,i #aagth ,,congress #b;d ,session ,h4 ,r4 #fdig ,,in ,,the ,,house ,,of ,,representatives ,january #be1 #bjbb,mrs4 ,carolyn ,b4 ,maloney of ,new ,york 7for herself1 ,mr4 ,comer1 ,mr4 ,connolly1 ,mr4 ,sessions1 ,ms4 ,norton1 ,mr4 ,keller1 ,ms4 ,wasserman ,schultz1 ,mr4 ,hice of ,georgia1 ,mr4 ,cooper1 ,mr4 ,c4 ,scott ,franklin of ,florida1 ,ms4 ,brown of ,ohio1 ,mr4 ,gibbs1 ,mr4 ,lynch1 and ,mr4 ,raskin7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,reform1 and in addition to the ,committee on ,science1 ,space1 and ,technology1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to modernize ,federal information security management and improve ,federal cybersecurity to combat persisting and emerging threats1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,information ,security ,modernization ,act of #bjbb4 #b4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4,sec4 #b4 ,table of contents4,sec4 #c4 ,definitions4,title ,i--,,updates ,,to ,f,i,s,m,a,sec4 #aja4 ,title #dd amendments4,sec4 #ajb4 ,amendments to subtitle ,,iii of title #dj4,sec4 #ajc4 ,actions to enhance ,federal incident response4,sec4 #ajd4 ,additional guidance to agencies on ,,fisma updates4,sec4 #aje4 ,agency requirements to notify private sector entities impacted by incidents4,title ,,ii--,,improving ,,federal ,c,y,b,e,r,s,e,c,u,r,i,t,y,sec4 #bja4 ,mobile security standards4,sec4 #bjb4 ,data and logging retention for incident response4,sec4 #bjc4 ,federal penetration testing policy4,sec4 #bjd4 ,ongoing threat hunting program4,sec4 #bje4 ,codifying vulnerability disclosure programs4,sec4 #bjf4 ,implementing zero trust architecture4,sec4 #bjg4 ,,gao automation report4,sec4 #bjh4 ,extension of ,federal ,acquisition ,security ,council4,sec4 #bji4 ,federal chief information security officer4,sec4 #baj4 ,extension of ,chief ,data ,officer ,council4,sec4 #baa4 ,council of the inspectors general on integrity and efficiency dashboard4,sec4 #bab4 ,quantitative cybersecurity metrics4,title ,,iii--,,pilot ,,programs ,,to ,,enhance ,,federal ,c,y,b,e,r,s,e,c,u,r,i,t,y,sec4 #cja4 ,risk-based budget pilot4,sec4 #cjb4 ,active cyber defensive study4,sec4 #cjc4 ,security operations center as a service pilot4,sec4 #cjd4 ,endpoint detection and response as a service pilot4 #c4 ,definitions ,in this ,act1 unless otherwise specified3 7#a7 ,additional cybersecurity procedure ,the term additional cybersecurity procedure has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7#b7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#c7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 and 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#d7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#e7 ,incident ,the term incident has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#f7 ,national security system ,the term national security system has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#g7 ,penetration test ,the term penetration test has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7#h7 ,threat hunting ,the term threat hunting means iteratively searching systems for threats that evade detection by automated threat detection systems4 7#i7 ,zero trust architecture ,the term zero trust architecture means a security model1 a set of system design principles1 and a coordinated cybersecurity and system management strategy that employs continuous monitoring1 risk-based access controls1 or system security automation techniques to address the cybersecurity principle that threats exist both inside and outside traditional network boundaries with an assumption that a breach is inevitable or has likely already occurred1 and therefore employs least-privileged access for network or system users while monitoring for anomalous or malicious activity4 ,i ,,updates ,,to ,,fisma #aja4 ,title #dd amendments 7a7 ,subchapter ,i amendments ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a77#a77;,b7 of section #cejd-- 7,a7 by striking clause 7v7 and inserting the following3 7v7 confidentiality1 privacy1 disclosure1 and sharing of information2 2 7,b7 by redesignating clause 7vi7 as clause 7vii72 and 7,c7 by inserting after clause 7v7 the following3 7vi7 in consultation with the ,national ,cyber ,director1 confidentiality and security of information2 and 2 7#b7 in section #ceje-- 7,a7 in paragraph 7#b7 of the first subsection designated as subsection 7c7 by adding discovery of internet-accessible information systems and assets1 as well as after an inventory under this subsection shall include2 7,b7 in paragraph 7#c7 of the first subsection designated as subsection 7c7-- 7i7 in subparagraph 7,b7-- 7,i7 by inserting the ,secretary of ,homeland ,security acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and before the ,comptroller ,general2 and 7,,ii7 by striking and at the end2 7ii7 in subparagraph 7,c77v71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 maintained on a continual basis through the use of automation1 machine-readable data1 and scanning wherever practicable4 2 and 7,c7 by striking the second subsection designated as subsection 7c72 7#c7 in section #cejf-- 7,a7 in subsection 7a77#c71 by inserting ,in carrying out these duties1 the ,chief ,information ,officer shall coordinate1 as appropriate1 with the ,chief ,data ,officer in accordance with the designated functions under section #cebj7;c74 after reduction of information collection burdens on the public42 and 7,b7 in subsection 7b77#a77;,c71 by inserting 1 availability after integrity2 and 7#d7 in section #ceac-- 7,a7 by redesignating subsection 7c7 as subsection 7d72 and 7,b7 by inserting after subsection 7b7 the following3 7c7 ,each agency providing a written plan under subsection 7b7 shall provide any portion of the written plan addressing information security to the ,national ,cyber ,director4 4 7b7 ,subchapter ,,ii definitions 7#a7 ,in general ,section #ceeb7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by redesignating paragraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 and 7#g7 as paragraphs 7#b71 7#d71 7#e71 7#f71 7#g71 7#i71 and 7#aa71 respectively2 7,b7 by inserting before paragraph 7#b71 as so redesignated1 the following3 7#a7 ,the term additional cybersecurity procedure means a process1 procedure1 or other activity that is established in excess of the information security standards promulgated under section #aacca7;b7 of title #dj to increase the security and reduce the cybersecurity risk of agency systems4 2 7,c7 by inserting after paragraph 7#b71 as so redesignated1 the following3 7#c7 ,the term high value asset means information or an information system that the head of an agency determines1 using policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a71 to be so critical to the agency that the loss or corruption of the information or the loss of access to the information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business4 2 7,d7 by inserting after paragraph 7#g71 as so redesignated1 the following3 7#h7 ,the term major incident has the meaning given the term in guidance issued by the ,director under section #ceih7;a74 2 7,e7 by inserting after paragraph 7#i71 as so redesignated1 the following3 7#aj7 ,the term penetration test has the meaning given the term in guidance issued by the ,director4 2 and 7,f7 by inserting after paragraph 7#aa71 as so redesignated1 the following3 7#ab7 ,the term shared service means a centralized business or mission capability that is provided to multiple organizations within an agency or to multiple agencies4 4 7#b7 ,conforming amendments 7,a7 ,homeland security act of #bjjb ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is amended by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f77;,a7 and inserting section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,c7 ,high-performance computing act of #aiia ,section #bjg7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is amended by striking section #ceeb7;b77#f77;,a77i7 and inserting section #ceeb7;b77#i77;,a77i74 7,d7 ,internet of things cybersecurity improvement act of #bjbj ,section #c7e7 of the ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,e7 ,national defense authorization act for fiscal year #bjac ,section #icc7;e77#a77;,b7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7#aj ,u4,s4,c4 #bbbd note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,f7 ,ike skelton national defense authorization act for fiscal year #bjaa ,the ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa 7,public ,law #aaa-chc7 is amended-- 7i7 in section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by striking section #cedb7;b7 and inserting section #ceeb7;b72 7ii7 in section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b72 and 7iii7 in section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,g7 ,e-government act of #bjjb ,section #cja7;c77#a77;,a7 of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,h7 ,national institute of standards and technology act ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7i7 in subsection 7a77#b71 by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b72 and 7ii7 in subsection 7f7-- 7,i7 in paragraph 7#c71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7,,ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b74 7c7 ,subchapter ,,ii amendments ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceea-- 7,a7 in paragraph 7#d71 by striking diagnose and improve and inserting integrate1 deliver1 diagnose1 and improve2 7,b7 in paragraph 7#e71 by striking and at the end2 7,c7 in paragraph 7#f71 by striking the period at the end and inserting a semicolon2 and 7,d7 by adding at the end the following3 7#g7 recognize that each agency has specific mission requirements and1 at times1 unique cybersecurity requirements to meet the mission of the agency2 7#h7 recognize that each agency does not have the same resources to secure agency systems1 and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone2 and 7#i7 recognize that a holistic ,federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies4 2 7#b7 in section #ceec-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#e71 by striking and at the end2 7ii7 in paragraph 7#f71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7#g7 promoting1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and the ,director of the ,national ,institute of ,standards and ,technology-- 7,a7 the use of automation to improve ,federal cybersecurity and visibility with respect to the implementation of ,federal cybersecurity2 and 7,b7 the use of zero trust architecture to improve resiliency and timely response actions to incidents on ,federal systems4 2 7,b7 in subsection 7b7-- 7i7 in the matter preceding paragraph 7#a71 by striking ,the ,secretary1 in consultation with the ,director and inserting ,the ,secretary of ,homeland ,security1 acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with the ,director and the ,national ,cyber ,director2 7ii7 in paragraph 7#b77;,a71 by inserting and reporting requirements under subchapter ,,iv of this chapter after section #ceef2 7iii7 redesignate paragraphs 7#h7 and 7#i7 as paragraphs 7#i7 and 7#aj72 and 7iv7 insert a new paragraph 7#h73 7#h7 expeditiously seek opportunities to reduce costs1 administrative burdens1 and other barriers to information technology security and modernization for ,federal agencies1 including through-- 7,a7 central shared services contracts for cybersecurity capabilities identified as optimal by the ,director1 in coordination with the ,secretary acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and other agencies as appropriate2 and 7,b7 offering technical assistance and expertise to agencies on the selection and successful engagement of highly adaptive cybersecurity service contracts and other relevant contracts provided by the ,u4,s4 ,general ,services ,administration4 2 7,c7 in subsection 7c7-- 7i7 in the matter preceding paragraph 7#a71 by striking each year and inserting each year during which agencies are required to submit reports under section #ceed7;c7 and by striking preceding year and inserting preceding two years2 7ii7 by striking paragraph 7#a72 7iii7 by redesignating paragraphs 7#b71 7#c71 and 7#d7 as paragraphs 7#a71 7#b71 and 7#c71 respectively2 7iv7 in paragraph 7#c71 as so redesignated1 by striking and at the end2 and 7v7 by inserting after paragraph 7#c71 as so redesignated1 the following3 7#d7 a summary of each assessment of ,federal risk posture performed under subsection 7i72 and 2 7,d7 by redesignating subsections 7i71 7j71 7k71 and 7l7 as subsections 7j71 7k71 7l71 and 7m7 respectively2 7,e7 in subsection 7h7-- 7i7 in paragraph 7#b71 subparagraph 7,a7 adding and the ,national ,cyber ,director after in coordination with the ,director2 7ii7 in paragraph 7#b71 subparagraph 7,d7 adding 1 the ,national ,cyber ,director1 after notify the ,director2 and 7iii7 in paragraph 7#c71 subparagraph 7,a71 clause 7iv7 adding 1 the ,national ,cyber ,director1 after the ,secretary provides prior notice to the ,director2 7,f7 by inserting after subsection 7h7 the following3 7i7 ,federal risk assessments ,on an ongoing and continuous basis1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform assessments using any available information on the cybersecurity posture of agencies1 and brief the ,director and ,national ,cyber ,director on the findings of those assessments including-- 7#a7 the status of agency cybersecurity remedial actions described in section #ceed7;b77#g72 7#b7 any vulnerability information relating to the systems of an agency that is known by the agency2 7#c7 analysis of incident information under section #ceig2 7#d7 evaluation of penetration testing performed under section #ceei;,a2 7#e7 evaluation of vulnerability disclosure program information under section #ceei;,b2 7#f7 evaluation of agency threat hunting results2 7#g7 evaluation of ,federal and non-,federal cyber threat intelligence2 7#h7 data on agency compliance with standards issued under section #aacca of title #dj2 7#i7 agency system risk assessments performed under section #ceed7;a77#a77;,a72 and 7#aj7 any other information the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines relevant4 2 7,g7 in subsection 7j71 as so redesignated-- 7i7 by striking ,not later than and inserting3 7#a7 ,in general ,not later than 2 7ii7 by striking regarding the specific and inserting that includes a summary of-- 7,a7 the specific 2 7iii7 in paragraph 7#a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iv7 by adding at the end the following3 7,b7 the trends identified in the ,federal risk assessments performed under subsection 7i74 7#b7 ,form ,the report required under paragraph 7#a7 shall be unclassified but may include a classified annex4 2 and 7,h7 by adding at the end the following3 7n7 ,binding operational directives ,if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency issues a binding operational directive or an emergency directive under this section1 not later than #g days after the date on which the binding operational directive requires an agency to take an action1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the ,director and ,national ,cyber ,director the status of the implementation of the binding operational directive at the agency4 2 7#c7 in section #ceed-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a7-- 7,i7 by redesignating subparagraphs 7,a71 7,b71 and 7,c7 as subparagraphs 7,b71 7,c71 and 7,d71 respectively2 7,,ii7 by inserting before subparagraph 7,b71 as so redesignated1 the following3 7,a7 on an ongoing and continuous basis1 performing an agency system risk assessment that-- 7i7 identifies and documents the high value assets of the agency using guidance from the ,director2 7ii7 evaluates the data assets inventoried under section #ceaa for sensitivity to compromises in confidentiality1 integrity1 and availability2 7iii7 identifies agency systems that have access to or hold the data assets inventoried under section #ceaa2 7iv7 evaluates the threats facing agency systems and data1 including high value assets1 based on ,federal and non-,federal cyber threat intelligence products1 where available2 7v7 evaluates the vulnerability of agency systems and data1 including high value assets1 including by analyzing-- 7,i7 the results of penetration testing performed by the ,department of ,homeland ,security under section #ceec7;b77#i72 7,,ii7 the results of penetration testing performed under section #ceei;,a2 7,,iii7 information provided to the agency through the vulnerability disclosure program of the agency under section #ceei;,b2 7,,iv7 incidents2 and 7,v7 any other vulnerability information relating to agency systems that is known to the agency2 7vi7 assesses the impacts of potential agency incidents to agency systems1 data1 and operations based on the evaluations described in clauses 7ii7 and 7iv7 and the agency systems identified under clause 7iii72 and 7vii7 assesses the consequences of potential incidents occurring on agency systems that would impact systems at other agencies1 including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system2 2 7,,iii7 in subparagraph 7,b71 as so redesignated1 in the matter preceding clause 7i71 by striking providing information and inserting using information from the assessment conducted under subparagraph 7,a71 providing information2 7,,iv7 in subparagraph 7,c71 as so redesignated-- 7aa7 in clause 7ii7 by inserting binding before operational2 and 7bb7 in clause 7vi71 by striking and at the end2 and 7,v7 by adding at the end the following3 7,e7 providing an update on the ongoing and continuous assessment performed under subparagraph 7,a7-- 7i7 upon request1 to the inspector general of the agency or the ,comptroller ,general of the ,united ,states2 and 7ii7 on a periodic basis1 as determined by guidance issued by the ,director but not less frequently than every #b years1 to-- 7,i7 the ,director2 7,,ii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,,iii7 the ,national ,cyber ,director2 7,f7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and not less frequently than once every #c years1 performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of1 or under the supervision of1 the agency1 which shall-- 7i7 be completed considering the agency system risk assessment performed under subparagraph 7,a72 and 7ii7 include a specific evaluation for high value assets2 7,g7 not later than #cj days after completing the evaluation performed under subparagraph 7,f71 providing the evaluation and an implementation plan1 if applicable1 for using additional cybersecurity procedures determined to be appropriate to-- 7i7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7ii7 the ,director2 and 7iii7 the ,national ,cyber ,director2 and 7,h7 if the head of the agency determines there is need for additional cybersecurity procedures1 ensuring that those additional cybersecurity procedures are reflected in the budget request of the agency2 2 and 7ii7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting in accordance with the agency system risk assessment performed under paragraph 7#a77;,a7 after information systems2 7,,ii7 in subparagraph 7,b7-- 7aa7 by striking in accordance with standards and inserting in accordance with-- 7i7 standards 2 and 7bb7 by adding at the end the following3 7ii7 the evaluation performed under paragraph 7#a77;,f72 and 7iii7 the implementation plan described in paragraph 7#a77;,g72 2 and 7,,iii7 in subparagraph 7,d71 by inserting 1 through the use of penetration testing1 the vulnerability disclosure program established under section #ceei;,b1 and other means1 after periodically2 7,b7 in subsection 7b7-- 7i7 by striking paragraph 7#a7 and inserting the following3 7#a7 pursuant to subsection 7a77#a77;,a71 performing ongoing and continuous agency system risk assessment1 which may include using automated tools consistent with standards and guidelines promulgated under section #aacca of title #dj1 as applicable2 2 7ii7 in paragraph 7#b77;,d7-- 7,i7 by redesignating clauses 7iii7 and 7iv7 as clauses 7iv7 and 7v71 respectively2 7,,ii7 by inserting after clause 7ii7 the following3 7iii7 binding operational directives and emergency directives promulgated by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency under section #ceec2 2 and 7,,iii7 in clause 7iv71 as so redesignated1 by striking as determined by the agency2 and and inserting as determined by the agency1 considering the agency risk assessment performed under subsection 7a77#a77;,a742 7iii7 in paragraph 7#e77;,a71 by inserting 1 including penetration testing1 as appropriate1 after shall include testing2 7iv7 by redesignating paragraphs 7#g7 and 7#h7 as paragraphs 7#h7 and 7#i71 respectively2 7v7 by inserting after paragraph 7#f7 the following3 7#g7 a process for providing the status of every remedial action1 as well as unremediated identified system vulnerabilities1 to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable2 2 and 7vi7 in paragraph 7#h77;,c71 as so redesignated-- 7,i7 by striking clause 7ii7 and inserting the following3 7ii7 notifying and consulting with the ,federal information security incident center established under section #ceef pursuant to the requirements of section #ceid2 2 7,,ii7 by redesignating clause 7iii7 as clause 7iv72 7,,iii7 by inserting after clause 7ii7 the following3 7iii7 performing the notifications and other activities required under subchapter ,,iv of this chapter2 and 2 and 7,,iv7 in clause 7iv71 as so redesignated-- 7aa7 in subclause 7,,ii71 by adding and at the end2 7bb7 by striking subclause 7,,iii72 and 7cc7 by redesignating subclause 7,,iv7 as subclause 7,,iii72 and 7,c7 in subsection 7c7-- 7i7 by redesignating paragraph 7#b7 as paragraph 7#e72 7ii7 by striking paragraph 7#a7 and inserting the following3 7#a7 ,biannual report ,not later than #b years after the date of the enactment of the ,federal ,information ,security ,modernization ,act of #bjbb and not less frequently than once every #b years thereafter1 using the continuous and ongoing agency system risk assessment under subsection 7a77#a77;,a71 the head of each agency shall submit to the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the majority and minority leaders of the ,senate1 the ,speaker and minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives1 the appropriate authorization and appropriations committees of ,congress1 the ,national ,cyber ,director1 and the ,comptroller ,general of the ,united ,states a report that-- 7,a7 summarizes the agency system risk assessment performed under subsection 7a77#a77;,a72 7,b7 evaluates the adequacy and effectiveness of information security policies1 procedures1 and practices of the agency to address the risks identified in the agency system risk assessment performed under subsection 7a77#a77;,a71 including an analysis of the agency's cybersecurity and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 7,c7 summarizes the evaluation and implementation plans described in subparagraphs 7,f7 and 7,g7 of subsection 7a77#a7 and whether those evaluation and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency2 and 7,d7 summarizes the status of remedial actions identified by inspector general of the agency1 the ,comptroller ,general of the ,united ,states1 and any other source determined appropriate by the head of the agency4 7#b7 ,unclassified reports ,each report submitted under paragraph 7#a7-- 7,a7 shall be1 to the greatest extent practicable1 in an unclassified and otherwise uncontrolled form2 and 7,b7 may include a classified annex4 7#c7 ,access to information ,the head of an agency shall ensure that1 to the greatest extent practicable1 information is included in the unclassified form of the report submitted by the agency under paragraph 7#b77;,a74 7#d7 ,briefings ,during each year during which a report is not required to be submitted under paragraph 7#a71 the ,director shall provide to the congressional committees described in paragraph 7#a7 a briefing summarizing current cybersecurity posture of agencies4 2 and 7iii7 in paragraph 7#e71 as so redesignated1 by inserting 1 including the reporting procedures established under section #aacae7;d7 of title #dj and subsection 7a77#c77;,a77v7 of this section1 after policies1 procedures1 and practices2 and 7#d7 in section #ceee-- 7,a7 in the section heading1 by striking ,annual independent and inserting ,independent2 7,b7 in subsection 7a7-- 7i7 in paragraph 7#a71 by inserting during which a report is required to be submitted under section #ceec7;c71 after ,each year2 7ii7 in paragraph 7#b77;,a71 by inserting 1 including by penetration testing and analyzing the vulnerability disclosure program of the agency after information systems2 and 7iii7 by adding at the end the following3 7#c7 ,an evaluation under this section may include recommendations for improving the cybersecurity posture of the agency4 2 7,c7 in subsection 7b77#a71 by striking annual2 7,d7 in subsection 7e77#a71 by inserting during which a report is required to be submitted under section #ceec7;c7 after ,each year2 7,e7 by striking subsection 7f7 and inserting the following3 7f7 ,protection of information 7#a7 ,agencies1 evaluators1 and other recipients of information that1 if disclosed1 may cause grave harm to the efforts of ,federal information security officers1 shall take appropriate steps to ensure the protection of that information1 including safeguarding the information from public disclosure4 7#b7 ,the protections required under paragraph 7#a7 shall be commensurate with the risk and comply with all applicable laws and regulations4 7#c7 ,with respect to information that is not related to national security systems1 agencies and evaluators shall make a summary of the information unclassified and publicly available1 including information that does not identify-- 7,a7 specific information system incidents2 or 7,b7 specific information system vulnerabilities4 2 7,f7 in subsection 7g77#b7-- 7i7 by striking this subsection shall and inserting this subsection-- 7,a7 shall 2 7ii7 in subparagraph 7,a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,b7 identify any entity that performs an independent evaluation under subsection 7b74 2 and 7,g7 striking subsection 7j72 and 7#e7 in section #ceef7;a77#d7 by striking #ceed7;b7 and inserting #ceed7;a77#a77;,a74 7d7 ,conforming amendments 7#a7 ,table of sections ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by striking the item relating to section #ceec and inserting the following3 #ceec4 ,authority and functions of the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 2 and 7,b7 by striking the item relating to section #ceee and inserting the following3 #ceee4 ,independent evaluation4 4 7#b7 ,,omb reports ,section #bbf7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebd7;c77 is amended-- 7,a7 in paragraph 7#a77;,b71 in the matter preceding clause 7i71 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7,b7 in paragraph 7#b77;,b71 in the matter preceding clause 7i7-- 7i7 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7ii7 by striking the report required under section #ceec7;c7 of title #dd1 ,united ,states ,code and inserting that report4 7#c7 ,,nist responsibilities ,section #bj7;d77#c77;,b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is amended by striking annual4 7e7 ,federal system incident response 7#a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,iv ,federal ,system ,incident ,response #ceia4 ,definitions 7a7 ,in general ,except as provided in subsection 7b71 the definitions under sections #cejb and #ceeb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,appropriate reporting entities ,the term appropriate reporting entities means-- 7,a7 the majority and minority leaders of the ,senate2 7,b7 the ,speaker and minority leader of the ,house of ,representatives2 7,c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,d7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7,e7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,f7 the appropriate authorization and appropriations committees of ,congress2 7,g7 the ,director2 7,h7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,i7 the ,national ,cyber ,director2 7,j7 the ,comptroller ,general of the ,united ,states2 and 7,k7 the inspector general of any impacted agency4 7#b7 ,awardee ,the term awardee-- 7,a7 means a person1 business1 or other entity that receives a grant from1 or is a party to a cooperative agreement or an other transaction agreement with1 an agency2 and 7,b7 includes any subgrantee of a person1 business1 or other entity described in subparagraph 7,a74 7#c7 ,breach ,the term breach shall be defined by the ,director4 7#d7 ,contractor ,the term contractor means a prime contractor of an agency or a subcontractor of a prime contractor of an agency4 7#e7 ,federal information ,the term ,federal information means information created1 collected1 processed1 maintained1 disseminated1 disclosed1 or disposed of by or for the ,federal ,government in any medium or form4 7#f7 ,federal information system ,the term ,federal information system means an information system used or operated by an agency1 a contractor1 or another organization on behalf of an agency4 7#g7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consumer reporting agency ,the term nationwide consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vulnerability disclosure ,the term vulnerability disclosure means a vulnerability identified under section #ceei;,b4 #ceib4 ,notification of breach 7a7 ,notification ,as expeditiously as practicable and without unreasonable delay1 and in any case not later than #de days after an agency has a reasonable basis to conclude that a breach has occurred1 the head of the agency1 in consultation with the chief privacy officer of the agency1 shall-- 7#a7 determine whether notice to any individual potentially affected by the breach is appropriate based on an assessment of the risk of harm to the individual that considers-- 7,a7 the nature and sensitivity of the personally identifiable information affected by the breach2 7,b7 the likelihood of access to and use of the personally identifiable information affected by the breach2 7,c7 the type of breach2 and 7,d7 any other factors determined by the ,director2 and 7#b7 as appropriate1 provide written notice in accordance with subsection 7b7 to each individual potentially affected by the breach-- 7,a7 to the last known mailing address of the individual2 or 7,b7 through an appropriate alternative method of notification that the head of the agency or a designated senior-level individual of the agency selects based on factors determined by the ,director4 7b7 ,contents of notice ,each notice of a breach provided to an individual under subsection 7a77#b7 shall include-- 7#a7 a brief description of the breach2 7#b7 if possible1 a description of the types of personally identifiable information affected by the breach2 7#c7 contact information of the agency that may be used to ask questions of the agency1 which-- 7,a7 shall include an e-mail address or another digital contact mechanism2 and 7,b7 may include a telephone number1 mailing address1 or a website2 7#d7 information on any remedy being offered by the agency2 7#e7 any applicable educational materials relating to what individuals can do in response to a breach that potentially affects their personally identifiable information1 including relevant contact information for ,federal law enforcement agencies and each nationwide consumer reporting agency2 and 7#f7 any other appropriate information1 as determined by the head of the agency or established in guidance by the ,director4 7c7 ,delay of notification 7#a7 ,in general ,the ,attorney ,general1 the ,director of ,national ,intelligence1 or the ,secretary of ,homeland ,security may delay a notification required under subsection 7a7 if the notification would-- 7,a7 impede a criminal investigation or a national security activity2 7,b7 reveal sensitive sources and methods2 7,c7 cause damage to national security2 or 7,d7 hamper security remediation actions4 7#b7 ,documentation 7,a7 ,in general ,any delay under paragraph 7#a7 shall be reported in writing to the ,director1 the ,attorney ,general1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the head of the agency and the inspector general of the agency that experienced the breach4 7,b7 ,contents ,a report required under subparagraph 7,a7 shall include a written statement from the entity that delayed the notification explaining the need for the delay4 7,c7 ,form ,the report required under subparagraph 7,a7 shall be unclassified but may include a classified annex4 7#c7 ,renewal ,a delay under paragraph 7#a7 shall be for a period of #fj days and may be renewed4 7d7 ,update notification ,if an agency determines there is a significant change in the reasonable basis to conclude that a breach occurred1 a significant change to the determination made under subsection 7a77#a71 or that it is necessary to update the details of the information provided to potentially affected individuals as described in subsection 7b71 the agency shall as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after such a determination1 notify each individual who received a notification pursuant to subsection 7a7 of those changes4 7e7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ,director from issuing guidance relating to notifications or the head of an agency from notifying individuals potentially affected by breaches that are not determined to be major incidents2 or 7#b7 the ,director from issuing guidance relating to notifications of major incidents or the head of an agency from providing more information than described in subsection 7b7 when notifying individuals potentially affected by breaches4 #ceic4 ,congressional and executive branch reports 7a7 ,initial report 7#a7 ,in general ,not later than #gb hours after an agency has a reasonable basis to conclude that a major incident occurred1 the head of the agency impacted by the major incident shall submit to the appropriate reporting entities a written report4 ,within #g days of a major incident determination1 the head of the agency impacted shall coordinate with the ,national ,cyber ,director1 or their designee1 to provide a briefing1 along with any other ,federal entity determined appropriate by the ,national ,cyber ,director1 to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the appropriate authorization and appropriations committees of ,congress1 in the manner requested by the ,congressional entities1 taking into account-- 7,a7 the information known at the time of the report1 including the threat having likely caused the major incident2 7,b7 the sensitivity of the details associated with the major incident2 and 7,c7 the classification level of the information contained in the report4 7#b7 ,contents ,a report required under paragraph 7#a7 shall include1 in a manner that excludes or otherwise reasonably protects personally identifiable information and to the extent permitted by applicable law1 including privacy and statistical laws-- 7,a7 a summary of the information available about the major incident1 including how the major incident occurred and1 if applicable1 information relating to the major incident as a breach1 based on information available to agency officials as of the date on which the agency submits the report2 7,b7 if applicable1 whether any ransom has been demanded or paid1 or plans to be paid1 by any entity operating a ,federal information system or with access to a ,federal information system1 unless disclosure of such information may disrupt an active ,federal law enforcement or national security operation2 7,c7 if applicable1 a description and any associated documentation of any circumstances necessitating a delay in notification to individuals potentially affected by the major incident under subsection 7c7 of section #ceib2 and 7,d7 if applicable1 an assessment of the impacts to the agency1 the ,federal ,government1 or the security of the ,united ,states1 based on information available to agency officials on the date on which the agency submits the report4 7#c7 ,components of briefing ,the #g day briefing required under paragraph 7#a7-- 7,a7 shall1 to the greatest extent practicable1 include an unclassified component2 and 7,b7 may include a classified component4 7b7 ,supplemental report ,within a reasonable amount of time1 but not later than #cj days after the date on which an agency submits a written report under subsection 7a71 the head of the agency shall provide to the appropriate reporting entities written updates on the major incident and1 to the extent practicable1 provide a briefing to the congressional committees described in subsection 7a77#a71 including summaries of-- 7#a7 vulnerabilities1 means by which the major incident occurred1 and impacts to the agency relating to the major incident2 7#b7 any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred2 7#c7 an estimate of the number of individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 7#d7 an assessment of the risk of harm to individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 7#e7 an update to the assessment of the risk to agency operations1 or to impacts on other agency or non-,federal entity operations1 affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 and 7#f7 the detection1 response1 and remediation actions of the agency1 including any support provided by the ,cybersecurity and ,infrastructure ,security ,agency under section #ceid7;d7 and status updates on the notification process described in section #ceib7;a71 including any delay described in subsection 7c7 of section #ceib1 if applicable4 7c7 ,update report ,if the agency1 or the ,national ,cyber ,director1 determines that there is any significant change in the understanding of the agency of the scope1 scale1 or consequence of a major incident for which an agency submitted a written report under subsection 7a71 the agency shall provide an updated report to the appropriate reporting entities that includes information relating to the change in understanding4 7d7 ,biannual report ,each agency shall submit as part of the biannual report required under section #ceed7;c77#a7 of this title a description of each major incident that occurred during the #b-year period preceding the date on which the biannual report is submitted4 7e7 ,delay report 7#a7 ,in general ,the ,director shall submit to the appropriate reporting entities an annual report on all notification delays granted pursuant to subsection 7c7 of section #ceib4 7#b7 ,component of other report ,the ,director may submit the report required under paragraph 7#a7 as a component of the annual report submitted under section #ceig7;b74 7f7 ,report and briefing consistency ,in carrying out the duties under this section1 and to achieve consistent and understandable agency reporting to ,congress1 the ,national ,cyber ,director shall-- 7#a7 provide to agencies formatting guidelines and recommended contents of information to be included in the reports and briefings required under this section1 including recommendations for the use of plain language terminology and consistent formats for presenting any associated metrics2 and 7#b7 maintain a historical archive and major incident log of all reports and briefings provided under the requirements of this section1 which shall include at a minimum an archive of the full contents of any written report and associated documentation1 the reporting agency1 the date of submission1 and a list of the recipient ,congressional entities1 which shall be made available upon request to the ,congressional entities listed under subsection 7a77#a7 and may1 to the extent practicable1 utilize an internet accessible portal for appropriate ,congressional staff to directly access the log and archived materials required to be maintained under this paragraph4 7g7 ,report delivery ,any written report required to be submitted under this section may be submitted in a paper or electronic format4 7h7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ability of an agency to provide additional reports or briefings to ,congress2 or 7#b7 ,congress from requesting additional information from agencies through reports1 briefings1 or other means4 #ceid4 ,government information sharing and incident response 7a7 ,in general 7#a7 ,incident reporting ,subject to limitations in subsection 7b71 the head of each agency shall provide the information described in paragraph 7#b7 relating to an incident affecting the agency1 whether the information is obtained by the ,federal ,government directly or indirectly1 to the ,cybersecurity and ,infrastructure ,security ,agency1 the ,office of ,management and ,budget1 and the ,office of the ,national ,cyber ,director in a manner specified by the ,director under subsection 7b74 7#b7 ,contents ,a provision of information relating to an incident made by the head of an agency under paragraph 7#a7 shall-- 7,a7 include detailed information about the safeguards that were in place when the incident occurred2 7,b7 whether the agency implemented the safeguards described in subparagraph 7,a7 correctly2 7,c7 in order to protect against a similar incident1 identify-- 7i7 how the safeguards described in subparagraph 7,a7 should be implemented differently2 and 7ii7 additional necessary safeguards2 and 7,d7 include information to aid in incident response1 such as-- 7i7 a description of the affected systems or networks2 7ii7 the estimated dates of when the incident occurred2 and 7iii7 information that could reasonably help identify the party that conducted the incident1 as appropriate4 7#c7 ,information sharing ,to the greatest extent practicable1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 share information relating to an incident with any agencies that may be impacted by the incident1 or are potentially susceptible or similarly targeted1 as well as with appropriate ,federal law enforcement agencies to facilitate any necessary threat response activities as requested2 and 7,b7 coordinate1 in consultation with the ,national ,cyber ,director1 any necessary information sharing efforts related to a major incident with the private sector4 7#d7 ,national security systems ,each agency operating or exercising control of a national security system shall share information about incidents that occur on national security systems with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to the extent consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president4 7b7 ,compliance ,the information provided and method of reporting under subsection 7a7 shall take into account the level of classification of the information and any information sharing limitations and protections1 such as limitations and protections relating to law enforcement1 national security1 privacy1 statistical confidentiality1 or other factors determined by the ,director in order to implement subsection 7a77#a7 in a manner that enables automated and consistent reporting4 7c7 ,incident response ,each agency that has a reasonable basis to conclude that a major incident occurred involving ,federal information in electronic medium or form1 as defined by the ,director and not involving a national security system1 regardless of delays from notification granted for a major incident1 shall coordinate with the ,cybersecurity and ,infrastructure ,security ,agency to facilitate asset response activities and recommendations for mitigating future incidents1 and with appropriate ,federal law enforcement agencies to facilitate threat response activities1 consistent with relevant policies1 principles1 standards1 and guidelines on information security4 #ceie4 ,responsibilities of contractors and awardees 7a7 ,reporting 7#a7 ,in general ,unless otherwise specified in a contract1 grant1 cooperative agreement1 or any other transaction agreement1 any contractor or awardee of an agency shall report to the agency within the same amount of time such agency is required to report an incident to the ,cybersecurity and ,infrastructure ,security ,agency1 if the contractor or awardee has a reasonable basis to suspect or conclude that-- 7,a7 an incident or breach has occurred with respect to ,federal information collected1 used1 or maintained by the contractor or awardee in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee2 7,b7 an incident or breach has occurred with respect to a ,federal information system used or operated by the contractor or awardee in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee2 7,c7 a component of any ,federal information system1 or a system able to access1 store1 or process ,federal information1 contains a security vulnerability1 including a supply chain compromise or an identified software or hardware vulnerability2 or 7,d7 the contractor or awardee has received information from the agency that the contractor or awardee is not authorized to receive in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee4 7#b7 ,procedures 7,a7 ,major incident ,following a report of a breach or major incident by a contractor or awardee under paragraph 7#a71 the agency1 in consultation with the contractor or awardee1 shall carry out the requirements under sections #ceib1 #ceic1 and #ceid with respect to the major incident4 7,b7 ,incident ,following a report of an incident by a contractor or awardee under paragraph 7#a71 an agency1 in consultation with the contractor or awardee1 shall carry out the requirements under section #ceid with respect to the incident4 7b7 ,effective date ,this section shall apply on and after the date that is #a year after the date of the enactment of the ,federal ,information ,security ,modernization ,act of #bjbb and shall apply with respect to any contract entered into on or after such effective date4 #ceif4 ,training 7a7 ,covered individual defined ,in this section1 the term covered individual means an individual who obtains access to ,federal information or ,federal information systems because of the status of the individual as an employee1 contractor1 awardee1 volunteer1 or intern of an agency4 7b7 ,requirement ,the head of each agency shall develop training for covered individuals on how to identify and respond to an incident1 including-- 7#a7 the internal process of the agency for reporting an incident2 and 7#b7 the obligation of a covered individual to report to the agency a confirmed major incident and any suspected incident involving information in any medium or form1 including paper1 oral1 and electronic4 7c7 ,inclusion in annual training ,the training developed under subsection 7b7 may be included as part of an annual privacy or security awareness training of an agency4 #ceig4 ,analysis and report on ,federal incidents 7a7 ,analysis of ,federal incidents 7#a7 ,quantitative and qualitative analyses ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop1 in consultation with the ,director and the ,national ,cyber ,director1 and perform continuous monitoring and quantitative and qualitative analyses of incidents at agencies1 including major incidents1 including-- 7,a7 the causes of incidents1 including-- 7i7 attacker tactics1 techniques1 and procedures2 and 7ii7 system vulnerabilities1 including previously unknown zero day exploitations1 unpatched systems1 and information system misconfigurations2 7,b7 the scope and scale of incidents at agencies2 7,c7 common root causes of incidents across multiple agencies2 7,d7 agency incident response1 recovery1 and remediation actions and the effectiveness of those actions1 as applicable2 7,e7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,f7 trends across multiple ,federal agencies to address intrusion detection and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7#b7 ,automated analysis ,the analyses developed under paragraph 7#a7 shall1 to the greatest extent practicable1 use machine readable data1 automation1 and machine learning processes4 7#c7 ,sharing of data and analysis 7,a7 ,in general ,the ,director shall share on an ongoing basis the analyses required under this subsection with agencies and the ,national ,cyber ,director to-- 7i7 improve the understanding of cybersecurity risk of agencies2 and 7ii7 support the cybersecurity improvement efforts of agencies4 7,b7 ,format ,in carrying out subparagraph 7,a71 the ,director shall share the analyses-- 7i7 in human-readable written products2 and 7ii7 to the greatest extent practicable1 in machine-readable formats in order to enable automated intake and use by agencies4 7b7 ,annual report on ,federal incidents ,not later than #b years after the date of the enactment of this section1 and not less frequently than annually thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 the ,national ,cyber ,director1 and the heads of other agencies as appropriate1 shall submit to the appropriate reporting entities a report that includes-- 7#a7 a summary of causes of incidents from across the ,federal ,government that categorizes those incidents as incidents or major incidents2 7#b7 the quantitative and qualitative analyses of incidents developed under subsection 7a77#a7 on an agency-by-agency basis and comprehensively across the ,federal ,government1 including-- 7,a7 a specific analysis of breaches2 and 7,b7 an analysis of the ,federal ,government's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 and 7#c7 an annex for each agency that includes-- 7,a7 a description of each major incident2 and 7,b7 an analysis of the agency's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7c7 ,publication ,to the extent that publication is consistent with national security interests1 a version of each report submitted under subsection 7b7 shall be made publicly available on the website of the ,cybersecurity and ,infrastructure ,security ,agency during the year in which the report is submitted4 7d7 ,information provided by agencies 7#a7 ,in general ,the analysis required under subsection 7a7 and each report submitted under subsection 7b7 shall use information provided by agencies under section #ceid7;a74 7#b7 ,national security system reports 7,a7 ,in general ,annually1 the head of an agency that operates or exercises control of a national security system shall submit a report that includes the information described in subsection 7b7 with respect to the agency to the extent that the submission is consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president to-- 7i7 the majority and minority leaders of the ,senate2 7ii7 the ,speaker and minority leader of the ,house of ,representatives2 7iii7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7iv7 the ,select ,committee on ,intelligence of the ,senate2 7v7 the ,committee on ,armed ,services of the ,senate2 7vi7 the ,committee on ,appropriations of the ,senate2 7vii7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7viii7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7ix7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives2 7x7 the ,committee on ,armed ,services of the ,house of ,representatives2 and 7xi7 the ,committee on ,appropriations of the ,house of ,representatives4 7,b7 ,classified form ,a report required under subparagraph 7,a7 may be submitted in a classified form4 7e7 ,requirement for compiling information ,in publishing the public report required under subsection 7c71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall sufficiently compile information such that no specific incident of an agency can be identified1 except with the concurrence of the ,director of the ,office of ,management and ,budget1 the ,national ,cyber ,director1 and in consultation with the impacted agency4 #ceih4 ,major incident definition 7a7 ,in general ,not later than #ahj days after the date of the enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director1 shall develop and promulgate guidance on the definition of the term major incident for the purposes of subchapter ,,ii and this subchapter4 7b7 ,requirements ,with respect to the guidance issued under subsection 7a71 the definition of the term major incident shall-- 7#a7 include1 with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency1 any incident the head of the agency determines is likely to result in demonstrable harm to-- 7,a7 the national security interests1 foreign relations1 or the economy of the ,united ,states2 7,b7 the public confidence1 civil liberties1 or public health and safety of the people of the ,united ,states2 7,c7 the integrity of personally identifiable information1 including the exfiltration1 modification1 or deletion of such information2 or 7,d7 any other type of incident determined appropriate by the ,director2 and 7#b7 stipulate that the ,director1 in coordination with the ,national ,cyber ,director1 shall declare a major incident at each agency impacted by an incident if it is determined that an incident-- 7,a7 occurs at not less than #b agencies2 7,b7 is enabled by-- 7i7 a common technical root cause1 such as a supply chain compromise or a common software or hardware vulnerability2 or 7ii7 the related activities of a common threat actor2 or 7,c7 has a significant impact on the confidentiality1 integrity1 or availability of a high value asset4 7c7 ,evaluation and updates ,not later than #b years after the date of the enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 and not less frequently than every #b years thereafter1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives an evaluation1 which shall include-- 7#a7 an update1 if necessary1 to the guidance issued under subsection 7a72 7#b7 the definition of the term major incident included in the guidance issued under subsection 7a72 and 7#c7 an explanation of1 and the analysis that led to1 the definition described in paragraph 7#b74 4 7#b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,subchapter ,,iv--,,federal ,,system ,,incident ,,response #ceia4 ,definitions4 #ceib4 ,notification of breach4 #ceic4 ,congressional and executive branch reports4 #ceid4 ,government information sharing and incident response4 #ceie4 ,responsibilities of contractors and awardees4 #ceif4 ,training4 #ceig4 ,analysis and report on ,federal incidents4 #ceih4 ,major incident definition4 4 #ajb4 ,amendments to subtitle ,,iii of title #dj 7a7 ,modernizing government technology ,subtitle ,g of title ,x of ,division ,a of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjah 7,public ,law #aae-ia2 #dj ,u4,s4,c4 #aacja note7 is amended in section #ajgh-- 7#a7 by striking subsection 7a7 and inserting the following3 7a7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,high value asset ,the term high value asset has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 2 and 7#b7 in subsection 7c7-- 7,a7 in paragraph 7#b77;,a77i71 by inserting 1 including a consideration of the impact on high value assets after operational risks2 7,b7 in paragraph 7#e7-- 7i7 in subparagraph 7,a71 by striking and at the end2 7ii7 in subparagraph 7,b71 by striking the period at the end and inserting and2 and 7iii7 by adding at the end the following3 7,c7 a senior official from the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 appointed by the ,director4 2 and 7,c7 in paragraph 7#f77;,a71 by striking shall be-- and all that follows through #d employees and inserting shall be #d employees4 7b7 ,subchapter ,i ,subchapter ,i of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacjb-- 7,a7 in subsection 7b71 by striking use1 security1 and disposal of and inserting use1 and disposal of1 and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director1 promote and improve the security of12 7,b7 in subsection 7c77#c77;,b71 by adding at the end the following3 7iii7 ,the ,director may make available1 upon request1 to the ,national ,cyber ,director any cybersecurity funding information provided to the ,director under clause 7ii7 of this subparagraph4 2 7,c7 in subsection 7f71 by striking ,the ,director shall and inserting ,the ,director shall-- 7#a7 encourage the heads of the executive agencies to develop and use the best practices in the acquisition of information technology1 including supply chain risk management standards1 guidelines1 and practices developed by the ,national ,institute of ,standards and ,technology2 and 7#b7 consult with the ,federal ,chief ,information ,security ,officer appointed by the ,president under section #cfjg of title #dd1 for the development and use of risk management standards1 guidelines1 and practices developed by the ,national ,institute of ,standards and ,technology4 2 and 7,d7 in subsection 7h71 by inserting 1 including cybersecurity performances1 after the performances2 and 7#b7 in section #aacjc7;b71 in paragraph 7#b77;,b7-- 7,a7 in clause 7i71 by striking or at the end2 7,b7 in clause 7ii71 by adding or at the end2 and 7,c7 by adding at the end the following3 7iii7 whether the function should be performed by a shared service offered by another executive agency4 4 7c7 ,subchapter ,,ii ,subchapter ,,ii of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacab7;a71 by inserting 1 including security risks after managing the risks2 7#b7 in section #aacac7a71 by striking efficiency and effectiveness and inserting efficiency1 security1 and effectiveness2 7#c7 in section #aacae1 by adding at the end the following3 7d7 ,component agency chief information officers ,the ,chief ,information ,officer or an equivalent official of a component agency shall report to-- 7#a7 the ,chief ,information ,officer designated under section #cejf7;a77#b7 of title #dd or an equivalent official of the agency of which the component agency is a component2 and 7#b7 the head of the component agency4 2 7#d7 in section #aacag1 by inserting security1 before or schedule2 and 7#e7 in section #aacai7;b77#a71 in the paragraph heading1 by striking ,,cios and inserting ,chief ,information ,officers4 7d7 ,subchapter ,,iii ,section #aacca of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a71 by striking section #cecb7;b77#a7 and inserting section #ceeb7;b72 7#b7 in subsection 7b77#a77;,a71 by striking the ,secretary of ,homeland ,security and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7#c7 by adding at the end the following3 7e7 ,review of office of management and budget guidance and policy 7#a7 ,conduct of review 7,a7 ,in general ,not less frequently than once every #c years1 the ,director of the ,office of ,management and ,budget1 in consultation with1 as available1 the ,chief ,information ,officers ,council1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,comptroller ,general of the ,united ,states1 and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 shall review the efficacy of the guidance and policy promulgated by the ,director in reducing cybersecurity risks1 including an assessment of the requirements for agencies to report information to the ,director1 and determine whether any changes to that guidance or policy is appropriate4 7,b7 ,federal risk assessments ,in conducting the review described in subparagraph 7,a71 the ,director shall consider the ,federal risk assessments performed under section #ceec7;i7 of title #dd4 7,c7 ,requirements burden reduction and clarity ,in conducting the review described in subparagraph 7,a71 the ,director shall consider the cumulative reporting and compliance burden to agencies as well as the clarity of the requirements and deadlines contained in guidance and policy documents4 7#b7 ,updated guidance ,not later than #ij days after the date on which a review is completed under paragraph 7#a71 the ,director of the ,office of ,management and ,budget shall issue updated guidance or policy to agencies determined appropriate by the ,director1 based on the results of the review4 7#c7 ,congressional briefing ,not later than #fj days after the date on which a review is completed under paragraph 7#a71 the ,director is expected to provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the review and any newly issued guidance or policy1 which shall include-- 7,a7 an overview of the guidance and policy promulgated under this section that is currently in effect2 7,b7 the cybersecurity risk mitigation1 or other cybersecurity benefit1 offered by each guidance or policy document described in subparagraph 7,a72 and 7,c7 a summary of the guidance or policy to which changes were determined appropriate during the review and what the changes include4 7f7 ,automated standard implementation verification ,when the ,director of the ,national ,institute of ,standards and ,technology issues a proposed standard pursuant to paragraphs 7#b7 and 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 the ,director of the ,national ,institute of ,standards and ,technology shall consider developing and1 if appropriate and practical1 develop1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 specifications to enable the automated verification of the implementation of controls4 4 #ajc4 ,actions to enhance ,federal incident response 7a7 ,responsibilities of the cybersecurity and infrastructure security agency 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 develop a plan for the development of the analysis required under section #ceig7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act1 and the report required under subsection 7b7 of that section that includes-- 7i7 a description of any challenges the ,director anticipates encountering2 and 7ii7 the use of automation and machine-readable formats for collecting1 compiling1 monitoring1 and analyzing data2 and 7,b7 provide to the appropriate congressional committees a briefing on the plan developed under subparagraph 7,a74 7#b7 ,briefing ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a briefing on-- 7,a7 the execution of the plan required under paragraph 7#a77;,a72 and 7,b7 the development of the report required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7b7 ,responsibilities of the director of the office of management and budget 7#a7 ,,fisma ,section #b of the ,federal ,information ,security ,modernization ,act of #bjad 7,public ,law #aac-bhc2 #dd ,u4,s4,c4 #ceed note7 is amended-- 7,a7 by striking subsection 7b72 and 7,b7 by redesignating subsections 7c7 through 7f7 as subsections 7b7 through 7e71 respectively4 7#b7 ,in general ,the ,director shall develop guidance1 to be updated not less frequently than once every #b years1 on the content1 timeliness1 and format of the information provided by agencies under section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7#c7 ,guidance on responding to information requests ,not later than #a year after the date of the enactment of this ,act1 the ,director shall develop guidance for agencies to implement the requirement under section #ceid7;c7 of title #dd1 ,united ,states ,code1 as added by this ,act1 to provide information to other agencies experiencing incidents4 7#d7 ,standard guidance and templates ,not later than #a year after the date of the enactment of this ,act1 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop guidance and templates1 to be reviewed and1 if necessary1 updated not less frequently than once every #b years1 for use by ,federal agencies in the activities required under sections #ceib1 #ceic1 and #ceif of title #dd1 ,united ,states ,code1 as added by this ,act4 7#e7 ,contractor and awardee guidance 7,a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,director1 in coordination with the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 the ,administrator of ,general ,services1 and the heads of other agencies determined appropriate by the ,director1 shall issue guidance to ,federal agencies on how to deconflict1 to the greatest extent practicable1 existing regulations1 policies1 and procedures relating to the responsibilities of contractors and awardees established under section #ceie of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,existing processes ,to the greatest extent practicable1 the guidance issued under subparagraph 7,a7 shall allow contractors and awardees to use existing processes for notifying ,federal agencies of incidents involving information of the ,federal ,government4 7#f7 ,updated briefings ,not less frequently than once every #b years1 the ,director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs 7#b7 through 7#d74 7c7 ,update to the privacy act of #aigd ,section #eeb;a7b7 of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd7 is amended-- 7#a7 in paragraph 7#aa71 by striking or at the end2 7#b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 or2 and 7#c7 by adding at the end the following3 7#ac7 to another agency in furtherance of a response to an incident 7as defined in section #ceeb of title #dd7 and pursuant to the information sharing requirements in section #ceid of title #dd1 if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought4 4 #ajd4 ,additional guidance to agencies on ,,fisma updates ,not later than #a year after the date of the enactment of this ,act1 the ,director shall issue guidance for agencies on-- 7#a7 performing the ongoing and continuous agency system risk assessment required under section #ceed7;a77#a77;,a7 of title #dd1 ,united ,states ,code1 as amended by this ,act2 7#b7 implementing additional cybersecurity procedures1 which shall include resources for shared services2 7#c7 establishing a process for providing the status of each remedial action under section #ceed7;b77#g7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency using automation and machine-readable data1 as practicable1 which shall include-- 7,a7 specific guidance for the use of automation and machine-readable data2 and 7,b7 templates for providing the status of the remedial action2 7#d7 interpreting the definition of high value asset under section #ceeb of title #dd1 ,united ,states ,code1 as amended by this ,act2 and 7#e7 a requirement to coordinate with inspectors general of agencies to ensure consistent understanding and application of agency policies for the purpose of evaluations by inspectors general4 #aje4 ,agency requirements to notify private sector entities impacted by incidents 7a7 ,definitions ,in this section3 7#a7 ,reporting entity ,the term reporting entity means private organization or governmental unit that is required by statute or regulation to submit sensitive information to an agency4 7#b7 ,sensitive information ,the term sensitive information has the meaning given the term by the ,director in guidance issued under subsection 7b74 7b7 ,guidance on notification of reporting entities ,not later than #ahj days after the date of the enactment of this ,act1 the ,director shall issue guidance requiring the head of each agency to notify a reporting entity of an incident that is likely to substantially affect-- 7#a7 the confidentiality or integrity of sensitive information submitted by the reporting entity to the agency pursuant to a statutory or regulatory requirement2 or 7#b7 the agency information system or systems used in the transmission or storage of the sensitive information described in paragraph 7#a74 ,,ii ,,improving ,,federal ,,cybersecurity #bja4 ,mobile security standards 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,director shall-- 7#a7 evaluate mobile application security guidance promulgated by the ,director2 and 7#b7 issue guidance to secure mobile devices1 including for mobile applications1 for every agency4 7b7 ,contents ,the guidance issued under subsection 7a77#b7 shall include-- 7#a7 a requirement1 pursuant to section #cejf7;b77#d7 of title #dd1 ,united ,states ,code1 for every agency to maintain a continuous inventory of every-- 7,a7 mobile device operated by or on behalf of the agency2 and 7,b7 vulnerability identified by the agency associated with a mobile device2 and 7#b7 a requirement for every agency to perform continuous evaluation of the vulnerabilities described in paragraph 7#a77;,b7 and other risks associated with the use of applications on mobile devices4 7c7 ,information sharing ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies for sharing the inventory of the agency required under subsection 7b77#a7 with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable4 7d7 ,briefing ,not later than #fj days after the date on which the ,director issues guidance under subsection 7a77#b71 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall provide to the appropriate congressional committees a briefing on the guidance4 #bjb4 ,data and logging retention for incident response 7a7 ,recommendations ,not later than #b years after the date of the enactment of this ,act1 and not less frequently than every #b years thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,attorney ,general1 shall submit to the ,director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency4 7b7 ,contents ,the recommendations provided under subsection 7a7 shall include-- 7#a7 the types of logs to be maintained2 7#b7 the duration that logs and other relevant data should be retained2 7#c7 the time periods for agency implementation of recommended logging and security requirements2 7#d7 how to ensure the confidentiality1 integrity1 and availability of logs2 7#e7 requirements to ensure that1 upon request1 in a manner that excludes or otherwise reasonably protects personally identifiable information1 and to the extent permitted by applicable law 7including privacy and statistical laws71 agencies provide logs to-- 7,a7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency for a cybersecurity purpose2 and 7,b7 the ,director of the ,federal ,bureau of ,investigation1 or the appropriate ,federal law enforcement agency1 to investigate potential criminal activity2 and 7#f7 requirements to ensure that1 subject to compliance with statistical laws and other relevant data protection requirements1 the highest level security operations center of each agency has visibility into all agency logs4 7c7 ,guidance ,not later than #ij days after receiving the recommendations submitted under subsection 7a71 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,attorney ,general1 shall1 as determined to be appropriate by the ,director1 update guidance to agencies regarding requirements for logging1 log retention1 log management1 sharing of log data with other appropriate agencies1 or any other logging activity determined to be appropriate by the ,director4 7d7 ,sunset ,this section will cease to be in effect on the date that is #aj years after the date of the enactment of this ,act4 #bjc4 ,federal penetration testing policy 7a7 ,in general ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceei;,a4 ,federal penetration testing 7a7 ,guidance 7#a7 ,in general ,the ,director shall1 in consultation with the ,secretary of the ,department of ,homeland ,security acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 issue guidance to agencies that-- 7,a7 requires agencies to use1 when and where appropriate1 penetration testing on agency systems by both ,federal and non-,federal entities1 with a focus on high value assets2 7,b7 provides policies governing agency development of an operational plan1 rules of engagement for utilizing penetration testing1 and procedures to utilize the results of penetration testing to improve the cybersecurity and risk management of the agency2 and 7,c7 establishes a program under the ,cybersecurity and ,infrastructure ,security ,agency to ensure that penetration testing is being performed appropriately by agencies and to provide operational support or a shared service4 7b7 ,responsibilities of ,,omb ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall-- 7#a7 not less frequently than annually1 inventory all ,federal penetration testing assets2 and 7#b7 develop and maintain a standardized process for the use of penetration testing4 7c7 ,exception for national security systems ,the guidance issued under subsection 7a7 shall not apply to national security systems4 7d7 ,delegation of authority for certain systems ,the authorities of the ,director described in subsection 7a7 shall be delegated-- 7#a7 to the ,secretary of ,defense in the case of systems described in section #ceec7;e77#b72 and 7#b7 to the ,director of ,national ,intelligence in the case of systems described in #ceec7;e77#c74 4 7b7 ,deadline for guidance ,not later than #ahj days after the date of the enactment of this ,act1 the ,director shall issue the guidance required under section #ceei;,a7a7 of title #dd1 ,united ,states ,code1 as added by subsection 7a74 7c7 ,sunset ,this section shall sunset on the date that is #aj years after the date of the enactment of this ,act4 7d7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei the following3 #ceei;,a4 ,federal penetration testing4 4 7e7 ,penetration testing by the secretary of homeland security ,section #ceec7;b7 of title #dd1 ,united ,states ,code1 as amended by section #eaba1 is further amended-- 7#a7 in paragraph 7#h77;,b71 by striking and at the end2 7#b7 by redesignating paragraph 7#i7 as paragraph 7#aj72 and 7#c7 by inserting after paragraph 7#h7 the following3 7#i7 performing penetration testing to identify vulnerabilities within ,federal information systems2 and 4 #bjd4 ,ongoing threat hunting program 7a7 ,threat hunting program 7#a7 ,in general ,not later than #edj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall1 in accordance with the authorities granted the ,secretary under sections #ceec7;b77#g7-7h7 and #ceec7m7 of title #dd1 ,united ,states ,code 7as redesignated by this ,act71 establish a program to provide ongoing1 hypothesis-driven threat-hunting services on the network of each agency4 7#b7 ,plan ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish the program required under paragraph 7#a7 that describes how the ,director of the ,cybersecurity and ,infrastructure ,security ,agency plans to-- 7,a7 determine the method for collecting1 storing1 accessing1 analyzing1 and safeguarding appropriate agency data2 7,b7 provide on-premises support to agencies2 7,c7 staff threat hunting services2 7,d7 allocate available human and financial resources to implement the plan2 and 7,e7 provide input to the heads of agencies on the use of-- 7i7 more stringent standards under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code2 and 7ii7 additional cybersecurity procedures under section #ceed of title #dd1 ,united ,states ,code4 7b7 ,reports ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall submit to the appropriate congressional committees-- 7#a7 not later than #cj days after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency completes the plan required under subsection 7a77#b71 a report on the plan to provide threat hunting services to agencies2 7#b7 not less than #cj days before the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services under the program under subsection 7a77#a71 a report providing any updates to the plan developed under subsection 7a77#b72 and 7#c7 not later than #a year after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services to agencies other than the ,cybersecurity and ,infrastructure ,security ,agency1 a report describing lessons learned from providing those services4 #bje4 ,codifying vulnerability disclosure programs 7a7 ,in general ,subchapter ,,ii of ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by inserting after section #ceei;,a1 as added by section #bjd1 the following3 #ceei;,b4 ,federal vulnerability disclosure programs 7a7 ,definitions ,in this section3 7#a7 ,report ,the term report means a vulnerability disclosure made to an agency by a reporter4 7#b7 ,reporter ,the term reporter means an individual that submits a vulnerability report pursuant to the vulnerability disclosure process of an agency4 7b7 ,responsibilities of ,,omb 7#a7 ,limitation on legal action ,the ,director of the ,office of ,management and ,budget1 in consultation with the ,attorney ,general1 shall issue guidance to agencies to not recommend or pursue legal action against a reporter or an individual that conducts a security research activity that the head of the agency determines-- 7,a7 represents a good faith effort to follow the vulnerability disclosure policy of the agency developed under subsection 7d77#b72 and 7,b7 is authorized under the vulnerability disclosure policy of the agency developed under subsection 7d77#b74 7#b7 ,sharing information with ,,cisa ,the ,director of the ,office of ,management and ,budget1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with the ,national ,cyber ,director1 shall issue guidance to agencies on sharing relevant information in a consistent1 automated1 and machine readable manner with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 including-- 7,a7 any valid or credible reports of newly discovered or not publicly known vulnerabilities 7including misconfigurations7 on ,federal information systems that use commercial software or services2 7,b7 information relating to vulnerability disclosure1 coordination1 or remediation activities of an agency1 particularly as those activities relate to outside organizations-- 7i7 with which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security ,agency can assist2 or 7ii7 about which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security ,agency should know2 and 7,c7 any other information with respect to which the head of the agency determines helpful or necessary to involve the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#c7 ,agency vulnerability disclosure policies ,the ,director shall issue guidance to agencies on the required minimum scope of agency systems covered by the vulnerability disclosure policy of an agency required under subsection 7d77#b74 7c7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide support to agencies with respect to the implementation of the requirements of this section2 7#b7 develop tools1 processes1 and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section2 and 7#c7 upon a request by an agency1 assist the agency in the disclosure to vendors of newly identified vulnerabilities in vendor products and services4 7d7 ,responsibilities of agencies 7#a7 ,public information ,the head of each agency shall make publicly available1 with respect to each internet domain under the control of the agency that is not a national security system-- 7,a7 an appropriate security contact2 and 7,b7 the component of the agency that is responsible for the internet accessible services offered at the domain4 7#b7 ,vulnerability disclosure policy ,the head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency1 which shall-- 7,a7 describe-- 7i7 the scope of the systems of the agency included in the vulnerability disclosure policy2 7ii7 the type of information system testing that is authorized by the agency2 7iii7 the type of information system testing that is not authorized by the agency2 and 7iv7 the disclosure policy of the agency for sensitive information2 7,b7 with respect to a report to an agency1 describe-- 7i7 how the reporter should submit the report2 and 7ii7 if the report is not anonymous1 when the reporter should anticipate an acknowledgment of receipt of the report by the agency2 7,c7 include any other relevant information2 and 7,d7 be mature in scope1 covering all internet accessible ,federal information systems used or operated by that agency or on behalf of that agency4 7#c7 ,identified vulnerabilities ,the head of each agency shall incorporate any vulnerabilities reported under paragraph 7#b7 into the vulnerability management process of the agency in order to track and remediate the vulnerability4 7e7 ,congressional reporting ,not later than #ij days after the date of the enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 and annually thereafter for a #c-year period1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the status of the use of vulnerability disclosure policies under this section at agencies1 including1 with respect to the guidance issued under subsection 7b77#c71 an identification of the agencies that are compliant and not compliant4 7f7 ,exemptions ,the authorities and functions of the ,director and ,director of the ,cybersecurity and ,infrastructure ,security ,agency under this section shall not apply to national security systems4 7g7 ,delegation of authority for certain systems ,the authorities of the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency described in this section shall be delegated-- 7#a7 to the ,secretary of ,defense in the case of systems described in section #ceec7;e77#b72 and 7#b7 to the ,director of ,national ,intelligence in the case of systems described in section #ceec7;e77#c74 4 7b7 ,sunset ,this section shall sunset on the date that is #aj years after the date of the enactment of this ,act4 7c7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei;,a1 as added by this ,act1 the following3 #ceei;,b4 ,federal vulnerability disclosure programs4 4 #bjf4 ,implementing zero trust architecture 7a7 ,guidance ,the ,director shall maintain guidance on the adoption of zero trust architecture and not later than #b years after the date of the enactment of this ,act1 provide an update to the appropriate congressional committees on progress in increasing the internal defenses of agency systems through such adoption across the government1 including-- 7#a7 shifting away from trusted networks to implement security controls based on a presumption of compromise2 7#b7 implementing principles of least privilege in administering information security programs2 7#c7 limiting the ability of entities that cause incidents to move laterally through or between agency systems2 7#d7 identifying incidents quickly2 7#e7 isolating and removing unauthorized entities from agency systems as quickly as practicable1 accounting for intelligence or law enforcement purposes2 7#f7 otherwise increasing the resource costs for entities that cause incidents to be successful2 and 7#g7 a summary of the agency progress reports required under subsection 7b74 7b7 ,agency progress reports ,not later than #bgj days after the date of the enactment of this ,act1 the head of each agency shall submit to the ,director a progress report on implementing an information security program based on a zero trust architecture1 which shall include-- 7#a7 a description of any steps the agency has completed1 including progress toward achieving any requirements issued by the ,director1 including the adoption of any models or reference architecture2 7#b7 an identification of activities that have not yet been completed and that would have the most immediate security impact2 and 7#c7 a schedule to implement any planned activities4 #bjg4 ,,gao automation report ,not later than #b years after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall perform a study on the use of automation and machine-readable data across the ,federal ,government for cybersecurity purposes1 including the automated updating of cybersecurity tools1 sensors1 or processes employed by agencies under paragraphs 7#a71 7#e77;,c71 and 7#h77;,b7 of section #ceed7;b7 of title #dd1 ,united ,states ,code4 #bjh4 ,extension of ,federal ,acquisition ,security ,council 7a7 ,extension ,section #acbh of title #da1 ,united ,states ,code1 is amended by striking the date that and all that follows and inserting ,december #ca1 #bjbf4 7b7 ,designation ,section #acbb7;c77#a7 of title #da1 ,united ,states ,code1 is amended by striking ,not later than and all that follows through the end of the paragraph and inserting the following3 ,the ,director of ,,omb shall designate the ,federal ,chief ,information ,security ,officer appointed by the ,president under section #cfjg of title #dd1 or an equivalent senior-level official from the ,office of ,management and ,budget if the position is vacant1 to serve as the ,chairperson of the ,council44 7c7 ,requirement ,subsection #acbf7;b7 of title #da1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#e71 by striking 2 and and inserting a semicolon2 7#b7 by redesignating paragraph 7#f7 as paragraph 7#g72 and 7#c7 by inserting after paragraph 7#e7 the following new paragraph3 7#f7 maintaining an up-to-date and accurate inventory of software in use by the agency and1 when available1 the components of such software1 including any available ,software ,bills of ,materials1 as applicable1 that can be communicated when requested to the ,federal ,acquisition ,security ,council1 the ,national ,cybersecurity ,director1 or the ,secretary of ,homeland ,security acting through the ,director of ,cybersecurity and ,infrastructure ,security ,agency4 4 #bji4 ,federal chief information security officer 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by inserting at the end3 #cfjg4 ,federal chief information security officer 7a7 ,establishment ,there is established in the ,office of the ,federal ,chief ,information ,officer of the ,office of ,management and ,budget a ,federal ,chief ,information ,security ,officer1 who shall be appointed by the ,president4 7b7 ,duties ,the ,federal ,chief ,information ,security ,officer shall report to the ,federal ,chief ,information ,officer1 and assist the ,chief ,information ,officer in carrying out-- 7#a7 all functions under this chapter2 7#b7 all functions assigned to the ,director under title ,,ii of the ,e-,government ,act of #bjjb2 7#c7 other electronic government initiatives1 consistent with other statutes2 7#d7 assisting the ,director with carrying out budget formation duties under subtitle ,,ii of title #ca as it pertains to the information technology1 operations1 and workforce resources of ,federal agencies to fulfill cybersecurity responsibilities under section #ceed1 and the duties of the ,department of ,homeland ,security duties designated under section #ceec2 and 7#e7 other initiatives determined by the ,chief ,information ,officer4 7c7 ,additional ,duties ,the ,federal ,chief ,information ,security ,officer shall work with the ,chief ,information ,officer to oversee implementation of electronic ,government under the ,e-,government ,act of #bjjb1 and other relevant statutes1 in a manner consistent with law1 relating to-- 7#a7 cybersecurity strategy1 policy1 and operations1 including the performance of the duties of the ,director under subchapter ,,ii of chapter #ce2 7#b7 the development of enterprise architectures2 7#c7 information security2 7#d7 privacy2 7#e7 access to1 dissemination of1 and preservation of ,government information2 and 7#f7 other areas of electronic ,government as determined by the ,administrator4 7d7 ,assistance ,the ,federal ,chief ,information ,security ,officer shall assist the ,administrator in the performance of electronic ,government functions as described in section #cfjb7;f74 4 7b7 ,deputy ,national ,cyber ,director ,section #ageb of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj2 #acd ,stat4 #dadd7 is amended by adding at the end the following new subsection3 7d7 ,deputy ,director ,there shall be a ,deputy ,national ,cyber ,director for ,agency ,strategy1 ,capabilities1 and ,budget1 who shall be the ,federal ,chief ,information ,security ,officer appointed by the ,president under section #cfjg of title #dd1 ,united ,states ,code1 and shall report to the ,director and assist the office in carrying out the following duties as it applies to the protection of ,federal information systems by the agencies-- 7#a7 the preparation and oversight over the implementation of national cyber policy and strategy under subsection 7c77#a77;,c77i72 7#b7 the formation and issuance of recommendations to agencies on resource allocations and policies under subsection 7c77#a77;,c77ii72 7#c7 reviewing annual budget proposals and making related recommendations under subsection 7c77#a77;,c77iii72 7#d7 the functions1 as determined necessary1 of the ,national ,cyber ,director under subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code2 and 7#e7 other initiatives determined by the ,director1 or to be necessary to coordinate with the ,office by the ,federal ,chief ,information ,officer4 4 7c7 ,clerical amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #cfjf the following3 #cfjg4 ,federal chief information security officer4 4 #baj4 ,extension of ,chief ,data ,officer ,council ,section #bebj;,a7e77#b7 of title #dd1 ,united ,states ,code1 is amended by striking upon the expiration of the #b-year period that begins on the date the ,comptroller ,general submits the report under paragraph 7#a7 to ,congress and inserting ,january #ca1 #bjcj4 #baa4 ,council of the inspectors general on integrity and efficiency dashboard ,section #aa7;e77#b7 of the ,inspector ,general ,act of #aigh 7#e ,u4,s4,c4 ,app47 is amended-- 7#a7 in subparagraph 7,a71 by striking and at the end2 7#b7 by redesignating subparagraph 7,b7 as subparagraph 7,c72 and 7#c7 by inserting after subparagraph 7,a7 the following3 7,b7 that shall include a dashboard of open information security recommendations identified in the independent evaluations required by section #ceee7;a7 of title #dd1 ,united ,states ,code2 and 4 #bab4 ,quantitative cybersecurity metrics 7a7 ,definition of covered metrics ,in this section1 the term covered metrics means the metrics established1 reviewed1 and updated under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7b7 ,updating and establishing metrics ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director and consulting with the ,director of the ,national ,institute of ,standards and ,technology1 shall-- 7#a7 evaluate any covered metrics established as of the date of the enactment of this ,act2 and 7#b7 as appropriate and pursuant to section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c77-- 7,a7 update the covered metrics2 and 7,b7 establish new covered metrics4 7c7 ,implementation 7#a7 ,in general ,not later than #edj days after the date of the enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall promulgate guidance that requires each agency to use covered metrics to track trends in the cybersecurity and incident response capabilities of the agency4 7#b7 ,performance demonstration ,the guidance issued under paragraph 7#a7 and any subsequent guidance shall require agencies to share with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency data demonstrating the performance of the agency using the covered metrics included in the guidance4 7#c7 ,penetration tests ,on not less than #b occasions during the #b-year period following the date on which guidance is promulgated under paragraph 7#a71 the ,director shall ensure that not less than #c agencies are subjected to substantially similar penetration tests1 as determined by the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in order to validate the utility of the covered metrics4 7#d7 ,analysis capacity ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a capability that allows for the analysis of the covered metrics1 including cross-agency performance of agency cybersecurity and incident response capability trends4 7d7 ,congressional reports 7#a7 ,utility of metrics ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall submit to the appropriate congressional committees a report on the utility of the covered metrics4 7#b7 ,use of metrics ,not later than #ahj days after the date on which the ,director promulgates guidance under subsection 7c77#a71 the ,director shall submit to the appropriate congressional committees a report on the results of the use of the covered metrics by agencies4 7e7 ,federal ,cybersecurity ,enhancement ,act of #bjae updates ,the ,federal ,cybersecurity ,enhancement ,act of #bjae 7#f ,u4,s4,c4 #aeba et seq47 is amended-- 7#a7 in section #bbb7c77;,b71 by inserting and the ,committee on ,oversight and ,reform before of the ,house of ,representatives2 and 7#b7 in section #bbd-- 7,a7 by amending subsection 7c7 to read as follows3 7c7 ,improved metrics ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall establish1 review1 and update metrics to measure the cybersecurity and incident response capabilities of agencies in accordance with the responsibilities of agencies under section #ceed of title #dd1 ,united ,states ,code4 2 7,b7 by striking subsection 7e72 and 7,c7 by redesignating subsection 7f7 as subsection 7e74 ,,iii ,,pilot ,,programs ,,to ,,enhance ,,federal ,,cybersecurity #cja4 ,risk-based budget pilot 7a7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate2 and 7,b7 the ,committee on ,homeland ,security1 the ,committee on ,oversight and ,reform1 and the ,committee on ,appropriations of the ,house of ,representatives4 7#b7 ,information technology ,the term information technology-- 7,a7 has the meaning given the term in section #aaaja of title #dj1 ,united ,states ,code2 and 7,b7 includes the hardware and software systems of a ,federal agency that monitor and control physical equipment and processes of the ,federal agency4 7#c7 ,risk-based budget ,the term risk-based budget means a budget-- 7,a7 developed by identifying and prioritizing cybersecurity risks and vulnerabilities1 including impact on agency operations in the case of a cyber attack1 through analysis of cyber threat intelligence1 incident data1 and tactics1 techniques1 procedures1 and capabilities of cyber threats2 and 7,b7 that allocates resources based on the risks identified and prioritized under subparagraph 7,a74 7b7 ,establishment of risk-,based budget pilot 7#a7 ,in general 7,a7 ,model ,not later than #a year after the first publication of the budget submitted by the ,president under section #aaje of title #ca1 ,united ,states ,code1 following the date of the enactment of this ,act1 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director and in coordination with the ,director of the ,national ,institute of ,standards and ,technology1 shall conduct a pilot for creating a risk-based budget for cybersecurity spending4 7,b7 ,contents of pilot ,the pilot required to be developed under this paragraph shall-- 7i7 consider ,federal and non-,federal cyber threat intelligence products1 where available1 to identify threats1 vulnerabilities1 and risks2 7ii7 consider the impact on agency operations of incidents1 including the interconnectivity to other agency systems and the operations of other agencies2 7iii7 indicate where resources should be allocated to have the greatest impact on mitigating current and future threats and current and future cybersecurity capabilities2 7iv7 be used to inform acquisition and sustainment of-- 7,i7 information technology and cybersecurity tools2 7,,ii7 information technology and cybersecurity architectures2 7,,iii7 information technology and cybersecurity personnel2 and 7,,iv7 cybersecurity and information technology concepts of operations2 and 7v7 be used to evaluate and inform government-wide cybersecurity programs of the ,department of ,homeland ,security4 7#b7 ,reports ,not later than #b years after the first publication of the budget submitted by the ,president under section #aaje of title #ca1 ,united ,states ,code1 following the date of the enactment of this ,act1 the ,director shall submit a report to ,congress on the implementation of the pilot for risk-based budgeting for cybersecurity spending1 an assessment of agency implementation1 and an evaluation of whether the risk-based budget helps to mitigate cybersecurity vulnerabilities4 7#c7 ,,gao report ,not later than #c years after the date on which the first budget of the ,president is submitted to ,congress containing the validation required under section #aaje7;a77#ce77;,a77i77,v7 of title #ca1 ,united ,states ,code1 as amended by subsection 7c71 the ,comptroller ,general of the ,united ,states shall submit to the appropriate congressional committees a report that includes-- 7,a7 an evaluation of the success of pilot agencies in implementing risk-based budgets2 7,b7 an evaluation of whether the risk-based budgets developed by pilot agencies are effective at informing ,federal ,government-wide cybersecurity programs2 and 7,c7 any other information relating to risk-based budgets the ,comptroller ,general determines appropriate4 #cjb4 ,active cyber defensive study 7a7 ,definition ,in this section1 the term active defense technique has the meaning given in guidance issued by the ,director1 in coordination with the ,attorney ,general4 7b7 ,study ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director and the ,national ,cyber ,director1 shall perform a study on the use of active defense techniques to enhance the security of agencies1 which shall include-- 7#a7 a review of legal restrictions on the use of different active cyber defense techniques in ,federal environments1 in consultation with the ,attorney ,general2 7#b7 an evaluation of-- 7,a7 the efficacy of a selection of active defense techniques determined by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,b7 factors that impact the efficacy of the active defense techniques evaluated under subparagraph 7,a72 7#c7 recommendations on safeguards and procedures that shall be established to require that active defense techniques are adequately coordinated to ensure that active defense techniques do not impede agency operations and mission delivery1 threat response efforts1 criminal investigations1 and national security activities1 including intelligence collection2 and 7#d7 the development of a framework for the use of different active defense techniques by agencies4 #cjc4 ,security operations center as a service pilot 7a7 ,purpose ,the purpose of this section is for the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to run a security operation center on behalf of the head of another agency1 alleviating the need to duplicate this function at every agency1 and empowering a greater centralized cybersecurity capability4 7b7 ,plan ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish a centralized ,federal security operations center shared service offering within the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,contents ,the plan required under subsection 7b7 shall include considerations for-- 7#a7 collecting1 organizing1 and analyzing agency information system data in real time2 7#b7 staffing and resources2 and 7#c7 appropriate interagency agreements1 concepts of operations1 and governance plans4 7d7 ,pilot program 7#a7 ,in general ,not later than #ahj days after the date on which the plan required under subsection 7b7 is developed1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director of the ,office of ,management and ,budget1 shall enter into a #a-year agreement with not less than #b agencies to offer a security operations center as a shared service4 7#b7 ,additional agreements ,after the date on which the briefing required under subsection 7e77#a7 is provided1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director of the ,office of ,management and ,budget1 may enter into additional #a-year agreements described in paragraph 7#a7 with agencies4 7e7 ,briefing and report 7#a7 ,briefing ,not later than #bgj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to appropriate congressional committees a briefing on the parameters of any #a-year agreements entered into under subsection 7d77#a74 7#b7 ,report ,not later than #ij days after the date on which the first #a-year agreement entered into under subsection 7d7 expires1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to appropriate congressional committees a report on-- 7,a7 the agreement2 and 7,b7 any additional agreements entered into with agencies under subsection 7d74 #cjd4 ,endpoint detection and response as a service pilot 7a7 ,purpose ,the ,cybersecurity and ,infrastructure ,security ,agency is directed to establish and conduct a pilot to determine the feasibility1 value1 and efficacy of providing endpoint detection and response capabilities as a shared service to ,federal agencies to reduce costs1 enhance interoperability1 and continuously detect and mitigate threat activity on ,federal networks4 7b7 ,plan ,not later than #ij days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish a centralized endpoint detection and response shared service offering within the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,contents ,the plan required under subsection 7b7 shall include considerations for-- 7#a7 understanding and assessing the full extent of endpoints across the ,federal civilian environment2 7#b7 maximizing the value of existing agency investments in endpoint detection and response tools and services2 7#c7 aggregating the available contract vehicles and options that provide agencies with appropriate capability for their environment and architecture2 7#d7 equipping all endpoints and services of pilot agencies with endpoint detection and response programs2 7#e7 aggregating network1 cloud1 and endpoint data from both within the agency and across agencies to provide enterprise-wide monitoring of the network to detect abnormal network behavior and automate defensive capabilities2 and 7#f7 appropriate interagency agreements1 concepts of operations1 and governance plans4 7d7 ,pilot program 7#a7 ,in general ,not later than #ahj days after the date on which the plan required under subsection 7b7 is developed1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall enter into a #a-year agreement with not less than #b agencies to offer endpoint detection and response as a shared service4 7#b7 ,additional agreements ,after the date on which the briefing required under subsection 7e77#a7 is provided1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 may enter into additional #a-year agreements described in paragraph 7#a7 with agencies4 7e7 ,briefing and report 7#a7 ,briefing ,not later than #bgj days after the date of the enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the parameters of any #a-year agreements entered into under subsection 7d77#a74 7#b7 ,report ,not later than #ij days after the date on which the first #a-year agreement entered into under subsection 7d7 expires1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report on-- 7,a7 the agreement2 and 7,b7 any additional agreements entered into with agencies under subsection 7d74