,,ii ,cal5d> ,no4 #bae #aaf? ,,congress 
#a/ ,session  ,s4 #gcd ,report ,no4     
#aaf-aab ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,m>* #aa1 #bjai,mr4 ,w>n] 7=  
himself1 ,mr4 ,g>dn]1 ,ms4 ,hassan1 ,mr4
 ,da9es1 ,ms4 ,cortez ,ma/o1 & ,mr4     
,r\nds7 introduc$ ! foll[+ bill2 :i* 0  
read twice & ref]r$ to ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs
  ,septemb] #bc1 #bjai,report$ by ,mr4  
,johnson1 ) an amendment,strike out all 
aft] ! enact+ clause & ins]t ! "p pr9t$ 
9 italic  ,a ,,bill  ,to lev]age ,f$]al 
,gov]nm5t procurem5t p[] to enc\rage    
increas$ cyb]security = ,int]net ( ,?+s 
devices1 & = o!r purposes4  #a4 ,%ort   
title ,?is ,act may be cit$ z ! ,int]net
 ( ,?+s ,cyb]security ,improvem5t ,act (
 #bjai or ! ,io,t ,cyb]security         
,improvem5t ,act ( #bjai4  #b4          
,def9itions ,9 ?is ,act3  7#a7 ,ag5cy ,!
 t]m ag5cy has ! mean+ giv5 su* t]m 9   
section #cejb ( title #dd1 ,unit$ ,/ates
 ,code4  7#b7 ,cov]$ device  7,a7 ,9    
g5]al ,! t]m cov]$ device means a       

physical object t--  7i7 is capable (   
connect+ to & is 9 regul> connection ) !
 ,int]net2  7ii7 has comput] process+   
capabilities t c collect1 s5d1 or       
receive data2 &  7iii7 is n a           
g5]al-purpose comput+ device1 includ+   
p]sonal comput+ sy/ems1 sm>t mobile     
communications devices1 programmable    
logic controls1 & ma9frame comput+      
sy/ems4  7,b7 ,modification ( def9ition 
,! ,director ( ! ,(fice ( ,managem5t &  
,budget %all e/abli% a process by :i*-- 
7i7 int]e/$ p>ties may petition = a     
device t is n describ$ 9 subp>agraph    
7,a7 to be consid]$ a device t is n a   
cov]$ device2 &  7ii7 ! ,director acts  
^u any petition submitt$ "u clause 7i7 9
 a timely mann]4  7#c7 ,security        
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 firmw>e1 s(tw>e1 or comb9ation (
 #b or m ( ^! factors t c\ld enable !   
compromise ( ! confid5tiality1          
integrity1 or availability ( an         
in=mation sy/em or its in=mation or     

physical devices to :i* x is connect$4  
#c4 ,national ,in/itute ( ,/&>ds &      
,te*nology consid]ations &              
recomm5dations reg>d+ manag+ ,int]net ( 
,?+s cyb]security risks  7a7 ,completion
 ( ongo+ ef=ts relat+ to consid]ations =
 manag+ int]net ( ?+s cyb]security risks
  7#a7 ,9 g5]al ,! ,director ( !        
,national ,in/itute ( ,/&>ds &          
,te*nology %all ensure t ! ef=ts ( !    
,in/itute 9 effect on ! date ( !        
enactm5t ( ?is ,act reg>d+ consid]ations
 = manag+ ,int]net ( ,?+s cyb]security  
risks1 especially reg>d+ examples (     
possible cyb]security capabilities (    
,int]net ( ,?+s devices1 are complet$ no
 lat] ?an ,septemb] #cj1 #bjai4  7#b7   
,matt]s address$ ,9 ensur+ ef=ts are    
complet$ "u p>agraph 7#a71 ! ,director  
%all also ensure t su* ef=ts address1 at
 a m9imum1 ! foll[+ consid]ations =     
cov]$ devices3  7,a7 ,secure            
,developm5t4  7,b7 ,id5tity managem5t4  
7,c7 ,pat*+4  7,d7 ,configuration       
managem5t4  7b7 ,developm5t ( recomm5d$ 

/&>ds = use ( int]net ( ?+s devices by  
,f$]al ,gov]nm5t  7#a7 ,9 g5]al ,n lat] 
?an ,m>* #ca1 #bjbj1 ! ,director ( !    
,in/itute %all develop recomm5dations = 
! ,f$]al ,gov]nm5t on ! appropriate use 
& managem5t by ! ,f$]al ,gov]nm5t (     
,int]net ( ,?+s devices own$ or         
controll$ by ! ,f$]al ,gov]nm5t1 includ+
 m9imum in=mation security requirem5ts =
 manag+ cyb]security risks associat$ )  
su* devices4  7#b7 ,consi/5cy ) ongo+   
ef=ts ,! ,director ( ! ,in/itute %all   
ensure t ! recomm5dations & /&>ds       
develop$ "u p>agraph 7#a7 are consi/5t )
 ! ef=ts ref]r$ to 9 subsection 7a71    
especially ) respect to ! examples (    
possible cyb]security capabilities      
ref]r$ to 9 su* subsection4  7c7        
,in/itute ,report on cyb]security       
consid]ations /emm+ f ! conv]g5ce (     
,in=mation ,te*nology1 ,int]net ( ,?+s1 
& ,op]ational ,te*nology devices1       
networks & sy/ems ,n lat] ?an #ahj days 
foll[+ ! enactm5t ( ?is ,act1 !         
,director ( ! ,in/itute %all publi% a   

draft report relat$ to ! increas+       
conv]g5ce ( traditional ,in=mation      
,te*nology devices1 networks1 & sy/ems )
 ,int]net ( ,?+s devices1 networks &    
sy/ems & ,op]ational ,te*nology devices1
 networks & sy/ems1 includ+             
consid]ations = manag+ cyb]security     
risks associat$ ) su* tr5ds4  #d4       
,policies = ,f$]al ag5cies on use &     
managem5t ( ,int]net ( ,?+s devices  7a7
 ,revisions to ! f$]al acquisition      
regulation ,n lat] ?an #ahj days aft] ! 
date on :i* ! ,director ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology         
completes ! developm5t ( !              
recomm5dations requir$ "u section       
#c7;b71 ! ,director ( ! ,(fice (        
,managem5t & ,budget %all issue         
guidel9es = ea* ag5cy t are consi/5t )  
su* recomm5dations4  7b7 ,requirem5t ,9 
issu+ ! guidel9es requir$ "u subsection 
7a71 ! ,director ( ! ,(fice ( ,managem5t
 & ,budget %all ensure t ! guidel9es are
 consi/5t ) ! in=mation security        
requirem5ts 9 sub*apt] ,,ii ( *apt] #ce 

( title #dd1 ,unit$ ,/ates ,code4  7c7  
,qu9qu5nial reviews & revisions ,n less 
frequ5tly ?an once e #e ye>s-- 7#a7 !   
,director ( ! ,(fice ( ,managem5t &     
,budget & ! ,director ( ! ,national     
,in/itute ( ,/&>ds & ,te*nology %all    
review ! policies issu$ "u subsection   
7a72 &  7#b7 ! ,director ( ! ,(fice (   
,managem5t & ,budget %all1 9            
consultation ) ! ,director ( ! ,national
 ,in/itute ( ,/&>ds & ,te*nology1 revise
 su* policies4  #e4 ,national ,in/itute 
( ,/&>ds & ,te*nology guidance on       
coord9at$ disclosure ( security         
vuln]abilities relat+ to ,int]net ( ,?+s
 devices  7a7 ,9 g5]al ,n lat] ?an #ahj 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,national         
,in/itute ( ,/&>ds & ,te*nology %all1 9 
consultation ) su* cyb]security rese>*]s
 & private-sector indu/ry exp]ts z !    
,director consid]s appropriate1 publi%  
guidance on policies & proc$ures = !    
report+1 coord9at+1 publi%+1 & receiv+ (
 in=mation ab\t--  7#a7 a security      

vuln]ability relat+ to a cov]$ device   
us$ by ! ,f$]al ,gov]nm5t2 &  7#b7 !    
resolution ( su* security vuln]ability4 
7b7 ,elem5ts ,! guidance publi%$ "u     
subsection 7a7 %all include ! foll[+3   
7#a7 ,policies & proc$ures describ$ 9   
subsection 7a7 t1 to ! maximum ext5t    
practicable1 are align$ ) ,/&>ds #biadg 
& #cjaaa ( ! ,int]national ,/&>ds       
,organization1 or any successor /&>ds4  
,su* policies & proc$ures %all include  
policies & proc$ures = a contractor or  
v5dor provid+ a cov]$ device to ! ,f$]al
 ,gov]nm5t on--  7,a7 receiv+ in=mation 
ab\t a pot5tial security vuln]ability   
relat+ to ! cov]$ device2 &  7,b7       
dissem9at+ in=mation ab\t ! resolution (
 a security vuln]ability relat+ to !    
cov]$ device4  7#b7 ,guidance1 includ+  
example cont5t1 on ! in=mation items t  
%\ld be produc$ ?r\gh ! implem5tation ( 
! security vuln]ability disclosure      
process ( ! contractor4  #f4 ,guidel9es 
= ,f$]al ag5cies on coord9at$ disclosure
 ( security vuln]abilities relat+ to    

,int]net ( ,?+s devices  7a7 ,ag5cy     
guidel9es requir$ ,n lat] ?an #ahj days 
aft] ! date on :i* ! guidance requir$ "u
 section #d is publi%$1 ! ,director ( ! 
,(fice ( ,managem5t & ,budget %all1 9   
consultation ) ! ,adm9i/rator ( ! ,g5]al
 ,s]vices ,adm9i/ration1 issue guidel9es
 = ea* ag5cy on report+1 coord9at+1     
publi%+1 & receiv+ in=mation ab\t--     
7#a7 a security vuln]ability relat+ to a
 cov]$ device us$ by ! ag5cy2 &  7#b7 ! 
resolution ( su* security vuln]ability4 
7b7 ,contractor & v5dor compliance )    
,national ,in/itute ( ,/&>ds &          
,te*nology guidance ,! guidel9es requir$
 by subsection 7a7 %all include a       
limitation t prohibits an ag5cy f       
acquir+ or us+ any cov]$ device f a     
contractor or v5dor if ! contractor or  
v5dor fails to comply ) ! guidance      
publi%$ "u section #e7;a74  7c7         
,consi/5cy ) guidance f ,national       
,in/itute ( ,/&>ds & ,te*nology ,!      
,director %all ensure t ! guidel9es     
issu$ "u subsection 7a7 are consi/5t ) !

 guidance publi%$ "u section #e7;a74    
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,int]net ( ,?+s ,cyb]security         
,improvem5t ,act ( #bjai or ! ,io,t     
,cyb]security ,improvem5t ,act ( #bjai4 
#b4 ,def9itions ,9 ?is ,act3  7#a7      
,ag5cy ,! t]m ag5cy has ! mean+ giv5 su*
 t]m 9 section #cejb ( title #dd1 ,unit$
 ,/ates ,code4  7#b7 ,director ,! t]m   
,director means ! ,director ( !         
,national ,in/itute ( ,/&>ds &          
,te*nology4  7#c7 ,in=mation sy/em ,!   
t]m in=mation sy/em has ! mean+ giv5 !  
t]m 9 section #cejb ( title #dd1 ,unit$ 
,/ates ,code4  7#d7 ,secret>y ,! t]m    
,secret>y means ! ,secret>y ( ,homel&   
,security4  7#e7 ,security vuln]ability 
,! t]m security vuln]ability has ! mean+
 giv5 ! t]m 9 section #ajb ( !          
,cyb]security ,in=mation ,%>+ ,act (    
#bjae 7#f ,u4,s4,c4 #aeja74  #c4        
,national ,in/itute ( ,/&>ds &          
,te*nology consid]ations &              
recomm5dations reg>d+ manag+ ,int]net ( 
,?+s cyb]security risks  7a7 ,developm5t

 ( recomm5d$ guidel9es = use ( int]net (
 ?+s devices by ,f$]al ,gov]nm5t  7#a7  
,9 g5]al ,n lat] ?an ,m>* #ca1 #bjbj1 ! 
,director %all develop /&>ds & guidel9es
 = ! ,f$]al ,gov]nm5t on ! appropriate  
use & managem5t by ! ,f$]al ,gov]nm5t ( 
,int]net ( ,?+s devices own$ or         
controll$ by ! ,f$]al ,gov]nm5t1 includ+
 m9imum in=mation security requirem5ts =
 manag+ cyb]security risks associat$ )  
su* devices4  7#b7 ,consi/5cy ) ongo+   
ef=ts ,! ,director %all ensure t ! /&>ds
 & guidel9es develop$ "u p>agraph 7#a7  
are consi/5t ) ! ef=ts ( ! ,national    
,in/itute ( ,/&>ds & ,te*nology 9 effect
 on ! date ( enactm5t ( ?is ,act reg>d+ 
consid]ations = manag+ ,int]net ( ,?+s  
cyb]security risks1 especially reg>d+   
examples ( possible cyb]security        
capabilities ( ,int]net ( ,?+s devices1 
& 9 p>ticul> ) respect to ! foll[+      
consid]ations = ,int]net ( ,?+s devices3
  7,a7 ,secure developm5t4  7,b7        
,id5tity managem5t4  7,c7 ,pat*+4  7,d7 
,configuration managem5t4  7b7 ,in/itute

 ,report on cyb]security consid]ations  
/emm+ f ! conv]g5ce ( ,in=mation        
,te*nology1 ,int]net ( ,?+s1 &          
,op]ational ,te*nology devices1         
networks1 & sy/ems ,n lat] ?an #ahj days
 aft] ! date ( enactm5t ( ?is ,act1 !   
,director %all brief ! appropriate      
committees ( ,congress on ! increas+    
conv]g5ce ( traditional in=mation       
te*nology devices1 networks1 & sy/ems ) 
,int]net ( ,?+s devices1 networks1 &    
sy/ems & op]ational te*nology devices1  
networks1 & sy/ems1 includ+             
consid]ations = manag+ cyb]security     
risks & security vuln]abilities         
associat$ ) su* tr5ds4  #d4 ,policies & 
pr9ciples = ,f$]al ag5cies on use &     
managem5t ( ,int]net ( ,?+s devices  7a7
 ,9 g5]al ,n lat] ?an #ahj days aft] !  
date on :i* ! ,director completes !     
developm5t ( ! /&>ds & guidel9es requir$
 "u section #c7;a71 ! ,director ( !     
,(fice ( ,managem5t & ,budget1 9        
consultation ) ! ,secret>y1 %all issue  
policies & pr9ciples = ea* ag5cy t are  

consi/5t ) su* /&>ds & guidel9es4  7b7  
,requirem5t ,9 issu+ ! policies1        
pr9ciples1 /&>ds1 or guidel9es requir$  
"u subsection 7a71 ! ,director ( !      
,(fice ( ,managem5t & ,budget1 9        
consultation ) ! ,secret>y1 %all ensure 
t ! policies & pr9ciples are consi/5t ) 
! in=mation security requirem5ts 9      
sub*apt] ,,ii ( *apt] #ce ( title #dd1  
,unit$ ,/ates ,code4  7c7 ,reviews &    
revisions ,! ,director ( ! ,(fice (     
,managem5t & ,budget1 9 consultation ) !
 ,secret>y1 %all--  7#a7 review any     
policies1 pr9ciples1 /&>ds1 or guidel9es
 issu$ "u subsection 7a72 &  7#b7 revise
 su* policies1 pr9ciples1 /&>ds1 &      
guidel9es4  #e4 ,guidel9es on coord9at$ 
disclosure ( security vuln]abilities    
relat+ to in=mation sy/ems1 includ+     
,int]net ( ,?+s devices  7a7 ,9 g5]al ,n
 lat] ?an #a ye> aft] ! date ( enactm5t 
( ?is ,act1 ! ,director1 9 consultation 
) su* cyb]security rese>*]s &           
private-sector indu/ry exp]ts z !       
,director consid]s appropriate1 & 9     

consultation ) ! ,secret>y1 %all publi% 
guidel9es = ! report+1 coord9at+1       
publi%+1 & receiv+ ( in=mation ab\t--   
7#a7 a security vuln]ability relat+ to  
ag5cy in=mation sy/ems1 includ+ ,int]net
 ( ,?+s devices2 &  7#b7 ! resolution ( 
su* security vuln]ability4  7b7 ,elem5ts
 ,! guidel9es publi%$ "u subsection 7a7 
%all--  7#a7 to ! maximum ext5t         
practicable1 be align$ ) indu/ry be/    
practices & ,/&>ds #biadg & #cjaaa ( !  
,int]national ,/&>ds ,organization1 or  
any successor /&>ds2 &  7#b7 incorporate
 guidel9es on-- 7,a7 receiv+ in=mation  
ab\t a pot5tial security or p]sonal     
in=mation vuln]ability relat+ to ag5cy  
in=mation sy/ems1 & :5 relevant1        
,int]net ( ,?+s devices2 &  7,b7        
dissem9at+ in=mation ab\t ! resolution (
 a security or p]sonal in=mation        
vuln]ability relat+ to ag5cy in=mation  
sy/ems1 & :5 relevant1 ,int]net ( ,?+s  
devices4  7c7 ,in=mation items ,!       
guidel9es publi%$ "u subsection 7a7 %all
 include guidel9es1 includ+ example     

cont5t1 on ! in=mation items t %\ld be  
produc$ ?r\gh ! implem5tation ( !       
security vuln]ability disclosure process
 ( a contractor or v5dor provid+        
,int]net ( ,?+s devices to ! ,f$]al     
,gov]nm5t4  7d7 ,ov]sight ,! ,director (
 ! ,(fice ( ,managem5t & ,budget %all   
ov]see ! implem5tation ( ! guidel9es    
publi%$ "u subsection 7a74  7e7         
,op]ational & te*nical assi/ance ,!     
,secret>y %all provide op]ational &     
te*nical assi/ance 9 implem5t+ !        
guidel9es publi%$ "u subsection 7a74    
#f4 ,implem5tation ( coord9at$          
disclosure ( security vuln]abilities    
relat+ to ag5cy in=mation sy/ems1       
includ+ ,int]net ( ,?+s devices  7a7    
,ag5cy guidel9es requir$ ,n lat] ?an    
#ahj days aft] ! date on :i* ! ,director
 publi%es guidel9es "u section #e7;a71 !
 ,director ( ! ,(fice ( ,managem5t &    
,budget %all issue policies & pr9ciples 
on security vuln]abilities ( in=mation  
sy/ems1 includ+ ,int]net ( ,?+s devices4
  7b7 ,proc$ures ,! ,secret>y1 9        

consultation ) ! ,director ( ! ,(fice ( 
,managem5t & ,budget1 %all develop &    
issue proc$ures = ea* ag5cy on report+1 
coord9at+1 publi%+1 & receiv+ in=mation 
ab\t security vuln]abilities ( in=mation
 sy/ems1 includ+ ,int]net ( ,?+s        
devices4  7c7 ,contractor & v5dor       
compliance ) policies & proc$ures ,!    
proc$ures requir$ "u subsection 7b7 %all
 include a limitation t prohibits an    
ag5cy f acquir+ or us+ any ,int]net (   
,?+s device f a contractor or v5dor if !
 contractor or v5dor fails to comply ) !
 guidel9es publi%$ "u section #e7;a74   
7d7 ,consi/5cy ) guidel9es f ,national  
,in/itute ( ,/&>ds & ,te*nology ,!      
,secret>y %all ensure t ! proc$ures     
requir$ "u subsection 7b7 are consi/5t )
 applicable /&>ds & publications        
e/abli%$ by ! ,national ,in/itute (     
,/&>ds & ,te*nology4  #g4 ,waiv] ,! head
 ( an ag5cy may use an ,int]net ( ,?+s  
device )\t reg>d to any policies1       
pr9ciples1 /&>ds1 or guidel9es issu$ "u 
?is ,act if ! use ( ! ,int]net ( ,?+s   

device is--  7#a7 necess>y = national   
security or = rese>* purposes2  7#b7    
appropriate to ! function ( ! cov]$     
device2  7#c7 secur$ us+ alt]native &   
effective me?ods2 or  7#d7 (            
sub/antially high] quality or           
af=dability ?an a product t meets su*   
policies1 pr9ciples1 /&>ds1 or          
guidel9es4  ,septemb] #bc1 #bjai,report$
 ) an am5dm5t