,,ii #aafth ,,congress #b;d ,session ,s4 #dghe ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #a1 #bjbj,mr4 ,portman 7for himself and ,mr4 ,peters7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to require the ,director of the ,office of ,management and ,budget to develop a model for risk-based budgeting1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,risk-,informed ,spending for ,cybersecurity ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate2 and 7,b7 the ,committee on ,homeland ,security and the ,committee on ,appropriations of the ,house of ,representatives4 7#b7 ,covered agency ,the term covered agency has the meaning given the term executive agency in section #acc of title #da1 ,united ,states ,code4 7#c7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#d7 ,information technology ,the term information technology-- 7,a7 has the meaning given the term in section #aaaja of title #dj1 ,united ,states ,code2 and 7,b7 includes the hardware and software systems of a ,federal agency that monitor and control physical equipment and processes of the ,federal agency4 7#e7 ,risk-based budget ,the term risk-based budget means a budget-- 7,a7 developed by identifying and prioritizing cybersecurity risks and vulnerabilities1 including impact on agency operations in the case of a cyber attack1 through analysis of threat intelligence1 incident data1 and tactics1 techniques1 procedures1 and capabilities of cyber threats2 and 7,b7 that allocates resources based on the risks identified and prioritized under subparagraph 7,a74 #c4 ,establishment of risk-based budget model 7a7 ,in general 7#a7 ,model ,not later than #a year after the first publication of the budget submitted by the ,president under section #aaje of title #ca1 ,united ,states ,code1 following the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall develop a standard model for creating a risk-based budget for cybersecurity spending4 7#b7 ,responsibility of ,director ,section #ceec7;a7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 in paragraph 7#e71 by striking and at the end2 7,b7 in paragraph 7#f71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#g7 developing a standard risk-based budget model to inform ,federal agency cybersecurity budget development4 4 7#c7 ,contents of model ,the model required to be developed under paragraph 7#a7 shall-- 7,a7 consider ,federal and non-,federal cyber threat intelligence products1 where available1 to identify threats1 vulnerabilities1 and risks2 7,b7 consider the impact of agency operations of compromise of systems1 including the interconnectivity to other agency systems and the operations of other agencies2 7,c7 indicate where resources should be allocated to have the greatest impact on mitigating current and future threats and current and future cybersecurity capabilities2 7,d7 be used to inform acquisition and sustainment of-- 7i7 information technology and cybersecurity tools2 7ii7 information technology and cybersecurity architectures2 7iii7 information technology and cybersecurity personnel2 and 7iv7 cybersecurity and information technology concepts of operations2 and 7,e7 be used to evaluate and inform government-wide cybersecurity programs of the ,department of ,homeland ,security4 7#d7 ,required updates ,not less frequently than once every #c years1 the ,director shall review1 and update as necessary1 the model required to be developed under this subsection4 7#e7 ,publication ,the ,director shall publish the model required to be developed under this subsection1 and any updates necessary under paragraph 7#d71 on the public website of the ,office of ,management and ,budget4 7#f7 ,reports ,not later than #a year after the date of enactment of this ,act1 and annually thereafter for each of the #b following fiscal years or until the date on which the model required to be developed under this subsection is completed1 whichever is sooner1 the ,director shall submit a report to ,congress on the development of the model4 7b7 ,required use of risk-,based budget model 7#a7 ,in general ,not later than #b years after the date on which the model developed under subsection 7a7 is published1 the head of each covered agency shall use the model to develop the annual cybersecurity and information technology budget requests of the agency4 7#b7 ,agency performance plans ,section #ceed7;d77#b7 of title #dd1 ,united ,states ,code1 is amended by inserting and the risk-based budget model required under section #ceec7;a77#g7 after paragraph 7#a74 7c7 ,verification 7#a7 ,in general ,section #aaje7;a77#ce77;,a77i7 of title #ca1 ,united ,states ,code1 is amended-- 7,a7 in the matter preceding subclause 7,i71 by striking by agency1 and by initiative area 7as determined by the administration7 and inserting and by agency2 7,b7 in subclause 7,,iii71 by striking and at the end2 7,c7 in subclause 7,,iv71 by adding and at the end2 and 7,d7 by adding at the end the following3 7,v7 a validation that the budgets submitted were developed using a risk-based methodology2 4 7#b7 ,effective date ,the amendments made by paragraph 7#a7 shall take effect on the date that is #b years after the date on which the model developed under subsection 7a7 is published4 7d7 ,annual reports 7#a7 ,annual independent evaluation ,section #ceee7;a77#b7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 in subparagraph 7,b71 by striking and at the end2 7,b7 in subparagraph 7,c71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7,d7 an assessment of how the agency implemented the risk-based budget model required under section #ceec7;a77#g7 and an evaluation of whether the model mitigates agency cyber vulnerabilities4 4 7#b7 ,assessment ,section #ceec7;c7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 in paragraph 7#d71 by striking and at the end2 7,b7 in paragraph 7#e71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#f7 an assessment of-- 7,a7 ,federal agency implementation of the model required under subsection 7a77#g72 7,b7 how cyber vulnerabilities of ,federal agencies changed from the previous year2 and 7,c7 whether the model mitigates the cyber vulnerabilities of the ,federal ,government4 4 7e7 ,,gao ,report ,not later than #c years after the date on which the first budget of the ,president is submitted to ,congress containing the validation required under section #aaje7;a77#ce77;,a77i77,v7 of title #ca1 ,united ,states ,code1 as amended by subsection 7c71 the ,comptroller ,general of the ,united ,states shall submit to the appropriate congressional committees a report that includes-- 7#a7 an evaluation of the success of covered agencies in developing risk-based budgets2 7#b7 an evaluation of the success of covered agencies in implementing risk-based budgets2 7#c7 an evaluation of whether the risk-based budgets developed by covered agencies mitigate cyber vulnerability1 including the extent to which the risk-based budgets inform ,federal ,government-wide cybersecurity programs2 and 7#d7 any other information relating to risk-based budgets the ,comptroller ,general determines appropriate4