,,ii #aaf? ,,congress #b;d ,session ,s4 #dghe ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,octob] #a1 #bjbj,mr4 ,portman 7= himself & ,mr4 ,pet]s7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,a ,,bill ,to require ! ,director ( ! ,(fice ( ,managem5t & ,budget to develop a model = risk-bas$ budget+1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,risk-,in=m$ ,sp5d+ = ,cyb]security ,act4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate2 & 7,b7 ! ,committee on ,homel& ,security & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives4 7#b7 ,cov]$ ag5cy ,! t]m cov]$ ag5cy has ! mean+ giv5 ! t]m executive ag5cy 9 section #acc ( title #da1 ,unit$ ,/ates ,code4 7#c7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#d7 ,in=mation te*nology ,! t]m in=mation te*nology-- 7,a7 has ! mean+ giv5 ! t]m 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code2 & 7,b7 includes ! h>dw>e & s(tw>e sy/ems ( a ,f$]al ag5cy t monitor & control physical equipm5t & processes ( ! ,f$]al ag5cy4 7#e7 ,risk-bas$ budget ,! t]m risk-bas$ budget means a budget-- 7,a7 develop$ by id5tify+ & prioritiz+ cyb]security risks & vuln]abilities1 includ+ impact on ag5cy op]ations 9 ! case ( a cyb] attack1 ?r\gh analysis ( ?reat intellig5ce1 incid5t data1 & tactics1 te*niques1 proc$ures1 & capabilities ( cyb] ?reats2 & 7,b7 t allocates res\rces bas$ on ! risks id5tifi$ & prioritiz$ "u subp>agraph 7,a74 #c4 ,e/abli%m5t ( risk-bas$ budget model 7a7 ,9 g5]al 7#a7 ,model ,n lat] ?an #a ye> aft] ! fir/ publication ( ! budget submitt$ by ! ,presid5t "u section #aaje ( title #ca1 ,unit$ ,/ates ,code1 foll[+ ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all develop a /&>d model = creat+ a risk-bas$ budget = cyb]security sp5d+4 7#b7 ,responsibility ( ,director ,section #ceec7;a7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 p>agraph 7#e71 by /rik+ & at ! end2 7,b7 9 p>agraph 7#f71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7,c7 by add+ at ! end ! foll[+3 7#g7 develop+ a /&>d risk-bas$ budget model to in=m ,f$]al ag5cy cyb]security budget developm5t4 4 7#c7 ,cont5ts ( model ,! model requir$ to be develop$ "u p>agraph 7#a7 %all-- 7,a7 consid] ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available1 to id5tify ?reats1 vuln]abilities1 & risks2 7,b7 consid] ! impact ( ag5cy op]ations ( compromise ( sy/ems1 includ+ ! int]connectivity to o!r ag5cy sy/ems & ! op]ations ( o!r ag5cies2 7,c7 indicate :]e res\rces %\ld be allocat$ to h ! greate/ impact on mitigat+ curr5t & future ?reats & curr5t & future cyb]security capabilities2 7,d7 be us$ to in=m acquisition & su/a9m5t (-- 7i7 in=mation te*nology & cyb]security tools2 7ii7 in=mation te*nology & cyb]security ar*itectures2 7iii7 in=mation te*nology & cyb]security p]sonnel2 & 7iv7 cyb]security & in=mation te*nology concepts ( op]ations2 & 7,e7 be us$ to evaluate & in=m gov]nm5t-wide cyb]security programs ( ! ,dep>tm5t ( ,homel& ,security4 7#d7 ,requir$ updates ,n less frequ5tly ?an once e #c ye>s1 ! ,director %all review1 & update z necess>y1 ! model requir$ to be develop$ "u ?is subsection4 7#e7 ,publication ,! ,director %all publi% ! model requir$ to be develop$ "u ?is subsection1 & any updates necess>y "u p>agraph 7#d71 on ! public website ( ! ,(fice ( ,managem5t & ,budget4 7#f7 ,reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] = ea* ( ! #b foll[+ fiscal ye>s or until ! date on :i* ! model requir$ to be develop$ "u ?is subsection is complet$1 :i*ev] is soon]1 ! ,director %all submit a report to ,congress on ! developm5t ( ! model4 7b7 ,requir$ use ( risk-,bas$ budget model 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date on :i* ! model develop$ "u subsection 7a7 is publi%$1 ! head ( ea* cov]$ ag5cy %all use ! model to develop ! annual cyb]security & in=mation te*nology budget reque/s ( ! ag5cy4 7#b7 ,ag5cy p]=mance plans ,section #ceed7;d77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ & ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 aft] p>agraph 7#a74 7c7 ,v]ification 7#a7 ,9 g5]al ,section #aaje7;a77#ce77;,a77i7 ( title #ca1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 ! matt] prec$+ subclause 7,i71 by /rik+ by ag5cy1 & by initiative area 7z det]m9$ by ! adm9i/ration7 & ins]t+ & by ag5cy2 7,b7 9 subclause 7,,iii71 by /rik+ & at ! end2 7,c7 9 subclause 7,,iv71 by add+ & at ! end2 & 7,d7 by add+ at ! end ! foll[+3 7,v7 a validation t ! budgets submitt$ 7 develop$ us+ a risk-bas$ me?odology2 4 7#b7 ,effective date ,! am5dm5ts made by p>agraph 7#a7 %all take effect on ! date t is #b ye>s aft] ! date on :i* ! model develop$ "u subsection 7a7 is publi%$4 7d7 ,annual reports 7#a7 ,annual indep5d5t evaluation ,section #ceee7;a77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 subp>agraph 7,b71 by /rik+ & at ! end2 7,b7 9 subp>agraph 7,c71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7,c7 by add+ at ! end ! foll[+3 7,d7 an assessm5t ( h[ ! ag5cy implem5t$ ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 & an evaluation ( :e!r ! model mitigates ag5cy cyb] vuln]abilities4 4 7#b7 ,assessm5t ,section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 p>agraph 7#d71 by /rik+ & at ! end2 7,b7 9 p>agraph 7#e71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7,c7 by add+ at ! end ! foll[+3 7#f7 an assessm5t (-- 7,a7 ,f$]al ag5cy implem5tation ( ! model requir$ "u subsection 7a77#g72 7,b7 h[ cyb] vuln]abilities ( ,f$]al ag5cies *ang$ f ! previ\s ye>2 & 7,c7 :e!r ! model mitigates ! cyb] vuln]abilities ( ! ,f$]al ,gov]nm5t4 4 7e7 ,,gao ,report ,n lat] ?an #c ye>s aft] ! date on :i* ! fir/ budget ( ! ,presid5t is submitt$ to ,congress conta9+ ! validation requir$ "u section #aaje7;a77#ce77;,a77i77,v7 ( title #ca1 ,unit$ ,/ates ,code1 z am5d$ by subsection 7c71 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! appropriate congressional committees a report t includes-- 7#a7 an evaluation ( ! success ( cov]$ ag5cies 9 develop+ risk-bas$ budgets2 7#b7 an evaluation ( ! success ( cov]$ ag5cies 9 implem5t+ risk-bas$ budgets2 7#c7 an evaluation ( :e!r ! risk-bas$ budgets develop$ by cov]$ ag5cies mitigate cyb] vuln]ability1 includ+ ! ext5t to :i* ! risk-bas$ budgets in=m ,f$]al ,gov]nm5t-wide cyb]security programs2 & 7#d7 any o!r in=mation relat+ to risk-bas$ budgets ! ,comptroll] ,g5]al det]m9es appropriate4