,,ii ,calendar ,no4 #bae #aafth         
,,congress  #ast ,session  ,s4 #gcd     
,report ,no4 #aaf-aab ,,in ,,the        
,,senate ,,of ,,the ,,united ,,states   
,march #aa1 #bjai,mr4 ,warner 7for      
himself1 ,mr4 ,gardner1 ,ms4 ,hassan1   
,mr4 ,daines1 ,ms4 ,cortez ,masto1 and  
,mr4 ,rounds7 introduced the following  
bill2 which was read twice and referred 
to the ,committee on ,homeland ,security
 and ,governmental ,affairs  ,september 
#bc1 #bjai,reported by ,mr4 ,johnson1   
with an amendment,strike out all after  
the enacting clause and insert the part 
printed in italic  ,a ,,bill  ,to       
leverage ,federal ,government           
procurement power to encourage increased
 cybersecurity for ,internet of ,things 
devices1 and for other purposes4  #a4   
,short title ,this ,act may be cited as 
the ,internet of ,things ,cybersecurity 
,improvement ,act of #bjai or the ,io,t 
,cybersecurity ,improvement ,act of     
#bjai4  #b4 ,definitions ,in this ,act3 
7#a7 ,agency ,the term agency has the   

meaning given such term in section #cejb
 of title #dd1 ,united ,states ,code4   
7#b7 ,covered device  7,a7 ,in general  
,the term covered device means a        
physical object that--  7i7 is capable  
of connecting to and is in regular      
connection with the ,internet2  7ii7 has
 computer processing capabilities that  
can collect1 send1 or receive data2 and 
7iii7 is not a general-purpose computing
 device1 including personal computing   
systems1 smart mobile communications    
devices1 programmable logic controls1   
and mainframe computing systems4  7,b7  
,modification of definition ,the        
,director of the ,office of ,management 
and ,budget shall establish a process by
 which-- 7i7 interested parties may     
petition for a device that is not       
described in subparagraph 7,a7 to be    
considered a device that is not a       
covered device2 and  7ii7 the ,director 
acts upon any petition submitted under  
clause 7i7 in a timely manner4  7#c7    
,security vulnerability ,the term       

security vulnerability means any        
attribute of hardware1 firmware1        
software1 or combination of #b or more  
of these factors that could enable the  
compromise of the confidentiality1      
integrity1 or availability of an        
information system or its information or
 physical devices to which it is        
connected4  #c4 ,national ,institute of 
,standards and ,technology              
considerations and recommendations      
regarding managing ,internet of ,things 
cybersecurity risks  7a7 ,completion of 
ongoing efforts relating to             
considerations for managing internet of 
things cybersecurity risks  7#a7 ,in    
general ,the ,director of the ,national 
,institute of ,standards and ,technology
 shall ensure that the efforts of the   
,institute in effect on the date of the 
enactment of this ,act regarding        
considerations for managing ,internet of
 ,things cybersecurity risks1 especially
 regarding examples of possible         
cybersecurity capabilities of ,internet 

of ,things devices1 are completed no    
later than ,september #cj1 #bjai4  7#b7 
,matters addressed ,in ensuring efforts 
are completed under paragraph 7#a71 the 
,director shall also ensure that such   
efforts address1 at a minimum1 the      
following considerations for covered    
devices3  7,a7 ,secure ,development4    
7,b7 ,identity management4  7,c7        
,patching4  7,d7 ,configuration         
management4  7b7 ,development of        
recommended standards for use of        
internet of things devices by ,federal  
,government  7#a7 ,in general ,not later
 than ,march #ca1 #bjbj1 the ,director  
of the ,institute shall develop         
recommendations for the ,federal        
,government on the appropriate use and  
management by the ,federal ,government  
of ,internet of ,things devices owned or
 controlled by the ,federal ,government1
 including minimum information security 
requirements for managing cybersecurity 
risks associated with such devices4     
7#b7 ,consistency with ongoing efforts  

,the ,director of the ,institute shall  
ensure that the recommendations and     
standards developed under paragraph 7#a7
 are consistent with the efforts        
referred to in subsection 7a71          
especially with respect to the examples 
of possible cybersecurity capabilities  
referred to in such subsection4  7c7    
,institute ,report on cybersecurity     
considerations stemming from the        
convergence of ,information ,technology1
 ,internet of ,things1 and ,operational 
,technology devices1 networks and       
systems ,not later than #ahj days       
following the enactment of this ,act1   
the ,director of the ,institute shall   
publish a draft report related to the   
increasing convergence of traditional   
,information ,technology devices1       
networks1 and systems with ,internet of 
,things devices1 networks and systems   
and ,operational ,technology devices1   
networks and systems1 including         
considerations for managing             
cybersecurity risks associated with such

 trends4  #d4 ,policies for ,federal    
agencies on use and management of       
,internet of ,things devices  7a7       
,revisions to the federal acquisition   
regulation ,not later than #ahj days    
after the date on which the ,director of
 the ,national ,institute of ,standards 
and ,technology completes the           
development of the recommendations      
required under section #c7;b71 the      
,director of the ,office of ,management 
and ,budget shall issue guidelines for  
each agency that are consistent with    
such recommendations4  7b7 ,requirement 
,in issuing the guidelines required     
under subsection 7a71 the ,director of  
the ,office of ,management and ,budget  
shall ensure that the guidelines are    
consistent with the information security
 requirements in subchapter ,,ii of     
chapter #ce of title #dd1 ,united       
,states ,code4  7c7 ,quinquennial       
reviews and revisions ,not less         
frequently than once every #e years--   
7#a7 the ,director of the ,office of    

,management and ,budget and the         
,director of the ,national ,institute of
 ,standards and ,technology shall review
 the policies issued under subsection   
7a72 and  7#b7 the ,director of the     
,office of ,management and ,budget      
shall1 in consultation with the         
,director of the ,national ,institute of
 ,standards and ,technology1 revise such
 policies4  #e4 ,national ,institute of 
,standards and ,technology guidance on  
coordinated disclosure of security      
vulnerabilities relating to ,internet of
 ,things devices  7a7 ,in general ,not  
later than #ahj days after the date of  
the enactment of this ,act1 the         
,director of the ,national ,institute of
 ,standards and ,technology shall1 in   
consultation with such cybersecurity    
researchers and private-sector industry 
experts as the ,director considers      
appropriate1 publish guidance on        
policies and procedures for the         
reporting1 coordinating1 publishing1 and
 receiving of information about--  7#a7 

a security vulnerability relating to a  
covered device used by the ,federal     
,government2 and  7#b7 the resolution of
 such security vulnerability4  7b7      
,elements ,the guidance published under 
subsection 7a7 shall include the        
following3 7#a7 ,policies and procedures
 described in subsection 7a7 that1 to   
the maximum extent practicable1 are     
aligned with ,standards #biadg and      
#cjaaa of the ,international ,standards 
,organization1 or any successor         
standards4 ,such policies and procedures
 shall include policies and procedures  
for a contractor or vendor providing a  
covered device to the ,federal          
,government on--  7,a7 receiving        
information about a potential security  
vulnerability relating to the covered   
device2 and  7,b7 disseminating         
information about the resolution of a   
security vulnerability relating to the  
covered device4  7#b7 ,guidance1        
including example content1 on the       
information items that should be        

produced through the implementation of  
the security vulnerability disclosure   
process of the contractor4  #f4         
,guidelines for ,federal agencies on    
coordinated disclosure of security      
vulnerabilities relating to ,internet of
 ,things devices  7a7 ,agency guidelines
 required ,not later than #ahj days     
after the date on which the guidance    
required under section #d is published1 
the ,director of the ,office of         
,management and ,budget shall1 in       
consultation with the ,administrator of 
the ,general ,services ,administration1 
issue guidelines for each agency on     
reporting1 coordinating1 publishing1 and
 receiving information about--  7#a7 a  
security vulnerability relating to a    
covered device used by the agency2 and  
7#b7 the resolution of such security    
vulnerability4  7b7 ,contractor and     
vendor compliance with ,national        
,institute of ,standards and ,technology
 guidance ,the guidelines required by   
subsection 7a7 shall include a          

limitation that prohibits an agency from
 acquiring or using any covered device  
from a contractor or vendor if the      
contractor or vendor fails to comply    
with the guidance published under       
section #e7;a74  7c7 ,consistency with  
guidance from ,national ,institute of   
,standards and ,technology ,the         
,director shall ensure that the         
guidelines issued under subsection 7a7  
are consistent with the guidance        
published under section #e7;a74  #a4    
,short title ,this ,act may be cited as 
the ,internet of ,things ,cybersecurity 
,improvement ,act of #bjai or the ,io,t 
,cybersecurity ,improvement ,act of     
#bjai4  #b4 ,definitions ,in this ,act3 
7#a7 ,agency ,the term agency has the   
meaning given such term in section #cejb
 of title #dd1 ,united ,states ,code4   
7#b7 ,director ,the term ,director means
 the ,director of the ,national         
,institute of ,standards and            
,technology4  7#c7 ,information system  
,the term information system has the    

meaning given the term in section #cejb 
of title #dd1 ,united ,states ,code4    
7#d7 ,secretary ,the term ,secretary    
means the ,secretary of ,homeland       
,security4  7#e7 ,security vulnerability
 ,the term security vulnerability has   
the meaning given the term in section   
#ajb of the ,cybersecurity ,information 
,sharing ,act of #bjae 7#f ,u4,s4,c4    
#aeja74  #c4 ,national ,institute of    
,standards and ,technology              
considerations and recommendations      
regarding managing ,internet of ,things 
cybersecurity risks  7a7 ,development of
 recommended guidelines for use of      
internet of things devices by ,federal  
,government  7#a7 ,in general ,not later
 than ,march #ca1 #bjbj1 the ,director  
shall develop standards and guidelines  
for the ,federal ,government on the     
appropriate use and management by the   
,federal ,government of ,internet of    
,things devices owned or controlled by  
the ,federal ,government1 including     
minimum information security            

requirements for managing cybersecurity 
risks associated with such devices4     
7#b7 ,consistency with ongoing efforts  
,the ,director shall ensure that the    
standards and guidelines developed under
 paragraph 7#a7 are consistent with the 
efforts of the ,national ,institute of  
,standards and ,technology in effect on 
the date of enactment of this ,act      
regarding considerations for managing   
,internet of ,things cybersecurity      
risks1 especially regarding examples of 
possible cybersecurity capabilities of  
,internet of ,things devices1 and in    
particular with respect to the following
 considerations for ,internet of ,things
 devices3  7,a7 ,secure development4    
7,b7 ,identity management4  7,c7        
,patching4  7,d7 ,configuration         
management4  7b7 ,institute ,report on  
cybersecurity considerations stemming   
from the convergence of ,information    
,technology1 ,internet of ,things1 and  
,operational ,technology devices1       
networks1 and systems ,not later than   

#ahj days after the date of enactment of
 this ,act1 the ,director shall brief   
the appropriate committees of ,congress 
on the increasing convergence of        
traditional information technology      
devices1 networks1 and systems with     
,internet of ,things devices1 networks1 
and systems and operational technology  
devices1 networks1 and systems1         
including considerations for managing   
cybersecurity risks and security        
vulnerabilities associated with such    
trends4  #d4 ,policies and principles   
for ,federal agencies on use and        
management of ,internet of ,things      
devices  7a7 ,in general ,not later than
 #ahj days after the date on which the  
,director completes the development of  
the standards and guidelines required   
under section #c7;a71 the ,director of  
the ,office of ,management and ,budget1 
in consultation with the ,secretary1    
shall issue policies and principles for 
each agency that are consistent with    
such standards and guidelines4  7b7     

,requirement ,in issuing the policies1  
principles1 standards1 or guidelines    
required under subsection 7a71 the      
,director of the ,office of ,management 
and ,budget1 in consultation with the   
,secretary1 shall ensure that the       
policies and principles are consistent  
with the information security           
requirements in subchapter ,,ii of      
chapter #ce of title #dd1 ,united       
,states ,code4  7c7 ,reviews and        
revisions ,the ,director of the ,office 
of ,management and ,budget1 in          
consultation with the ,secretary1       
shall--  7#a7 review any policies1      
principles1 standards1 or guidelines    
issued under subsection 7a72 and  7#b7  
revise such policies1 principles1       
standards1 and guidelines4  #e4         
,guidelines on coordinated disclosure of
 security vulnerabilities relating to   
information systems1 including ,internet
 of ,things devices  7a7 ,in general    
,not later than #a year after the date  
of enactment of this ,act1 the          

,director1 in consultation with such    
cybersecurity researchers and           
private-sector industry experts as the  
,director considers appropriate1 and in 
consultation with the ,secretary1 shall 
publish guidelines for the reporting1   
coordinating1 publishing1 and receiving 
of information about--  7#a7 a security 
vulnerability relating to agency        
information systems1 including ,internet
 of ,things devices2 and  7#b7 the      
resolution of such security             
vulnerability4  7b7 ,elements ,the      
guidelines published under subsection   
7a7 shall--  7#a7 to the maximum extent 
practicable1 be aligned with industry   
best practices and ,standards #biadg and
 #cjaaa of the ,international ,standards
 ,organization1 or any successor        
standards2 and  7#b7 incorporate        
guidelines on-- 7,a7 receiving          
information about a potential security  
or personal information vulnerability   
relating to agency information systems1 
and when relevant1 ,internet of ,things 

devices2 and  7,b7 disseminating        
information about the resolution of a   
security or personal information        
vulnerability relating to agency        
information systems1 and when relevant1 
,internet of ,things devices4  7c7      
,information items ,the guidelines      
published under subsection 7a7 shall    
include guidelines1 including example   
content1 on the information items that  
should be produced through the          
implementation of the security          
vulnerability disclosure process of a   
contractor or vendor providing ,internet
 of ,things devices to the ,federal     
,government4  7d7 ,oversight ,the       
,director of the ,office of ,management 
and ,budget shall oversee the           
implementation of the guidelines        
published under subsection 7a74  7e7    
,operational and technical assistance   
,the ,secretary shall provide           
operational and technical assistance in 
implementing the guidelines published   
under subsection 7a74  #f4              

,implementation of coordinated          
disclosure of security vulnerabilities  
relating to agency information systems1 
including ,internet of ,things devices  
7a7 ,agency guidelines required ,not    
later than #ahj days after the date on  
which the ,director publishes guidelines
 under section #e7;a71 the ,director of 
the ,office of ,management and ,budget  
shall issue policies and principles on  
security vulnerabilities of information 
systems1 including ,internet of ,things 
devices4  7b7 ,procedures ,the          
,secretary1 in consultation with the    
,director of the ,office of ,management 
and ,budget1 shall develop and issue    
procedures for each agency on reporting1
 coordinating1 publishing1 and receiving
 information about security             
vulnerabilities of information systems1 
including ,internet of ,things devices4 
7c7 ,contractor and vendor compliance   
with policies and procedures ,the       
procedures required under subsection 7b7
 shall include a limitation that        

prohibits an agency from acquiring or   
using any ,internet of ,things device   
from a contractor or vendor if the      
contractor or vendor fails to comply    
with the guidelines published under     
section #e7;a74  7d7 ,consistency with  
guidelines from ,national ,institute of 
,standards and ,technology ,the         
,secretary shall ensure that the        
procedures required under subsection 7b7
 are consistent with applicable         
standards and publications established  
by the ,national ,institute of          
,standards and ,technology4  #g4 ,waiver
 ,the head of an agency may use an      
,internet of ,things device without     
regard to any policies1 principles1     
standards1 or guidelines issued under   
this ,act if the use of the ,internet of
 ,things device is--  7#a7 necessary for
 national security or for research      
purposes2  7#b7 appropriate to the      
function of the covered device2  7#c7   
secured using alternative and effective 
methods2 or  7#d7 of substantially      

higher quality or affordability than a  
product that meets such policies1       
principles1 standards1 or guidelines4   
,september #bc1 #bjai,reported with an  
amendment