( ,ill9ois 7= h]self1 ,mr4 ,hurd ( ,texas1 ,mr4 ,khanna1 ,mr4 ,budd1 ,mr4 ,rupp]sb]g]1 ,mr4 ,m>%all1 ,mr4 ,t$ ,lieu ( ,cali=nia1 ,mr4 ,ratcliffe1 ,mr4 ,mead[s1 ,mr4 ,soto1 ,mr4 ,walk]1 ,mr4 ,connolly1 ,mr4 ,fo/]1 & ,mr4 ,baird7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,ov]sight & ,re=m1 & 9 addition to ! ,committee on ,sci5ce1 ,space1 & ,te*nology1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,septemb] #ad1 #bjbj;,additional sponsors3 ,mr4 ,olson1 ,ms4 ,hill ( ,cali=nia1 ,mr4 ,fitzpatrick1 ,mr4 ,o',hall]an1 ,mrs4 ,brooks ( ,indiana1 ,ms4 ,cl>ke ( ,new ,york1 ,ms4 ,/ev5s1 ,mr4 ,h>d] ( ,cali=nia1 ,mr4 ,norman1 ,mr4 ,r\da1 ,mr4 ,graves ( ,georgia1 ,ms4 ,wass]man ,s*ultz1 & ,ms4 ,del,bene ,septemb] #ad1 #bjbj,report$ f ! ,committee on ,ov]sight & ,re=m ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,septemb] #ad1 #bjbj;,committee on ,sci5ce1 ,space1 & ,te*nology dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be printed,for text ( introduc$ bill1 see copy ( bill z introduc$ on ,m>* #aa1 #bjai ,a ,,bill ,to lev]age ,f$]al ,gov]nm5t procurem5t p[] to enc\rage increas$ cyb]security = ,int]net ( ,?+s devices1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjai or ! ,io,t ,cyb]security ,improvem5t ,act ( #bjai4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 su* t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,cov]$ device ,! t]m cov]$ device means a physical object t-- 7,a7 is capable ( be+ 9 regul> connection )-- 7i7 ! ,int]net2 or 7ii7 a network t is connect$ to ! ,int]net on a recurr+ basis2 7,b7 has comput] process+ capabilities ( collect+1 s5d+1 or receiv+ data2 & 7,c7 is n a-- 7i7 g5]al-purpose comput+ device2 7ii7 p]sonal comput+ sy/em2 7iii7 sm>t mobile communications device2 7iv7 programmable logic controll] ) an indu/rial control sy/em specifically n design$ = connection to ! int]net2 7v7 ma9frame comput+ sy/em2 or 7vi7 subcompon5t ( a device4 7#c7 ,director ( ,,omb ,! t]m ,director ( ,,omb means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#d7 ,director ( ! ,in/itute ,! t]m ,director ( ! ,in/itute means ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7#e7 ,security vuln]ability ,! t]m security vuln]ability has ! mean+ giv5 t t]m "u section #ajb7ag7 ( ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja7ag774 #c4 ,completion ( ongo+ ef=ts relat+ to consid]ations = manag+ ,int]net ( ?+s cyb]security risks ,n lat] ?an ,decemb] #ca1 #bjai1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all complete ! ef=ts ( ! ,in/itute 9 effect on ! date ( ! enactm5t ( ?is ,act reg>d+ consid]ations = manag+ ! security vuln]abilities ( ,int]net ( ,?+s devices & examples ( possible cyb]security capabilities ( su* devices by publi%+ a report t includes1 at a m9imum1 ! foll[+ consid]ations = cov]$ devices3 7#a7 ,secure developm5t4 7#b7 ,id5tity managem5t4 7#c7 ,pat*+4 7#d7 ,configuration managem5t4 #d4 ,security /&>ds = use ( cov]$ devices by ! ,f$]al ,gov]nm5t 7a7 ,guidel9es requir$ 7#a7 ,guidel9es ,n lat] ?an #f mon?s aft] ! date on :i* ! report "u section #c is complet$1 ! ,director ( ! ,in/itute %all develop "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c71 & submit to ! ,director ( ,,omb1 guidel9es on-- 7,a7 ! appropriate use & managem5t by ! ag5cies ( cov]$ devices own$ or controll$ by ! ag5cies2 & 7,b7 m9imum in=mation security requirem5ts = manag+ security vuln]abilities associat$ ) su* devices4 7#b7 ,developm5t ( guidel9es ,9 develop+ ! guidel9es submitt$ "u p>agraph 7#a71 ! ,director ( ! ,in/itute %all-- 7,a7 consid] relevant /&>ds & be/ practices develop$ by ! private sector1 ag5cies1 & public-private p>tn]%ips2 & 7,b7 ensure t su* guidel9es are consi/5t ) ! consid]ations publi%$ 9 ! report describ$ "u section #c4 7b7 ,promulgation ( /&>ds 7#a7 ,/&>ds ,n lat] ?an #ahj days aft] ! date on :i* ! ,director ( ! ,in/itute completes ! developm5t ( ! guidel9es requir$ "u subsection 7a71 ! ,director ( ,,omb1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 %all-- 7,a7 promulgate /&>ds on ! basis ( ! guidel9es submitt$ "u subsection 7a7 p]ta9+ to cov]$ devices own$ or controll$ by ag5cies1 except ^? consid]$ national security sy/ems z def9$ by section #ceeb7;b77#f7 ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 ensure su* /&>ds are consi/5t ) ! in=mation security requirem5ts "u sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,qu9qu5nial review & revision ,n lat] ?an #e ye>s aft] ! date on :i* ! ,director ( ,,omb promulgates ! /&>ds "u p>agraph 7#a71 & n less frequ5tly ?an once e #e ye>s !reaft]1 ! ,director ( ,,omb1 9 consultation ) & ! ,director ( ! ,in/itute & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 %all-- 7,a7 review su* /&>ds2 & 7,b7 revise su* /&>ds z appropriate4 7c7 ,revision ( ,f$]al ,acquisition ,regulation ,! ,f$]al ,acquisition ,regulation %all be revis$ to implem5t any /&>d promulgat$ "u subsection 7b74 #e4 ,petition to exclude c]ta9 devices 7a7 ,petition ,! ,director ( ,,omb %all e/abli% a process by :i* an int]e/$ p>ty may petition ! ,director ( ,,omb = a device describ$ 9 section #b7b7 to n be consid]$ a cov]$ device = ! purpose ( /&>ds promulgat$ "u section #d7;b74 7b7 ,grants ( petition ,! ,director ( ,,omb %all grant a petition "u subsection 7a7-- 7#a7 on a limit$ basis2 7#b7 9 a timely mann]2 & 7#c7 only if ! int]e/$ p>ty demon/rates t-- 7,a7 ! procurem5t ( su* a cov]$ device ) limit$ data process+ & s(tw>e functionality w\ld be unfeasible2 or 7,b7 ! procurem5t ( a cov]$ device t does n meet ! /&>ds promulgat$ by ! ,director ( ,,omb "u ?is ,act is necess>y = national security or = rese>* purposes4 7c7 ,report 7#a7 ,9 g5]al ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is ,act1 & annually !reaft] = ea* ( ! foll[+ f\r ye>s1 ! ,director ( ,,omb %all submit to ! appropriate congressional committees a report on ! process e/abli%$ by ! ,director ( ,,omb = grant+ or d5y+ waiv]s "u ?is section4 7#b7 ,assessm5t ( implem5tation ,! reports requir$ "u p>agraph 7#a7 %all include1 at a m9imum1 ! foll[+3 7,a7 ,an assessm5t ( ! waiv] evaluation process4 7,b7 ,a description ( ! me?ods e/abli%$ to c>ry out su* assessm5t4 7,c7 ,a classifi$ app5dix li/+ ! types & numb] ( devices = ea* ag5cy grant$ a waiv] & ! reasons = su* waiv]4 7#c7 ,appropriate congressional committees def9$ ,9 ?is subsection1 ! t]m appropriate congressional committees means ! ,committees on ,ov]sight & ,re=m & ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate4 #f4 ,coord9at$ disclosure ( security vuln]abilities relat+ to cov]$ devices 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director ( ! ,in/itute1 9 consultation ) ! ,director ( ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 %all develop "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 & submit to ! ,director ( ,,omb1 guidel9es-- 7#a7 = ! report+1 coord9at+1 publi%+1 & receiv+ ( in=mation ab\t-- 7,a7 a security vuln]ability relat+ to a cov]$ device own$ or controll$ by an ag5cy2 & 7,b7 ! resolution ( su* security vuln]ability2 7#b7 = contractors provid+ a cov]$ device to ! ,f$]al ,gov]nm5t1 & any subcontractor !re( at any ti] provid+ su* device to su* contractors on-- 7,a7 receiv+ in=mation ab\t a pot5tial security vuln]ability relat+ to ! cov]$ device2 & 7,b7 dissem9at+ in=mation ab\t ! resolution ( a security vuln]ability relat+ to ! cov]$ device2 & 7#c7 on ! type ( in=mation ab\t security vuln]abilities t %\ld be report$ to ! ,f$]al ,gov]nm5t1 includ+ examples !re(4 7b7 ,developm5t ( guidel9es ,9 develop+ ! guidel9es "u subsection 7a71 ! ,director ( ! ,in/itute %all-- 7#a7 consult ) su* cyb]security rese>*]s & private sector indu/ry exp]ts z ! ,director consid]s appropriate2 7#b7 to ! maximum ext5t practicable1 align su* guidel9es ) ,/&>ds #biadg & #cjaaa ( ! ,int]national ,/&>ds ,organization1 or any successor /&>ds !re(2 & 7#c7 ensure su* guidel9es are consi/5t ) ! policies & proc$ures develop$ "u section #bbji7m7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fei7m774 7c7 ,promulgation ( /&>ds 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* ! guidel9es "u subsection 7a7 are submitt$1 ! ,director ( ,,omb1 9 consultation ) ! ,adm9i/rator ( ,g5]al ,s]vices & ! ,secret>y ( ,homel& ,security1 %all promulgate /&>ds on ! basis ( su* guidel9es4 7#b7 ,contract requirem5t = subcontracts ,! /&>ds promulgat$ "u p>agraph 7#a7 %all include a requirem5t = any contract relat$ to a cov]$ device to include a clause t requires ea* contractor t provides a cov]$ device "u ! contract to an ag5cy to ensure t any cov]$ device obta9$ ?r\gh a subcontract1 at any ti]1 complies ) ! /&>ds & regulations promulgat$ "u ?is section ) respect to su* cov]$ device4 7#c7 ,consi/5cy ) ! ,/r5g!n+ & ,enhanc+ ,cyb]-capabilities by ,utiliz+ ,risk ,exposure ,te*nology ,act ,! ,director ( ,,omb %all ensure t ! /&>ds promulgat$ "u p>agraph 7#a7 are consi/5t ) section #aja ( ! ,/r5g!n+ & ,enhanc+ ,cyb]-capabilities by ,utiliz+ ,risk ,exposure ,te*nology ,act 7#f ,u4,s4,c4 #ffc note2 ,public ,law #aae-cij74 7d7 ,revision ( ,f$]al ,acquisition ,regulation ,! ,f$]al ,acquisition ,regulation %all be revis$ to implem5t ! /&>ds promulgat$ "u subsection 7c74 #g4 ,contractor compliance ) /&>ds & regulations 7a7 ,9 g5]al 7#a7 ,det]m9ation 7,a7 ,compliance requir$ ,be=e aw>d+ a contract to an (f]or = ! procurem5t ( a cov]$ device1 or r5ew+ a contract to procure or obta9 a cov]$ device f a contractor1 ! ag5cy ,*ief ,in=mation ,(fic] %all det]m9e if su* (f]or or contractor has compli$ ) ea* /&>d promulgat$ "u section #f7;c7 ) respect to su* cov]$ device4 7,b7 ,simplifi$ acquisition ?re%old ,not)/&+ section #aije ( title #da1 ,unit$ ,/ates ,code1 ! requirem5ts "u subp>agraph 7,a7 %all apply to a contract or subcontract 9 am\nts n great] ?an ! simplifi$ acquisition ?re%old4 7#b7 ,prohibition on use or procurem5t ,! head ( an ag5cy may n procure or obta91 or r5ew a contract to procure or obta91 a cov]$ device if ! ag5cy ,*ief ,in=mation ,(fic] det]m9es "u p>agraph 7#a77;,a7 t su* (f]or or contractor has n compli$ ) a /&>d promulgat$ "u section #f7;c7 ) respect to su* cov]$ device4 7b7 ,waiv] ,! head ( an ag5cy may waive ! prohibition "u subsection 7a77#b7 if ! procurem5t ( su* cov]$ device is necess>y = national security or = rese>* purposes4 7c7 ,effective date ,! prohibition "u subsection 7a7 %all take effect "o ye> aft] ! date ( ! enactm5t ( ?is ,act4 #h4 ,in/itute report on cyb]security consid]ations /emm+ f ! conv]g5ce ( in=mation te*nology1 int]net ( ?+s1 & op]ational te*nology devices1 networks & sy/ems ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director ( ! ,in/itute %all publi% a report on ! increas+ conv]g5ce1 includ+ consid]ations = manag+ pot5tial security vuln]abilities associat$ ) su* conv]g5ce1 ( traditional in=mation te*nology devices1 networks1 & sy/ems )-- 7#a7 cov]$ devices1 networks & sy/ems2 & 7#b7 op]ational te*nology devices1 networks & sy/ems4 ,septemb] #ad1 #bjbj,report$ f ! ,committee on ,ov]sight & ,re=m ) an amendment,september #ad1 #bjbj;,committee on ,sci5ce1 ,space1 & ,te*nology dis*>g$2 committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be pr9t$