,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #gcd  ,,9 ,,! ,,s5ate ,,( ,,!       
,,unit$ ,,/ates  ,m>* #aa1 #bjai,mr4    
,w>n] 7= himself1 ,mr4 ,g>dn]1 ,ms4     
,hassan1 & ,mr4 ,da9es7 introduc$ !     
foll[+ bill2 :i* 0 read twice & ref]r$  
to ! ,committee on ,homel& ,security &  
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
lev]age ,f$]al ,gov]nm5t procurem5t p[] 
to enc\rage increas$ cyb]security =     
,int]net ( ,?+s devices1 & = o!r        
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,int]net ( ,?+s            
,cyb]security ,improvem5t ,act ( #bjai  
or ! ,io,t ,cyb]security ,improvem5t    
,act ( #bjai4  #b4 ,def9itions ,9 ?is   
,act3  7#a7 ,ag5cy ,! t]m ag5cy has !   
mean+ giv5 su* t]m 9 section #cejb (    
title #dd1 ,unit$ ,/ates ,code4  7#b7   
,cov]$ device  7,a7 ,9 g5]al ,! t]m     
cov]$ device means a physical object t--
  7i7 is capable ( connect+ to & is 9   
regul> connection ) ! ,int]net2  7ii7   
has comput] process+ capabilities t c   
collect1 s5d1 or receive data2 &  7iii7 

is n a g5]al-purpose comput+ device1    
includ+ p]sonal comput+ sy/ems1 sm>t    
mobile communications devices1          
programmable logic controls1 & ma9frame 
comput+ sy/ems4  7,b7 ,modification (   
def9ition ,! ,director ( ! ,(fice (     
,managem5t & ,budget %all e/abli% a     
process by :i*-- 7i7 int]e/$ p>ties may 
petition = a device t is n describ$ 9   
subp>agraph 7,a7 to be consid]$ a device
 t is n a cov]$ device2 &  7ii7 !       
,director acts ^u any petition submitt$ 
"u clause 7i7 9 a timely mann]4  7#c7   
,security vuln]ability ,! t]m security  
vuln]ability means any attribute (      
h>dw>e1 firmw>e1 s(tw>e1 or comb9ation (
 #b or m ( ^! factors t c\ld enable !   
compromise ( ! confid5tiality1          
integrity1 or availability ( an         
in=mation sy/em or its in=mation or     
physical devices to :i* x is connect$4  
#c4 ,national ,in/itute ( ,/&>ds &      
,te*nology consid]ations &              
recomm5dations reg>d+ manag+ ,int]net ( 
,?+s cyb]security risks  7a7 ,completion

 ( ongo+ ef=ts relat+ to consid]ations =
 manag+ int]net ( ?+s cyb]security risks
  7#a7 ,9 g5]al ,! ,director ( !        
,national ,in/itute ( ,/&>ds &          
,te*nology %all ensure t ! ef=ts ( !    
,in/itute 9 effect on ! date ( !        
enactm5t ( ?is ,act reg>d+ consid]ations
 = manag+ ,int]net ( ,?+s cyb]security  
risks1 especially reg>d+ examples (     
possible cyb]security capabilities (    
,int]net ( ,?+s devices1 are complet$ no
 lat] ?an ,septemb] #cj1 #bjai4  7#b7   
,matt]s address$ ,9 ensur+ ef=ts are    
complet$ "u p>agraph 7#a71 ! ,director  
%all also ensure t su* ef=ts address1 at
 a m9imum1 ! foll[+ consid]ations =     
cov]$ devices3  7,a7 ,secure            
,developm5t4  7,b7 ,id5tity managem5t4  
7,c7 ,pat*+4  7,d7 ,configuration       
managem5t4  7b7 ,developm5t ( recomm5d$ 
/&>ds = use ( int]net ( ?+s devices by  
,f$]al ,gov]nm5t  7#a7 ,9 g5]al ,n lat] 
?an ,m>* #ca1 #bjbj1 ! ,director ( !    
,in/itute %all develop recomm5dations = 
! ,f$]al ,gov]nm5t on ! appropriate use 

& managem5t by ! ,f$]al ,gov]nm5t (     
,int]net ( ,?+s devices own$ or         
controll$ by ! ,f$]al ,gov]nm5t1 includ+
 m9imum in=mation security requirem5ts =
 manag+ cyb]security risks associat$ )  
su* devices4  7#b7 ,consi/5cy ) ongo+   
ef=ts ,! ,director ( ! ,in/itute %all   
ensure t ! recomm5dations & /&>ds       
develop$ "u p>agraph 7#a7 are consi/5t )
 ! ef=ts ref]r$ to 9 subsection 7a71    
especially ) respect to ! examples (    
possible cyb]security capabilities      
ref]r$ to 9 su* subsection4  7c7        
,in/itute ,report on cyb]security       
consid]ations /emm+ f ! conv]g5ce (     
,in=mation ,te*nology1 ,int]net ( ,?+s1 
& ,op]ational ,te*nology devices1       
networks & sy/ems ,n lat] ?an #ahj days 
foll[+ ! enactm5t ( ?is ,act1 !         
,director ( ! ,in/itute %all publi% a   
draft report relat$ to ! increas+       
conv]g5ce ( traditional ,in=mation      
,te*nology devices1 networks1 & sy/ems )
 ,int]net ( ,?+s devices1 networks &    
sy/ems & ,op]ational ,te*nology devices1

 networks & sy/ems1 includ+             
consid]ations = manag+ cyb]security     
risks associat$ ) su* tr5ds4  #d4       
,policies = ,f$]al ag5cies on use &     
managem5t ( ,int]net ( ,?+s devices  7a7
 ,revisions to ! f$]al acquisition      
regulation ,n lat] ?an #ahj days aft] ! 
date on :i* ! ,director ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology         
completes ! developm5t ( !              
recomm5dations requir$ "u section       
#c7;b71 ! ,director ( ! ,(fice (        
,managem5t & ,budget %all issue         
guidel9es = ea* ag5cy t are consi/5t )  
su* recomm5dations4  7b7 ,requirem5t ,9 
issu+ ! guidel9es requir$ "u subsection 
7a71 ! ,director ( ! ,(fice ( ,managem5t
 & ,budget %all ensure t ! guidel9es are
 consi/5t ) ! in=mation security        
requirem5ts 9 sub*apt] ,,ii ( *apt] #ce 
( title #dd1 ,unit$ ,/ates ,code4  7c7  
,qu9qu5nial reviews & revisions ,n less 
frequ5tly ?an once e #e ye>s-- 7#a7 !   
,director ( ! ,(fice ( ,managem5t &     
,budget & ! ,director ( ! ,national     

,in/itute ( ,/&>ds & ,te*nology %all    
review ! policies issu$ "u subsection   
7a72 &  7#b7 ! ,director ( ! ,(fice (   
,managem5t & ,budget %all1 9            
consultation ) ! ,director ( ! ,national
 ,in/itute ( ,/&>ds & ,te*nology1 revise
 su* policies4  #e4 ,national ,in/itute 
( ,/&>ds & ,te*nology guidance on       
coord9at$ disclosure ( security         
vuln]abilities relat+ to ,int]net ( ,?+s
 devices  7a7 ,9 g5]al ,n lat] ?an #ahj 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,national         
,in/itute ( ,/&>ds & ,te*nology %all1 9 
consultation ) su* cyb]security rese>*]s
 & private-sector indu/ry exp]ts z !    
,director consid]s appropriate1 publi%  
guidance on policies & proc$ures = !    
report+1 coord9at+1 publi%+1 & receiv+ (
 in=mation ab\t--  7#a7 a security      
vuln]ability relat+ to a cov]$ device   
us$ by ! ,f$]al ,gov]nm5t2 &  7#b7 !    
resolution ( su* security vuln]ability4 
7b7 ,elem5ts ,! guidance publi%$ "u     
subsection 7a7 %all include ! foll[+3   

7#a7 ,policies & proc$ures describ$ 9   
subsection 7a7 t1 to ! maximum ext5t    
practicable1 are align$ ) ,/&>ds #biadg 
& #cjaaa ( ! ,int]national ,/&>ds       
,organization1 or any successor /&>ds4  
,su* policies & proc$ures %all include  
policies & proc$ures = a contractor or  
v5dor provid+ a cov]$ device to ! ,f$]al
 ,gov]nm5t on--  7,a7 receiv+ in=mation 
ab\t a pot5tial security vuln]ability   
relat+ to ! cov]$ device2 &  7,b7       
dissem9at+ in=mation ab\t ! resolution (
 a security vuln]ability relat+ to !    
cov]$ device4  7#b7 ,guidance1 includ+  
example cont5t1 on ! in=mation items t  
%\ld be produc$ ?r\gh ! implem5tation ( 
! security vuln]ability disclosure      
process ( ! contractor4  #f4 ,guidel9es 
= ,f$]al ag5cies on coord9at$ disclosure
 ( security vuln]abilities relat+ to    
,int]net ( ,?+s devices  7a7 ,ag5cy     
guidel9es requir$ ,n lat] ?an #ahj days 
aft] ! date on :i* ! guidance requir$ "u
 section #d is publi%$1 ! ,director ( ! 
,(fice ( ,managem5t & ,budget %all1 9   

consultation ) ! ,adm9i/rator ( ! ,g5]al
 ,s]vices ,adm9i/ration1 issue guidel9es
 = ea* ag5cy on report+1 coord9at+1     
publi%+1 & receiv+ in=mation ab\t--     
7#a7 a security vuln]ability relat+ to a
 cov]$ device us$ by ! ag5cy2 &  7#b7 ! 
resolution ( su* security vuln]ability4 
7b7 ,contractor & v5dor compliance )    
,national ,in/itute ( ,/&>ds &          
,te*nology guidance ,! guidel9es requir$
 by subsection 7a7 %all include a       
limitation t prohibits an ag5cy f       
acquir+ or us+ any cov]$ device f a     
contractor or v5dor if ! contractor or  
v5dor fails to comply ) ! guidance      
publi%$ "u section #e7;a74  7c7         
,consi/5cy ) guidance f ,national       
,in/itute ( ,/&>ds & ,te*nology ,!      
,director %all ensure t ! guidel9es     
issu$ "u subsection 7a7 are consi/5t ) !
 guidance publi%$ "u section #e7;a74