,i  #aagth ,,congress  #b;d ,session    
,h4 ,r4 #hdjc  ,,in ,,the ,,house ,,of  
,,representatives  ,july #ae1 #bjbb,mr4 
,swalwell introduced the following bill2
 which was referred to the ,committee on
 ,oversight and ,reform1 and in addition
 to the ,committee on ,armed ,services1 
for a period to be subsequently         
determined by the ,speaker1 in each case
 for consideration of such provisions as
 fall within the jurisdiction of the    
committee concerned  ,a ,,bill  ,to     
encourage and improve ,federal proactive
 cybersecurity initiatives1 and for     
other purposes4  #a4 ,short title2 table
 of contents  7a7 ,short title ,this    
,act may be cited as the ,proactive     
,cyber ,initiatives ,act of #bjbb4  7b7 
,table of contents ,the table of        
contents for this ,act is as follows3   
,sec4 #a4 ,short title2 table of        
contents4,sec4 #b4 ,definitions4,sec4   
#c4 ,increasing proactive cybersecurity 
initiatives4,sec4 #d4 ,strengthening    
,office of ,national ,cyber             

,director4,sec4 #e4 ,penetration testing
 reports4,sec4 #f4 ,report on active    
defense techniques4,sec4 #g4 ,study on  
innovative uses of proactive            
cybersecurity initiatives4  #b4         
,definitions ,in this ,act3 7#a7 ,active
 defense technique ,the term active     
defense technique means an action taken 
on an information system of an agency to
 increase the security of such system   
against an attacker1 including-- 7,a7   
the use of a deception technology or    
other purposeful feeding of false or    
misleading information to an attacker   
accessing such system2 and  7,b7        
proportional action taken in response to
 an unlawful breach4  7#b7 ,agency ,the 
term agency means any ,government       
corporation1 ,government-controlled     
corporation1 or other establishment of  
the executive branch of the ,government 
7including the ,executive ,office of the
 ,president71 or any independent        
regulatory agency1 but does not include 
the following3 7,a7 ,the ,government    

,accountability ,office4  7,b7 ,the     
,federal ,election ,commission4  7,c7   
,the governments of the ,district of    
,columbia and of the territories and    
possessions of the ,united ,states1 and 
their various subdivisions4  7,d7       
,government-owned contractor-operated   
facilities1 including laboratories      
engaged in national defense research and
 production activities4  7#c7           
,continuous monitoring ,the term        
continuous monitoring means continuous  
experimentation conducted by an agency  
on an information system of such agency 
to evaluate the resilience of such      
system against a malicious attack or    
condition that could compromise such    
system for the purpose of improving     
design1 resilience1 or incident response
 with respect to such system4  7#d7     
,deception technology ,the term         
deception technology means an isolated  
digital environment1 system1 or platform
 containing a replication of an active  
information system with realistic data  

flows used to attract1 mislead1 or      
observe an attacker4  7#e7 ,department  
,the term department means the          
following3 7,a7 ,the ,department of     
,state4  7,b7 ,the ,department of the   
,treasury4  7,c7 ,the ,department of    
,defense4  7,d7 ,the ,department of     
,justice4  7,e7 ,the ,department of the 
,interior4  7,f7 ,the ,department of    
,agriculture4  7,g7 ,the ,department of 
,commerce4  7,h7 ,the ,department of    
,labor4  7,i7 ,the ,department of       
,health and ,human ,services4  7,j7 ,the
 ,department of ,housing and ,urban     
,development4  7,k7 ,the ,department of 
,transportation4  7,l7 ,the ,department 
of ,energy4  7,m7 ,the ,department of   
,education4  7,n7 ,the ,department of   
,veterans ,affairs4  7,o7 ,the          
,department of ,homeland ,security4     
7#f7 ,director ,the term ,director means
 the ,director of the ,cybersecurity and
 ,infrastructure ,security ,agency of   
the ,department of ,homeland ,security4 
7#g7 ,information system ,the term      

information system has the meaning given
 the term in section #cejb of title #dd1
 ,united ,states ,code4  7#h7 ,national 
laboratory ,the term national laboratory
 has the meaning given the term in      
section #b of the ,energy ,policy ,act  
of #bjje 7#db ,u4,s4,c4 #aehja74  7#i7  
,penetration test2 penetration testing  
,the terms penetration test and         
penetration testing mean an assessment  
conducted on an information system of an
 agency that emulates an attack or other
 exploitation capability to identify and
 test vulnerabilities that could be     
exploited4  7#aj7 ,rules of engagement  
,the term rules of engagement means a   
set of rules established by an agency   
for use during penetration testing4  #c4
 ,increasing proactive cybersecurity    
initiatives  7a7 ,penetration testing   
7#a7 ,in general ,the head of each      
department or agency shall carry out the
 following3 7,a7 ,conduct regular       
penetration testing on the information  
systems 7as described in paragraph 7#b77

 of such department or agency4  7,b7    
,provide to the ,director1 the ,national
 ,cyber ,director1 and the ,director of 
the ,office of ,management and ,budget a
 report on the results of such testing1 
including-- 7i7 an identification of any
 risks discovered2 and  7ii7 a          
description of how cybersecurity at such
 department or agency may be improved4  
7#b7 ,information systems described ,for
 purposes of paragraph 7#a77;,a71 an    
information system of an agency to be   
tested is one described as moderate- or 
high-impact in the document titled ,risk
 ,management ,framework for ,information
 ,systems and ,organizations3 ,a ,system
 ,life ,cycle ,approach for ,security   
and ,privacy 7,national ,institute of   
,standards and ,technology ,special     
,publication #hjj-cg1 ,revision #b2     
,december #bjah7 or in a successor      
document4  7b7 ,guidance ,not later than
 one year after the date of the         
enactment of this ,act1 the ,director1  
in consultation with the ,secretary of  

,defense1 the ,national ,cyber          
,director1 the ,director of ,national   
,intelligence1 the ,secretary of        
,homeland ,security1 and the head of any
 other department or agency the         
,director determines appropriate1 shall 
issue guidance to facilitate the        
implementation of subsection 7a71 which 
shall include the following3 7#a7       
,information regarding how departments  
and agencies are to utilize independent 
penetration testing carried out by      
another department or agency1 a national
 laboratory1 or a private entity4  7#b7 
,recommendations regarding how best to  
utilize1 within the budget of an agency1
 penetration testing1 including         
independent penetration testing4  7#c7  
,recommendations for minimum rules of   
engagement4  7c7 ,report  7#a7 ,in      
general ,not later than one year after  
the date of the enactment of this ,act1 
the ,director shall submit to the       
appropriate congressional committees a  
report that includes the following3 7,a7

 ,an analysis of whether increased      
engagement is needed from national      
laboratories and the private sector to  
assist with the protection of the       
information systems of agencies through 
the use of the following3 7i7 ,active   
defense techniques4  7ii7 ,deception    
technologies4  7iii7 ,penetration       
testing4  7,b7 ,an analysis of the      
feasibility and benefits of             
consolidating within the ,cybersecurity 
and ,infrastructure ,security ,agency of
 the ,department of ,homeland ,security 
proactive cybersecurity initiatives4    
7,c7 ,an analysis of whether the        
,director requires additional           
authorities or resources to carry out   
proactive cybersecurity initiatives for 
agencies4  7#b7 ,appropriate            
congressional committees defined ,in    
this subsection1 the term appropriate   
congressional committees means-- 7,a7   
with respect to the ,house of           
,representatives-- 7i7 the ,committee on
 ,appropriations2  7ii7 the ,committee  

on ,armed ,services2  7iii7 the         
,committee on ,homeland ,security2  7iv7
 the ,committee on the ,judiciary2  7v7 
the ,committee on ,oversight and        
,reform2 and  7vi7 the ,permanent       
,select ,committee on ,intelligence2 and
  7,b7 with respect to the ,senate-- 7i7
 the ,committee on ,appropriations2     
7ii7 the ,committee on ,armed ,services2
  7iii7 the ,committee on ,homeland     
,security and ,governmental ,affairs2   
7iv7 the ,committee on the ,judiciary2  
and  7v7 the ,select ,committee on      
,intelligence4  #d4 ,strengthening the  
,office of the ,national ,cyber         
,director  7a7 ,deconfliction ,section  
#ageb7;c77#a77;,d7 of the ,william ,m4  
7,mac7 ,thornberry ,national ,defense   
,authorization ,act for ,fiscal ,year   
#bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,d77 
is amended-- 7#a7 in clause 7iii71 by   
striking and at the end2  7#b7 in clause
 7iv71 by inserting and at the end2 and 
7#c7 by adding at the end the following3
  7v7 deconflicting overlapping         

jurisdiction between agencies regarding 
cybersecurity activities and authority  
to mitigate risks2  4  7b7 ,information 
sharing ,section #ageb7;c77#a7 of the   
,william ,m4 7,mac7 ,thornberry         
,national ,defense ,authorization ,act  
for ,fiscal ,year #bjba 7#f ,u4,s4,c4   
#aejj7;c77#a77 is amended-- 7#a7 in     
subparagraph 7,c77vi71 by inserting the 
,secretary of ,homeland ,security1 the  
,director of the ,office of ,management 
and ,budget1 after the ,assistant to the
 ,president for ,national ,security     
,affairs12 and  7#b7 in subparagraph    
7,g71 by inserting the ,secretary of    
,homeland ,security1 the ,director of   
the ,office of ,management and ,budget1 
and after annually report to4  #e4      
,penetration testing reports  7a7       
,cybersecurity and ,infrastructure      
,security ,agency  7#a7 ,aggregation of 
penetration testing results ,not later  
than one year after the date of the     
enactment of this ,act and annually     
thereafter1 the ,director shall         

aggregate and review the results of the 
penetration testing provided to the     
,director under section #c7;a77#a77;,b74
  7#b7 ,interagency reports ,not later  
than #ahj days after each review under  
paragraph 7#a71 the ,director1 based on 
such review1 shall provide to each      
agency a report containing the          
following3 7,a7 ,a summary of the       
results of such review1 including an    
identification of risks and other       
results common across agencies4  7,b7   
,an assessment1 based on the document   
entitled ,risk ,management ,framework   
for ,information ,systems and           
,organizations3 ,a ,system ,life ,cycle 
,approach for ,security and ,privacy    
7,national ,institute of ,standards and 
,technology ,special ,publication       
#hjj-cg1 ,revision #b2 ,december #bjah7 
or a successor document1 of the severity
 of risks identified under subparagraph 
7,a74  7,c7 ,an analysis of the duration
 of time that such risks have existed4  
7,d7 ,recommendations for mitigating    

such risks1 which prioritize risks      
assessed as the highest severity        
pursuant to subparagraph 7,b74  7#c7    
,congressional report ,not later than   
#ahj days after each report provided    
under paragraph 7#b71 the ,director     
shall submit to ,congress a report that 
contains-- 7,a7 a summary of the report 
provided under such paragraph2 and  7,b7
 recommendations for legislative action 
relating to the matters referred to in  
such paragraph4  7b7 ,government        
,accountability ,office ,not later than 
#ahj days after the date of the         
enactment of this ,act1 the ,comptroller
 ,general of the ,united ,states shall  
submit to ,congress a report on         
penetration testing1 which shall include
 the following3 7#a7 ,an identification 
of which departments or agencies are    
obligating and expending funds on       
penetration testing and how such funds  
are being used1 including whether such  
funds are being used on independent     
penetration testing4  7#b7              

,recommendations for legislative action 
regarding additional authority or       
resources needed by departments or      
agencies to conduct penetration testing 
more effectively1 including with respect
 to independent penetration testing4    
#f4 ,report on active defense techniques
  7a7 ,report ,not later than #ah months
 after the date of the enactment of this
 ,act1 the ,director1 in consultation   
with the ,national ,cyber ,director and 
representatives of appropriate private  
sector entities1 shall submit to the    
appropriate congressional committees a  
report regarding active defense         
techniques4  7b7 ,contents ,the report  
described in subsection 7a7 shall       
include the following3 7#a7 ,an         
assessment of the effectiveness of      
active defense techniques to protect the
 information systems of departments or  
agencies4  7#b7 ,recommendations        
regarding how such techniques can be    
better utilized to protect such systems1
 including best practices with respect  

to such techniques4  7#c7 ,an analysis  
of whether there are legislative1       
regulatory1 or resource burdens that    
prevent such techniques from being      
effectively utilized1 including the     
resources necessary to implement such   
techniques4  7#d7 ,an identification of 
resources necessary to carry out the    
recommendations under paragraph 7#b74   
7#e7 ,an identification of other        
techniques that should be evaluated to  
protect such systems4  7c7 ,appropriate 
congressional committees defined ,in    
this subsection1 the term appropriate   
congressional committees means-- 7#a7   
with respect to the ,house of           
,representatives-- 7,a7 the ,committee  
on ,appropriations2  7,b7 the ,committee
 on ,armed ,services2  7,c7 the         
,committee on ,homeland ,security2  7,d7
 the ,committee on the ,judiciary2  7,e7
 the ,committee on ,oversight and       
,reform2 and  7,f7 the ,permanent       
,select ,committee on ,intelligence2 and
  7#b7 with respect to the ,senate--    

7,a7 the ,committee on ,appropriations2 
7,b7 the ,committee on ,armed ,services2
  7,c7 the ,committee on ,homeland      
,security and ,governmental ,affairs2   
7,d7 the ,committee on the ,judiciary2  
and  7,e7 the ,select ,committee on     
,intelligence4  #g4 ,study on innovative
 uses of proactive cybersecurity        
initiatives  7a7 ,study ,the ,secretary 
of ,defense1 in consultation with the   
,director of ,national ,intelligence1   
the ,secretary of ,homeland ,security1  
the ,attorney ,general1 and the head of 
any other department or agency the      
,director determines appropriate1 shall 
conduct a study on innovative uses of   
proactive cybersecurity initiatives1    
including the following3 7#a7 ,the use  
of deception technologies4  7#b7 ,the   
use of continuous monitoring to generate
 evidence regarding how an information  
system-- 7,a7 operates under normal or  
intended use2 and  7,b7 behaves under a 
variety of adverse conditions or        
scenarios4  7#c7 ,the feasibility of    

department or agency adoption of a set  
of continuous monitoring procedures4    
7b7 ,reports  7#a7 ,classified report   
,not later than two years after the date
 of the enactment of this ,act1 the     
,secretary of ,defense shall submit to  
the ,permanent ,select ,committee on    
,intelligence of the ,house of          
,representatives and the ,select        
,committee on ,intelligence of the      
,senate a classified report describing  
the results of the study required under 
subsection 7a71 including examples of   
any successes against attackers who     
unlawfully breached an information      
system of a department or agency4  7#b7 
,unclassified report ,not later than two
 years after the date of the enactment  
of this ,act1 the ,secretary shall      
submit to the appropriate congressional 
committees an unclassified report       
describing the results of the study     
required under subsection 7a71 including
 legislative recommendations relating   
thereto4  7c7 ,appropriate congressional

 committees defined ,in this section1   
the term appropriate congressional      
committees means-- 7#a7 with respect to 
the ,house of ,representatives-- 7,a7   
the ,committee on ,armed ,services2     
7,b7 the ,committee on ,homeland        
,security2  7,c7 the ,committee on the  
,judiciary2  7,d7 the ,committee on     
,oversight and ,reform2 and  7,e7 the   
,permanent ,select ,committee on        
,intelligence2 and  7#b7 with respect to
 the ,senate-- 7,a7 the ,committee on   
,armed ,services2  7,b7 the ,committee  
on ,homeland ,security and ,governmental
 ,affairs2  7,c7 the ,committee on the  
,judiciary2 and  7,d7 the ,select       
,committee on ,intelligence4