,i  #aafth ,,congress  #b;d ,session    
,h4 ,r4 #hggi  ,,in ,,the ,,house ,,of  
,,representatives  ,november #ah1 #bjbj 
,ms4 ,underwood introduced the following
 bill2 which was referred to the        
,committee on ,oversight and ,reform  ,a
 ,,bill  ,to amend the ,federal         
,cybersecurity ,enhancement ,act of     
#bjae to require ,federal agencies to   
obtain exemptions from certain          
cybersecurity requirements in order to  
avoid compliance with those             
requirements1 and for other purposes4   
#a4 ,short title ,this ,act may be cited
 as the ,federal ,cybersecurity         
,oversight ,act of #bjbj4  #b4 ,federal 
cybersecurity requirements  7a7         
,exemption from ,federal requirements   
,section #bbe7;b77#b7 of the ,federal   
,cybersecurity ,enhancement ,act of     
#bjae 7#f ,u4,s4,c4 #aebc7;b77#b77 is   
amended to read as follows3  7#b7       
,exception  7,a7 ,in general ,a         
particular requirement under paragraph  
7#a7 shall not apply to an agency       

information system of an agency if-- 7i7
 with respect to the agency information 
system1 the head of the agency submits  
to the ,director an application for an  
exemption from the particular           
requirement1 in which the head of the   
agency personally certifies to the      
,director with particularity that--     
7,i7 operational requirements           
articulated in the certification and    
related to the agency information system
 would make it excessively burdensome to
 implement the particular requirement2  
7,,ii7 the particular requirement is not
 necessary to secure the agency         
information system or agency information
 stored on or transiting the agency     
information system2 and  7,,iii7 the    
agency has taken all necessary steps to 
secure the agency information system and
 agency information stored on or        
transiting the agency information       
system2  7ii7 the head of the agency or 
the designee of the head of the agency  
has submitted the certification         

described in clause 7i7 to the          
appropriate congressional committees and
 any other congressional committee with 
jurisdiction over the agency2 and  7iii7
 the ,director grants the exemption from
 the particular requirement4  7,b7      
,duration of exemption  7i7 ,in general 
,an exemption granted under subparagraph
 7,a7 shall expire on the date that is  
#a year after the date on which the     
,director grants the exemption4  7ii7   
,renewal ,upon the expiration of an     
exemption granted to an agency under    
subparagraph 7,a71 the head of the      
agency may apply for an additional      
exemption4  4  7b7 ,report on exemptions
 ,section #ceed7;c77#a77;,a7 of title   
#dd1 ,united ,states ,code1 is amended--
  7#a7 in clause 7iii71 by striking and 
at the end2  7#b7 by redesignating      
clause 7iv7 as clause 7v72 and  7#c7 by 
inserting after clause 7iii7 the        
following3  7iv7 with respect to any    
exemptions the agency is granted by the 
,director of the ,office of ,management 

and ,budget under section #bbe7;b77#b7  
of the ,federal ,cybersecurity          
,enhancement ,act of #bjae 7#f ,u4,s4,c4
 #aebc7;b77#b77 that is effective on the
 date of submission of the report--     
7,i7 an identification of the particular
 requirements from which any agency     
information system 7as defined in       
section #bbaj of the ,homeland ,security
 ,act of #bjjb 7#f ,u4,s4,c4 #ffj77 is  
exempted2 and  7,,ii7 for each          
requirement identified under subclause  
7,i7--  7aa7 an identification of the   
agency information system described in  
subclause 7,i7 exempted from the        
requirement2 and  7bb7 an estimate of   
the date on which the agency will be    
able to comply with the requirement2 and
  4  7c7 ,effective date ,this ,act and 
the amendments made by this ,act shall  
take effect on the date that is #a year 
after the date of enactment of this     
,act4