,,ii #aagth ,,congress #ast ,session ,s4 #bijb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bi1 #bjba,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to modernize ,federal information security management1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,information ,security ,modernization ,act of #bjba4 #b4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4,sec4 #b4 ,table of contents4,sec4 #c4 ,definitions4,,title ,i--,updates to ,f,i,s,m,a,sec4 #aja4 ,title #dd amendments4,sec4 #ajb4 ,amendments to subtitle ,,iii of title #dj4,sec4 #ajc4 ,actions to enhance ,federal incident response4,sec4 #ajd4 ,additional guidance to agencies on ,,fisma updates4,sec4 #aje4 ,agency requirements to notify entities impacted by incidents4,,title ,,ii--,improving ,federal cybersecurity,sec4 #bja4 ,evaluation of effectiveness of standards4,sec4 #bjb4 ,mobile security standards4,sec4 #bjc4 ,quantitative cybersecurity metrics4,sec4 #bjd4 ,data and logging retention for incident response4,sec4 #bje4 ,,cisa agency advisors4,sec4 #bjf4 ,federal penetration testing policy4,sec4 #bjg4 ,ongoing threat hunting program4,sec4 #bjh4 ,codifying vulnerability disclosure programs4,sec4 #bji4 ,implementing presumption of compromise and zero trust architectures4,sec4 #baj4 ,automation reports4,sec4 #baa4 ,extension of ,federal ,acquisition ,security ,council4,,title ,,iii--,pilot programs to enhance ,federal cybersecurity,sec4 #cja4 ,continuous independent ,,fisma evaluation pilot4,sec4 #cjb4 ,active cyber defensive pilot4,sec4 #cjc4 ,security operations center as a service pilot4 #c4 ,definitions ,in this ,act1 unless otherwise specified3 7#a7 ,additional cybersecurity procedure ,the term additional cybersecurity procedure has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7#b7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#c7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 and 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#d7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#e7 ,incident ,the term incident has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#f7 ,penetration test ,the term penetration test has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7#g7 ,threat hunting ,the term threat hunting means proactively and iteratively searching for threats to systems that evade detection by automated threat detection systems4 7#h7 ,verification specification ,the term verification specification means a specification developed under section #aacca7;f7 of title #dj1 ,united ,states ,code1 as amended by this ,act4 ,i ,updates to ,,fisma #aja4 ,title #dd amendments 7a7 ,subchapter ,i amendments ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #cejd-- 7,a7 in subsection 7a77#a77;,b77v71 by striking confidentiality1 security1 disclosure1 and sharing of information and inserting disclosure1 sharing of information1 and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 confidentiality and security2 7,b7 in subsection 7b77#b77;,b71 by inserting in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency after standards for security2 7,c7 in subsection 7g71 by striking paragraph 7#a7 and inserting the following3 7#a7 with respect to information collected or maintained by or for agencies-- 7,a7 develop and oversee the implementation of policies1 principles1 standards1 and guidelines on privacy1 disclosure1 and sharing of the information2 and 7,b7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 develop and oversee policies1 principles1 standards1 and guidelines on confidentiality and security of the information2 and 2 and 7,d7 in subsection 7h77#a7-- 7i7 in the matter preceding subparagraph 7,a7-- 7,i7 by inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 before the ,director2 and 7,,ii7 by inserting a comma before and the ,administrator2 and 7ii7 in subparagraph 7,a71 by inserting security and after information technology2 7#b7 in section #ceje-- 7,a7 in paragraph 7#c7 of the first subsection designated as subsection 7c7-- 7i7 in subparagraph 7,b7-- 7,i7 by inserting and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency after ,comptroller ,general2 and 7,,ii7 by striking and at the end2 7ii7 in subparagraph 7,c77v71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 maintained on a continual basis through the use of automation1 machine-readable data1 and scanning4 2 and 7,b7 by striking the second subsection designated as subsection 7c72 7#c7 in section #cejf-- 7,a7 in subsection 7b7-- 7i7 in paragraph 7#a77;,c71 by inserting 1 availability after integrity2 and 7ii7 in paragraph 7#d71 by inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 after ,general ,services12 and 7,b7 in subsection 7h77#c71 by inserting security1 after efficiency12 7#d7 in section #ceac-- 7,a7 in subsection 7a71 by inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 before the ,administrator of ,general ,services2 7,b7 by redesignating subsection 7c7 as subsection 7d72 and 7,c7 by inserting after subsection 7b7 the following3 7c7 ,each agency providing a written plan under subsection 7b7 shall provide any portion of the written plan addressing information security or cybersecurity to the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 2 and 7#e7 in section #cebj;,a7b7-- 7,a7 in paragraph 7#a71 by striking 1 protection2 7,b7 by redesignating paragraphs 7#b71 7#c71 7#d71 and 7#e7 as paragraphs 7#c71 7#d71 7#e71 and 7#f71 respectively2 and 7,c7 by inserting after paragraph 7#a7 the following3 7#b7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 establish ,governmentwide best practices for the protection of data2 4 7b7 ,suchapter ,,ii definitions 7#a7 ,in general ,section #ceeb7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by redesignating paragraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 and 7#g7 as paragraphs 7#b71 7#c71 7#d71 7#e71 7#f71 7#i71 and 7#aa71 respectively2 7,b7 by inserting before paragraph 7#b71 as so redesignated1 the following3 7#a7 ,the term additional cybersecurity procedure means a process1 procedure1 or other activity that is established in excess of the information security standards promulgated under section #aacca7;b7 of title #dj to increase the security and reduce the cybersecurity risk of agency systems1 such as continuous threat hunting1 increased network segmentation1 endpoint detection and response1 or persistent penetration testing4 2 7,c7 by inserting after paragraph 7#f71 as so redesignated1 the following3 7#g7 ,the term high value asset means information or an information system that the head of an agency determines so critical to the agency that the loss or corruption of the information or the loss of access to the information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business4 7#h7 ,the term major incident has the meaning given the term in guidance issued by the ,director under section #ceih7;a74 2 7,d7 by inserting after paragraph 7#i71 as so redesignated1 the following3 7#aj7 ,the term penetration test means a specialized type of assessment that-- 7,a7 is conducted on an information system or a component of an information system2 and 7,b7 emulates an attack or other exploitation capability of a potential adversary1 typically under specific constraints1 in order to identify any vulnerabilities of an information system or a component of an information system that could be exploited4 2 and 7,e7 by inserting after paragraph 7#aa71 as so redesignated1 the following3 7#ab7 ,the term shared service means a business or mission function that is provided for use by multiple organizations within or between agencies4 7#ac7 ,the term verification specification means a specification developed under section #aacca7;f7 of title #dj4 4 7#b7 ,conforming amendments 7,a7 ,homeland ,security ,act of #bjjb ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is amended by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f77;,a7 and inserting section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,c7 ,high-,performance ,computing ,act of #aiia ,section #bjg7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is amended by striking section #ceeb7;b77#f77;,a77i7 and inserting section #ceeb7;b77#i77;,a77i74 7,d7 ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj ,section #c7e7 of the ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,e7 ,national ,defense ,authorization ,act for ,fiscal ,year #bjac ,section #icc7;e77#a77;,b7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7#aj ,u4,s4,c4 #bbbd note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa ,the ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa 7,public ,law #aaa-chc7 is amended-- 7i7 in section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by striking section #cedb7;b7 and inserting section #ceeb7;b72 7ii7 in section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b72 and 7iii7 in section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,g7 ,e-,government ,act of #bjjb ,section #cja7;c77#a77;,a7 of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,h7 ,national ,institute of ,standards and ,technology ,act ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7i7 in subsection 7a77#b71 by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b72 and 7ii7 in subsection 7f7-- 7,i7 in paragraph 7#c71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7,,ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b74 7c7 ,subchapter ,,ii amendments ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceea-- 7,a7 by redesignating paragraphs 7#c71 7#d71 7#e71 and 7#f7 as paragraphs 7#d71 7#e71 7#f71 and 7#g71 respectively2 7,b7 by inserting after paragraph 7#b7 the following3 7#c7 recognize the role of the ,cybersecurity and ,infrastructure ,security ,agency as the lead cybersecurity entity for operational coordination across the ,federal ,government2 2 7,c7 in paragraph 7#e71 as so redesignated1 by striking diagnose and improve and inserting integrate1 deliver1 diagnose1 and improve2 7,d7 in paragraph 7#f71 as so redesignated1 by striking and at the end2 and 7,e7 by adding at the end the following3 7#h7 recognize that each agency has specific mission requirements and1 at times1 unique cybersecurity requirements to meet the mission of the agency2 7#i7 recognize that each agency does not have the same resources to secure agency systems1 and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone2 and 7#aj7 recognize that-- 7,a7 a holistic ,federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies2 and 7,b7 in accounting for the differences described in subparagraph 7,a7 and ensuring overall ,federal cybersecurity-- 7i7 the ,office of ,management and ,budget is the leader for policy development and oversight of ,federal cybersecurity2 7ii7 the ,cybersecurity and ,infrastructure ,security ,agency is the leader for implementing operations at agencies2 and 7iii7 the ,national ,cyber ,director is responsible for developing the overall cybersecurity strategy of the ,united ,states and advising the ,president on matters relating to cybersecurity4 2 7#b7 in section #ceec1 as amended by section #agje of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7,public ,law #aaf-bhc7-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a7-- 7,i7 by striking developing and and inserting in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency12 and 7,,ii7 by inserting and associated verification specifications before promulgated2 and 7ii7 in paragraph 7#e71 by inserting 1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 before agency compliance2 7,b7 in subsection 7b7-- 7i7 by striking the subsection heading and inserting ,cybersecurity and ,infrastructure ,security ,agency2 7ii7 in the matter preceding paragraph 7#a71 by striking the ,secretary and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7iii7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting and reporting requirements under subchapter ,,iv of this title after section #ceef2 and 7,,ii7 in subparagraph 7,d71 by striking the ,director or ,secretary and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7iv7 in paragraph 7#e71 by striking coordinating and inserting leading the coordination of2 7v7 in paragraph 7#f7-- 7,i7 in the matter preceding subparagraph 7,a71 by inserting and verifications specifications before promulgated under2 7,,ii7 in subparagraph 7,c71 by striking and at the end2 7,,iii7 in subparagraph 7,d71 by adding and at the end2 and 7,,iv7 by adding at the end the following3 7,e7 taking any other action that the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director-- 7i7 may determine necessary2 and 7ii7 is authorized to perform2 2 7vi7 in paragraph 7#h71 by striking the ,secretary's discretion and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency's discretion2 and 7vii7 in paragraph 7#i71 by striking as the ,director or the ,secretary1 in consultation with the ,director1 and inserting as the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,c7 in subsection 7c7-- 7i7 in paragraph 7#d71 by striking and at the end2 7ii7 by redesignating paragraph 7#e7 as paragraph 7#g72 and 7iii7 by inserting after paragraph 7#d7 the following3 7#e7 an assessment of agency use of automated verification of standards for the standards promulgated under section #aacca of title #dj using verification specifications2 7#f7 a summary of each assessment of ,federal risk posture performed under subsection 7i72 and 2 7,d7 in subsection 7f77#b77;,b71 by striking conflict with and inserting reduce the security posture of agencies established under2 7,e7 by redesignating subsections 7i71 7j71 7k71 and 7l7 as subsections 7j71 7k71 7l71 and 7m7 respectively2 7,f7 by inserting after subsection 7h7 the following3 7i7 ,federal risk assessments ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall perform1 on an ongoing and continuous basis1 assessments of ,federal risk posture using any available information on the cybersecurity posture of agencies1 including-- 7#a7 the status of agency cybersecurity remedial actions described in section #ceed7;b77#g72 7#b7 any vulnerability information relating to the systems of an agency that is known by the agency2 7#c7 analysis of incident information under section #ceig2 7#d7 evaluation of penetration testing performed under section #ceei;,a2 7#e7 evaluation of vulnerability disclosure program information under section #ceei;,b2 7#f7 evaluation of agency threat hunting results2 7#g7 evaluation of ,federal and non-,federal threat intelligence2 7#h7 data on compliance with standards issued under section #aacca of title #dj that1 when appropriate1 uses verification specifications2 7#i7 agency system risk assessments performed under section #ceed7;a77#a77;,a72 and 7#aj7 any other information the ,secretary determines relevant4 2 and 7,g7 in subsection 7j71 as so redesignated-- 7i7 by striking regarding the specific and inserting 8that includes a summary of-- 7#a7 the specific 2 7ii7 in paragraph 7#a71 as so designated1 by striking the period at the end and inserting 2 and and 7iii7 by adding at the end the following3 7#b7 the trends identified in the ,federal risk assessment performed under subsection 7i74 2 7#c7 in section #ceed-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a7-- 7,i7 by redesignating subparagraphs 7,a71 7,b71 and 7,c7 as subparagraphs 7,b71 7,c71 and 7,d71 respectively2 7,,ii7 by inserting before subparagraph 7,b71 as so redesignated1 the following3 7,a7 performing1 not less frequently than once every #b years or based on a significant change to system architecture or security posture1 an agency system risk assessment that-- 7i7 identifies and documents the high value assets of the agency using guidance from the ,director2 7ii7 evaluates the data assets inventoried under section #ceaa of title #dd for sensitivity to compromises in confidentiality1 integrity1 and availability2 7iii7 identifies agency systems that have access to or hold the data assets inventoried under section #ceaa of title #dd2 7iv7 evaluates the threats facing agency systems and data1 including high value assets1 based on ,federal and non-,federal cyber threat intelligence products1 where available2 7v7 evaluates the vulnerability of agency systems and data1 including high value assets1 based on-- 7,i7 the results of penetration testing performed by the ,department of ,homeland ,security under section #ceec7;b77#i72 7,,ii7 the results of penetration testing performed under section #ceei;,a2 7,,iii7 information provided to the agency through the vulnerability disclosure program of the agency under section #ceei;,b2 7,,iv7 incidents2 and 7,v7 any other vulnerability information relating to agency systems that is known to the agency2 7vi7 assesses the impacts of potential agency incidents to agency systems1 data1 and operations based on the evaluations described in clauses 7ii7 and 7iv7 and the agency systems identified under clause 7iii72 and 7vii7 assesses the consequences of potential incidents occurring on agency systems that would impact systems at other agencies1 including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system2 2 7,,iii7 in subparagraph 7,b71 as so redesignated-- 7aa7 in the matter preceding clause 7i71 by striking providing information and inserting using information from the assessment conducted under subparagraph 7,a71 providing1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 information2 7bb7 in clause 7i71 by striking and at the end2 7cc7 in clause 7ii71 by adding and at the end2 and 7dd7 by adding at the end the following3 7iii7 in consultation with the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 information or information systems used by agencies through shared services1 memoranda of understanding1 or other agreements2 2 7,,iv7 in subparagraph 7,c71 as so redesignated-- 7aa7 in clause 7ii7 by inserting binding before operational2 and 7bb7 in clause 7vi71 by striking and at the end2 and 7,v7 by adding at the end the following3 7,e7 not later than #cj days after the date on which an agency system risk assessment is performed under subparagraph 7,a71 providing the assessment to-- 7i7 the ,director2 7ii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7iii7 the ,national ,cyber ,director2 7,f7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and not less frequently than annually1 performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of1 or under the supervision of1 the agency1 which shall-- 7i7 be completed considering the agency system risk assessment performed under subparagraph 7,a72 and 7ii7 include a specific evaluation for high value assets2 and 7,g7 not later than #cj days after completing the evaluation performed under subparagraph 7,f71 providing the evaluation and an implementation plan for using additional cybersecurity procedures determined to be appropriate to-- 7i7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7ii7 the ,director2 and 7iii7 the ,national ,cyber ,director4 2 7ii7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting in accordance with the agency system risk assessment performed under paragraph 7#a77;,a7 after information systems2 7,,ii7 in subparagraph 7,b7-- 7aa7 by striking in accordance with standards and inserting 8in accordance with-- 7i7 standards 2 and 7bb7 by adding at the end the following3 7ii7 the evaluation performed under paragraph 7#a77;,f72 and 7iii7 the implementation plan described in paragraph 7#a77;,g72 2 and 7,,iii7 in subparagraph 7,d71 by inserting 1 through the use of penetration testing1 the vulnerability disclosure program established under section #ceei;,b1 and other means1 after periodically2 7iii7 in paragraph 7#c7-- 7,i7 in subparagraph 7,b71 by inserting 1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 after maintaining2 7,,ii7 in subparagraph 7,d71 by striking and at the end2 7,,iii7 in subparagraph 7,e71 by adding and at the end2 and 7,,iv7 by adding at the end the following3 7,f7 implementing mechanisms for using verification specifications1 or alternate verification specifications validated by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 to automatically verify the implementation of standards of agency systems promulgated under section #aacca of title #dj or any additional cybersecurity procedures1 as applicable2 2 and 7iv7 in paragraph 7#e71 by inserting and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency before on the effectiveness2 7,b7 in subsection 7b7-- 7i7 by striking paragraph 7#a7 and inserting the following3 7#a7 pursuant to subsection 7a77#a77;,a71 performing an agency system risk assessment1 which shall include using automated tools consistent with standards1 verification specifications1 and guidelines promulgated under section #aacca of title #dj1 as applicable2 2 7ii7 in paragraph 7#b77;,d7-- 7,i7 by redesignating clauses 7iii7 and 7iv7 as clauses 7iv7 and 7v71 respectively2 7,,ii7 by inserting after clause 7ii7 the following3 7iii7 binding operational directives and emergency directives promulgated by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency under section #ceec of title #dd2 2 and 7,,iii7 in clause 7iv71 as so redesignated1 by striking as determined by the agency2 and and inserting 8as determined by the agency-- 7,i7 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,,ii7 in consideration of-- 7aa7 the agency risk assessment performed under subsection 7a77#a77;,a72 and 7bb7 the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section #aacca7;c77#a7 of title #dj2 and 2 7iii7 in paragraph 7#e7-- 7,i7 in subparagraph 7,a71 by inserting 1 including penetration testing1 as appropriate1 after shall include testing2 and 7,,ii7 in subparagraph 7,c71 by inserting 1 verification specifications1 after with standards2 7iv7 in paragraph 7#f71 by striking planning1 implementing1 evaluating1 and documenting and inserting planning and implementing and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 evaluating and documenting2 7v7 by redesignating paragraphs 7#g7 and 7#h7 as paragraphs 7#i7 and 7#aj71 respectively2 7vi7 by inserting after paragraph 7#f7 the following3 7#g7 a process for providing the status of every remedial action and known system vulnerability to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable2 7#h7 a process for providing the verification of the implementation of standards promulgated under section #aacca of title #dj using verification specifications1 automation1 and machine-readable data1 to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 2 and 7vii7 in paragraph 7#i77;,c71 as so redesignated-- 7,i7 by striking clause 7ii7 and inserting the following3 7ii7 notifying and consulting with the ,federal information security incident center established under section #ceef pursuant to the requirements of section #ceid2 2 7,,ii7 by redesignating clause 7iii7 as clause 7iv72 7,,iii7 by inserting after clause 7ii7 the following3 7iii7 performing the notifications and other activities required under subchapter ,,iv of this title2 and 2 and 7,,iv7 in clause 7iv71 as so redesignated-- 7aa7 in subclause 7,i71 by striking and relevant ,offices of ,inspector ,general2 7bb7 in subclause 7,,ii71 by adding and at the end2 7cc7 by striking subclause 7,,iii72 and 7dd7 by redesignating subclause 7,,iv7 as subclause 7,,iii72 7,c7 in subsection 7c7-- 7i7 in paragraph 7#a7-- 7,i7 in subparagraph 7,a7-- 7aa7 in the matter preceding clause 7i71 by striking on the adequacy and effectiveness of information security policies1 procedures1 and practices1 including and inserting that includes2 and 7bb7 in clause 7ii71 by inserting unless the ,director issues a waiver to the agency under subparagraph 7,b77iii71 before the total number2 and 7,,ii7 by striking subparagraph 7,b7 and inserting the following3 7,b7 ,incident reporting waiver 7i7 ,certification of agency information sharing ,if the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 determines that an agency shares any information relating to any incident pursuant to section #ceid7;a71 the ,director shall certify that the agency is in compliance with that section4 7ii7 ,certification of issuing report ,if the ,director determines that the ,director of the ,cybersecurity and ,infrastructure ,security ,agency uses the information described in clause 7i7 with respect to a particular agency to submit to ,congress an annex required under section #ceig7;c77#c7 for that agency1 the ,director shall certify that the ,cybersecurity and ,infrastructure ,security ,agency is in compliance with that section with respect to that agency4 7iii7 ,waiver ,the ,director may waive the reporting requirement with respect to the information required to be included in the report under subparagraph 7,a77ii7 for a particular agency if-- 7,i7 the ,director has issued a certification for the agency under clause 7i72 and 7,,ii7 the ,director has issued a certification with respect to the annex of the agency under clause 7ii74 7iv7 ,revocation of waiver or certifications 7,i7 ,waiver ,if1 at any time1 the ,director determines that the ,director of the ,cybersecurity and ,infrastructure ,security ,agency cannot submit to ,congress an annex for a particular agency under section #ceig7;c77#c7-- 7aa7 any waiver previously issued under clause 7iii7 with respect to that agency shall be considered void2 and 7bb7 the ,director shall revoke the certification for the annex of that agency under clause 7ii74 7,,ii7 ,certifications ,if1 at any time1 the ,director determines that an agency has not provided to the ,director of the ,cybersecurity and ,infrastructure ,security ,agency the totality of incident information required under section #ceid7;a7-- 7aa7 any waiver previously issued under clause 7iii7 with respect to that agency shall be considered void2 and 7bb7 the ,director shall revoke the certification for that agency under clause 7i74 7,,iii7 ,reissuance ,if the ,director revokes a waiver under this clause1 the ,director may issue a subsequent waiver if the ,director issues new certifications under clauses 7i7 and 7ii74 2 7ii7 by redesignating paragraphs 7#b7 through 7#e7 as paragraphs 7#d7 through 7#g71 respectively2 and 7iii7 by inserting after paragraph 7#a7 the following3 7#b7 ,biannual report ,not later than #ahj days after the date on which an agency completes an agency system risk assessment under subsection 7a77#a77;,a7 and not less frequently than every #b years1 each agency shall submit to the ,director1 the ,secretary1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 the appropriate authorization and appropriations committees of ,congress1 the ,national ,cyber ,director1 and the ,comptroller ,general of the ,united ,states a report that-- 7,a7 summarizes the agency system risk assessment performed under subsection 7a77#a77;,a72 7,b7 evaluates the adequacy and effectiveness of information security policies1 procedures1 and practices of the agency to address the risks identified in the system risk assessment performed under subsection 7a77#a77;,a72 and 7,c7 summarizes the evaluations and implementation plans described in subparagraphs 7,f7 and 7,g7 of subsection 7a77#a7 and whether those evaluations and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency4 7#c7 ,unclassified reports ,each report submitted under paragraphs 7#a7 and 7#b7-- 7,a7 shall be1 to the greatest extent practicable1 in an unclassified and otherwise uncontrolled form2 and 7,b7 may include a classified annex4 2 and 7,d7 in subsection 7d77#a71 in the matter preceding subparagraph 7,a71 by inserting and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency after the ,director2 7#d7 in section #ceee-- 7,a7 in subsection 7a77#b77;,a71 by inserting 1 including by penetration testing and analyzing the vulnerability disclosure program of the agency after information systems2 7,b7 by striking subsection 7f7 and inserting the following3 7f7 ,protection of information 7#a7 ,agencies and evaluators shall take appropriate steps to ensure the protection of information which1 if disclosed1 may adversely affect information security4 7#b7 ,the protections required under paragraph 7#a7 shall be commensurate with the risk and comply with all applicable laws and regulations4 7#c7 ,with respect to information that is not related to national security systems1 agencies and evaluators shall make a summary of the information unclassified and publicly available1 including information that does not identify-- 7,a7 specific information system incidents2 or 7,b7 specific information system vulnerabilities4 2 7,c7 in subsection 7g77#b7-- 7i7 by striking this subsection shall and inserting 8this subsection-- 7,a7 shall 2 7ii7 in subparagraph 7,a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,b7 identify any entity that performs an independent audit under subsection 7b74 2 and 7,d7 in subsection 7j71 by striking the ,secretary and inserting the ,director of the ,cyber ,security and ,infrastructure ,security ,agency2 and 7#e7 in section #ceef7;a7-- 7,a7 in the matter preceding paragraph 7#a71 by inserting within the ,cybersecurity and ,infrastructure ,security ,agency after incident center2 and 7,b7 in paragraph 7#d71 by striking #ceed7;b7 and inserting #ceed7;a77#a77;,a74 7d7 ,federal system incident response 7#a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,iv ,federal ,system ,incident ,response #ceia4 ,definitions 7a7 ,in general ,except as provided in subsection 7b71 the definitions under sections #cejb and #ceeb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,appropriate notification entities ,the term appropriate notification entities means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,d7 the appropriate authorization and appropriations committees of ,congress2 7,e7 the ,director2 7,f7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,g7 the ,national ,cyber ,director2 and 7,h7 the ,comptroller ,general of the ,united ,states4 7#b7 ,contractor ,the term contractor-- 7,a7 means any person or business that collects or maintains information that includes personally identifiable information or sensitive personal information on behalf of an agency2 and 7,b7 includes any subcontractor of a person or business described in subparagraph 7,a74 7#c7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 7#d7 ,nationwide consumer reporting agency ,the term nationwide consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#e7 ,vulnerability disclosure ,the term vulnerability disclosure means a vulnerability identified under section #ceei;,b4 #ceib4 ,notification of high risk exposure after major incident 7a7 ,notification ,as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after an agency has a reasonable basis to conclude that a major incident has occurred due to a high risk exposure of personal identifiable information1 as described in section #ceih7;c77#b71 the head of the agency shall provide notice of the major incident in accordance with subsection 7b7 in writing to the last known home mailing address of each individual whom the major incident may have impacted4 7b7 ,contents of notice ,each notice to an individual required under subsection 7a7 shall include-- 7#a7 a description of the rationale for the determination that the major incident resulted in a high risk of exposure of the personal information of the individual2 7#b7 an assessment of the type of risk the individual may face as a result of an exposure2 7#c7 contact information for the ,federal ,bureau of ,investigation or other appropriate entity2 7#d7 the contact information of each nationwide consumer reporting agency2 7#e7 the contact information for questions to the agency1 including a telephone number1 e-mail address1 and website2 7#f7 information on any remedy being offered by the agency2 7#g7 consolidated ,federal ,government recommendations on what to do in the event of a major incident2 and 7#h7 any other appropriate information as determined by the head of the agency4 7c7 ,delay of notification 7#a7 ,in general ,the ,attorney ,general1 the ,director of ,national ,intelligence1 or the ,secretary of ,homeland ,security may impose a delay of a notification required under subsection 7a7 if the notification would disrupt a law enforcement investigation1 endanger national security1 or hamper security remediation actions4 7#b7 ,documentation 7,a7 ,in general ,any delay under paragraph 7#a7 shall be reported in writing to the head of the agency1 the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,office of ,inspector ,general of the agency that experienced the major incident4 7,b7 ,contents ,a statement required under subparagraph 7,a7 shall include a written statement from the entity that delayed the notification explaining the need for the delay4 7,c7 ,form ,the statement required under subparagraph 7,a7 shall be unclassified1 but may include a classified annex4 7#c7 ,renewal ,a delay under paragraph 7#a7 shall be for a period of #b months and may be renewed4 7d7 ,update notification ,if an agency determines there is a change in the reasonable basis to conclude that a major incident occurred1 or that there is a change in the details of the information provided to impacted individuals as described in subsection 7b71 the agency shall as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after such a determination1 notify all such individuals who received a notification pursuant to subsection 7a7 of those changes4 7e7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ,director from issuing guidance regarding notifications or the head of an agency from sending notifications to individuals impacted by incidents not determined to be major incidents2 or 7#b7 the ,director from issuing guidance regarding notifications of major incidents or the head of an agency from issuing notifications to individuals impacted by major incidents that contain more information than described in subsection 7b74 #ceic4 ,congressional notifications and reports 7a7 ,initial report 7#a7 ,in general ,not later than #e days after the date on which an agency has a reasonable basis to conclude that a major incident occurred1 the head of the agency shall submit a written notification and1 to the extent practicable1 provide a briefing1 to the appropriate notification entities1 taking into account-- 7,a7 the information known at the time of the notification2 7,b7 the sensitivity of the details associated with the major incident2 and 7,c7 the classification level of the information contained in the notification4 7#b7 ,contents ,a notification required under paragraph 7#a7 shall include-- 7,a7 a summary of the information available about the major incident1 including how the major incident occurred1 based on information available to agency officials as of the date on which the agency submits the report2 7,b7 if applicable1 an estimate of the number of individuals impacted by the major incident1 including an assessment of the risk level to impacted individuals based on the guidance promulgated under section #ceih7;c77#a7 and any information available to agency officials on the date on which the agency submits the report2 7,c7 if applicable1 a description and any associated documentation of any circumstances necessitating a delay in or exemption to notification granted under subsection 7c7 or 7d7 of section #ceib2 and 7,d7 if applicable1 an assessment of the impacts to the agency1 the ,federal ,government1 or the security of the ,united ,states1 based on information available to agency officials on the date on which the agency submits the report4 7b7 ,supplemental report ,within a reasonable amount of time1 but not later than #de days after the date on which additional information relating to a major incident for which an agency submitted a written notification under subsection 7a7 is discovered by the agency1 the head of the agency shall submit to the appropriate notification entities updates to the written notification that include summaries of-- 7#a7 the threats and threat actors1 vulnerabilities1 means by which the major incident occurred1 and impacts to the agency relating to the major incident2 7#b7 any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred2 7#c7 the status of compliance of the affected information system with applicable security requirements at the time of the major incident2 7#d7 an estimate of the number of individuals affected by the major incident based on information available to agency officials as of the date on which the agency submits the update2 7#e7 an update to the assessment of the risk of harm to impacted individuals affected by the major incident based on information available to agency officials as of the date on which the agency submits the update2 7#f7 an update to the assessment of the risk to agency operations1 or to impacts on other agency or non-,federal entity operations1 affected by the major incident based on information available to agency officials as of the date on which the agency submits the update2 and 7#g7 the detection1 response1 and remediation actions of the agency1 including any support provided by the ,cybersecurity and ,infrastructure ,security ,agency under section #ceid7;d7 and status updates on the notification process described in section #ceib7;a71 including any delay or exemption described in subsection 7c7 or 7d71 respectively1 of section #ceib1 if applicable4 7c7 ,update ,report ,if the agency determines that there is any significant change in the understanding of the agency of the scope1 scale1 or consequence of a major incident for which an agency submitted a written notification under subsection 7a71 the agency shall provide an updated report to the appropriate notification entities that includes information relating to the change in understanding4 7d7 ,annual report ,each agency shall submit as part of the annual report required under section #ceed7;c77#a7 of this title a description of each major incident that occurred during the #a-year period preceding the date on which the report is submitted4 7e7 ,delay and exemption report ,the ,director shall submit to the appropriate notification entities an annual report on all notification delays and exemptions granted pursuant to subsections 7c7 and 7d7 of section #ceib4 7f7 ,report delivery ,any written notification or report required to be submitted under this section may be submitted in a paper or electronic format4 7g7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ability of an agency to provide additional reports or briefings to ,congress2 or 7#b7 ,congress from requesting additional information from agencies through reports1 briefings1 or other means4 7h7 ,binding operational directive ,if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency issues a binding operational directive or an emergency directive under section #ceec1 not later than #b days after the date on which the binding operational directive requires an agency to take an action1 each agency shall provide to the appropriate notification entities the status of the implementation of the binding operational directive at the agency4 #ceid4 ,government information sharing and incident response 7a7 ,in general 7#a7 ,incident reporting ,the head of each agency shall provide any information relating to any incident1 whether the information is obtained by the ,federal ,government directly or indirectly1 to the ,cybersecurity and ,infrastructure ,security ,agency and the ,office of ,management and ,budget4 7#b7 ,contents ,a provision of information relating to an incident made by the head of an agency under paragraph 7#a7 shall-- 7,a7 include detailed information about the safeguards that were in place when the incident occurred2 7,b7 whether the agency implemented the safeguards described in subparagraph 7,a7 correctly2 and 7,c7 in order to protect against a similar incident1 identify-- 7i7 how the safeguards described in subparagraph 7,a7 should be implemented differently2 and 7ii7 additional necessary safeguards4 7b7 ,compliance ,the information provided under subsection 7a7 shall-- 7#a7 take into account the level of classification of the information and any information sharing limitations relating to law enforcement2 and 7#b7 be in compliance with the requirements limiting the release of information under section #eeb;a of title #e 7commonly known as the ,privacy ,act of #aigd74 7c7 ,responding to information requests from agencies experiencing incidents ,an agency that receives a request from another agency or ,federal entity for information specifically intended to assist in the remediation or notification requirements due to an incident shall provide that information to the greatest extent possible1 in accordance with guidance issued by the ,director and taking into account classification1 law enforcement1 national security1 and compliance with section #eeb;a of title #e 7commonly known as the ,privacy ,act of #aigd74 7d7 ,incident response ,each agency that has a reasonable basis to conclude that a major incident occurred1 regardless of delays from notification granted for a major incident1 shall consult with the ,cybersecurity and ,infrastructure ,security ,agency regarding-- 7#a7 incident response and recovery2 and 7#b7 recommendations for mitigating future incidents4 #ceie4 ,responsibilities of contractors and grant recipients 7a7 ,notification 7#a7 ,in general ,subject to paragraph 7#c71 any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that an incident involving ,federal information has occurred shall immediately notify the agency4 7#b7 ,procedures 7,a7 ,major incident ,following notification of a major incident by a contractor or recipient of a grant under paragraph 7#a71 an agency1 in consultation with the contractor or grant recipient1 as applicable1 shall carry out the requirements under sections #ceib1 #ceic1 and #ceid with respect to the major incident4 7,b7 ,incident ,following notification of an incident by a contractor or recipient of a grant under paragraph 7#a71 an agency1 in consultation with the contractor or grant recipient1 as applicable1 shall carry out the requirements under section #ceid with respect to the incident4 7#c7 ,applicability ,this subsection shall apply to a contractor of an agency or a recipient of a grant from an agency that-- 7,a7 receives information from the agency that the contractor or recipient1 as applicable1 is not contractually authorized to receive2 7,b7 experiences an incident relating to ,federal information on an information system of the contractor or recipient1 as applicable2 or 7,c7 identifies an incident involving a ,federal information system4 7b7 ,incident response ,any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that a major incident occurred shall1 in coordination with the agency1 consult with the ,cybersecurity and ,infrastructure ,security ,agency regarding-- 7#a7 incident response assistance2 and 7#b7 recommendations for mitigating future incidents at the agency4 7c7 ,effective date ,this section shall apply on and after the date that is #a year after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjba4 #ceif4 ,training 7a7 ,in general ,each agency shall develop training for individuals at the agency with access to ,federal information or information systems on how to identify and respond to an incident1 including-- 7#a7 the internal process at the agency for reporting an incident2 and 7#b7 the obligation of the individual to report to the agency a confirmed major incident and any suspected incident1 involving information in any medium or form1 including paper1 oral1 and electronic4 7b7 ,applicability ,the training developed under subsection 7a7 shall-- 7#a7 be required for an individual before the individual may access ,federal information or information systems2 and 7#b7 apply to individuals with temporary access to ,federal information or information systems1 such as detailees1 contractors1 subcontractors1 grantees1 volunteers1 and interns4 7c7 ,inclusion in annual training ,the training developed under subsection 7a7 may be included as part of an annual privacy or security awareness training of the agency1 as applicable4 #ceig4 ,analysis and report on ,federal incidents 7a7 ,definition of compromise ,in this section1 the term compromise means-- 7#a7 an incident2 7#b7 a result of a penetration test in which the tester successfully gains access to a system within the standards under section #ceei;,a2 7#c7 a vulnerability disclosure2 or 7#d7 any other event that the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines identifies an exploitable vulnerability in an agency system4 7b7 ,analysis of ,federal incidents 7#a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform continuous monitoring of compromises of agencies4 7#b7 ,quantitative and ,qualitative analyses ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall develop and perform continuous monitoring and quantitative and qualitative analyses of compromises of agencies1 including-- 7,a7 the causes of successful compromises1 including-- 7i7 attacker tactics1 techniques1 and procedures2 and 7ii7 system vulnerabilities1 including zero days1 unpatched systems1 and information system misconfigurations2 7,b7 the scope and scale of compromises of agencies2 7,c7 cross ,federal ,government root causes of compromises of agencies2 7,d7 agency response1 recovery1 and remediation actions and effectiveness of incidents1 as applicable2 and 7,e7 lessons learned and recommendations in responding1 recovering1 remediating1 and mitigating future incidents4 7#c7 ,automated analysis ,the analyses developed under paragraph 7#b7 shall1 to the greatest extent practicable1 use machine readable data1 automation1 and machine learning processes4 7#d7 ,sharing of data and analysis 7,a7 ,in general ,the ,director shall share on an ongoing basis the analyses required under this subsection with agencies to-- 7i7 improve the understanding of agencies with respect to risk2 and 7ii7 support the cybersecurity improvement efforts of agencies4 7,b7 ,format ,in carrying out subparagraph 7,a71 the ,director shall share the analyses-- 7i7 in human-readable written products2 and 7ii7 to the greatest extent practicable1 in machine-readable formats in order to enable automated intake and use by agencies4 7c7 ,annual report on ,federal compromises ,not later than #b years after the date of enactment of this section1 and not less frequently than annually thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall submit to the appropriate notification entities a report that includes-- 7#a7 a summary of causes of compromises from across the ,federal ,government that categorizes those compromises by the items described in paragraphs 7#a7 through 7#d7 of subsection 7a72 7#b7 the quantitative and qualitative analyses of compromises developed under subsection 7b77#b7 on an agency-by-agency basis and comprehensively2 and 7#c7 an annex for each agency that includes the total number of compromises of the agency and categorizes those compromises by the items described in paragraphs 7#a7 through 7#d7 of subsection 7a74 7d7 ,publication ,a version of each report submitted under subsection 7c7 shall be made publicly available on the website of the ,cybersecurity and ,infrastructure ,security ,agency during the year in which the report is submitted4 7e7 ,information provided by agencies ,the analysis required under subsection 7b7 and each report submitted under subsection 7c7 shall utilize information provided by agencies pursuant to section #ceid7;d74 7f7 ,requirement ,to ,anonymize ,information ,in publishing the public report required under subsection 7d71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall sufficiently anonymize and compile information such that no specific incidents of an agency can be identified1 except with the concurrence of the ,director of the ,office of ,management and ,budget and in consultation with the impacted agency4 #ceih4 ,major incident guidance 7a7 ,in general ,not later than #ij days after the date of enactment of the ,federal ,information ,security ,management ,act of #bjba1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop and promulgate guidance on the definition of the term major incident for the purposes of subchapter ,,ii and this subchapter4 7b7 ,requirements ,with respect to the guidance issued under subsection 7a71 the definition of the term major incident shall-- 7#a7 include1 with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency-- 7,a7 any incident the head of the agency determines is likely to have an impact on the national security1 homeland security1 or economic security of the ,united ,states2 7,b7 any incident the head of the agency determines is likely to have an impact on the operations of the agency1 a component of the agency1 or the ,federal ,government1 including an impact on the efficiency or effectiveness of agency information systems2 7,c7 any incident that the head of an agency1 in consultation with the ,chief ,privacy ,officer of the agency1 determines involves a high risk incident in accordance with the guidance issued under subsection 7c77#a72 7,d7 any incident that involves the unauthorized disclosure of personally identifiable information of not less than #ejj individuals1 regardless of the risk level determined under the guidance issued under subsection 7c77#a72 7,e7 any incident the head of the agency determines involves a high value asset owned or operated by the agency2 and 7,f7 any other type of incident determined appropriate by the ,director2 7#b7 stipulate that every agency shall be considered to have experienced a major incident if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines that an incident that occurs at not less than #b agencies-- 7,a7 is enabled by a common technical root cause1 such as a supply chain compromise1 a common software or hardware vulnerability2 or 7,b7 is enabled by the related activities of a common actor2 and 7#c7 stipulate that1 in determining whether an incident constitutes a major incident because that incident-- 7,a7 is any incident described in paragraph 7#a71 the head of an agency shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,b7 is an incident described in paragraph 7#a77;,a71 the head of the agency shall consult with the ,national ,cyber ,director2 and 7,c7 is an incident described in subparagraph 7,c7 or 7,d7 of paragraph 7#a71 the head of the agency shall consult with-- 7i7 the ,privacy and ,civil ,liberties ,oversight ,board2 and 7ii7 the ,executive ,director of the ,federal ,trade ,commission4 7c7 ,guidance on risk to individuals 7#a7 ,in general ,not later than #ij days after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjba1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,privacy and ,civil ,liberties ,oversight ,board1 and the ,executive ,director of the ,federal ,trade ,commission1 shall develop and issue guidance to agencies that establishes a risk-based framework for determining the level of risk that an incident involving personally identifiable information could result in substantial harm1 physical harm1 embarrassment1 or unfairness to an individual4 7#b7 ,risk levels and considerations ,the risk-based framework included in the guidance issued under paragraph 7#a7 shall-- 7,a7 include a range of risk levels1 including a high risk level2 and 7,b7 consider-- 7i7 any personally identifiable information that was exposed as a result of an incident2 7ii7 the circumstances under which the exposure of personally identifiable information of an individual occurred2 and 7iii7 whether an independent evaluation of the information affected by an incident determines that the information is unreadable1 including1 as appropriate1 instances in which the information is-- 7,i7 encrypted2 and 7,,ii7 determined by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to be of sufficiently low risk of exposure4 7#c7 ,approval 7,a7 ,in general ,the guidance issued under paragraph 7#a7 shall include a process by which the ,director1 jointly with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,attorney ,general1 may approve the designation of an incident that would be considered high risk as lower risk if information exposed by the incident is unreadable1 as described in paragraph 7#b77;,b77iii74 7,b7 ,documentation ,the ,director shall report any approval of an incident granted by the ,director under subparagraph 7,a7 to-- 7i7 the head of the agency that experienced the incident2 7ii7 the inspector general of the agency that experienced the incident2 and 7iii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7d7 ,evaluation and updates ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjba1 and not less frequently than every #b years thereafter1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives an evaluation1 which shall include-- 7#a7 an update1 if necessary1 to the guidance issued under subsections 7a7 and 7c72 7#b7 the definition of the term major incident included in the guidance issued under subsection 7a72 7#c7 an explanation of1 and the analysis that led to1 the definition described in paragraph 7#b72 and 7#d7 an assessment of any additional datasets or risk evaluation criteria that should be included in the risk-based framework included in the guidance issued under subsection 7c77#a74 4 7#b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,subchapter ,,iv--,federal ,system ,incident ,response #ceia4 ,definitions4 #ceib4 ,notification of high risk exposure after major incident4 #ceic4 ,congressional notifications and reports4 #ceid4 ,government information sharing and incident response4 #ceie4 ,responsibilities of contractors and grant recipients4 #ceif4 ,training4 #ceig4 ,analysis and report on ,federal incidents4 #ceih4 ,major incident guidance4 4 #ajb4 ,amendments to subtitle ,,iii of title #dj 7a7 ,information ,technology ,modernization ,centers of ,excellence ,program ,act ,section #b7;c77#d77;,a77ii7 of the ,information ,technology ,modernization ,centers of ,excellence ,program ,act 7#dj ,u4,s4,c4 #aacja note7 is amended by striking the period at the end and inserting 1 which shall be provided in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency44 7b7 ,modernizing ,government ,technology ,subtitle ,g of title ,x of ,division ,a of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjah 7#dj ,u4,s4,c4 #aacja note7 is amended-- 7#a7 in section #ajgg7;b7-- 7,a7 in paragraph 7#e77;,a71 by inserting improving the cybersecurity of systems and before cost savings activities2 and 7,b7 in paragraph 7#g7-- 7i7 in the paragraph heading1 by striking cio and inserting ,,cio2 7ii7 by striking ,in evaluating projects and inserting the following3 7,a7 ,consideration of guidance ,in evaluating projects 2 7iii7 in subparagraph 7,a71 as so designated1 by striking under section #ajid7;b77#a7 and inserting guidance issued by the ,director2 and 7iv7 by adding at the end the following3 7,b7 ,consultation ,in using funds under paragraph 7#c77;,a71 the ,chief ,information ,officer of the covered agency shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 2 and 7#b7 in section #ajgh-- 7,a7 by striking subsection 7a7 and inserting the following3 7a7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,high value asset ,the term high value asset has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 2 7,b7 in subsection 7b71 by adding at the end the following3 7#h7 ,proposal evaluation ,the ,director shall-- 7,a7 give consideration for the use of amounts in the ,fund to improve the security of high value assets2 and 7,b7 require that any proposal for the use of amounts in the ,fund includes a cybersecurity plan1 including a chain risk management plan1 to be reviewed by the member of the ,technology ,modernization ,board described in subsection 7c77#e77;,c74 2 and 7,c7 in subsection 7c7-- 7i7 in paragraph 7#b77;,a77i71 by inserting 1 including a consideration of the impact on high value assets after operational risks2 7ii7 in paragraph 7#e7-- 7,i7 in subparagraph 7,a71 by striking and at the end2 7,,ii7 in subparagraph 7,b71 by striking the period at the end and inserting and2 and 7,,iii7 by adding at the end the following3 7,c7 a senior official from the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 appointed by the ,director4 2 and 7iii7 in paragraph 7#f77;,a71 by striking shall be-- and all that follows through #d employees and inserting shall be #d employees4 7c7 ,subchapter ,i ,subchapter ,i of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacjb-- 7,a7 in subsection 7b71 by striking use1 security1 and disposal of and inserting use1 and disposal1 and1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 promote and improve the security1 of2 7,b7 in subsection 7c7-- 7i7 in paragraph 7#b71 by inserting in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency before 1 and results of2 7ii7 in paragraph 7#c7-- 7,i7 in subparagraph 7,a71 by striking 1 and performance and inserting security1 and performance2 and 7,,ii7 in subparagraph 7,c7-- 7aa7 by striking ,for each major and inserting the following3 7i7 ,in general ,for each major 2 and 7bb7 by adding at the end the following3 7ii7 ,cybersecurity ,in categorizing an investment according to risk under clause 7i71 the ,chief ,information ,officer of the covered agency shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency on the cybersecurity or supply chain risk4 7iii7 ,security risk guidance ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance for the categorization of an investment under clause 7i7 according to the cybersecurity or supply chain risk4 2 and 7iii7 in paragraph 7#d7-- 7,i7 in subparagraph 7,a7-- 7aa7 in clause 7ii71 by striking and at the end2 7bb7 in clause 7iii71 by striking the period at the end and inserting 2 and2 and 7cc7 by adding at the end the following3 7iv7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the cybersecurity risks of the investment4 2 and 7,,ii7 in subparagraph 7,b71 in the matter preceding clause 7i71 by inserting not later than #cj days after the date on which the review under subparagraph 7,a7 is completed1 before the ,administrator2 7,c7 in subsection 7f7-- 7i7 by striking heads of executive agencies to develop and inserting 8heads of executive agencies to-- 7#a7 develop 2 7ii7 in paragraph 7#a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7#b7 consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency for the development and use of supply chain security best practices4 2 and 7,d7 in subsection 7h71 by inserting 1 including cybersecurity performances1 after the performances2 and 7#b7 in section #aacjc7;b77#b77;,b7-- 7,a7 in clause 7i71 by striking or at the end2 7,b7 in clause 7ii71 by adding or at the end2 and 7,c7 by adding at the end the following3 7iii7 whether the function should be performed by a shared service offered by another executive agency2 4 7d7 ,subchapter ,,ii ,subchapter ,,ii of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacab7;a71 by inserting 1 including security risks after managing the risks2 7#b7 in section #aacac7a71 by striking efficiency and effectiveness and inserting efficiency1 security1 and effectiveness2 7#c7 in section #aacag1 by inserting security1 before or schedule2 and 7#d7 in section #aacai7;b77#a71 in the paragraph heading1 by striking cios and inserting ,chief ,information ,officers4 7e7 ,subchapter ,,iii ,section #aacca of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a71 by striking section #cecb7;b77#a7 and inserting section #ceeb7;b72 7#b7 in subsection 7b77#a77;,a7-- 7,a7 by striking in consultation and inserting in coordination2 7,b7 by striking the ,secretary of ,homeland ,security and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,c7 by inserting and associated verification specifications developed under subsection 7g7 before pertaining to ,federal2 7#c7 by striking subsection 7c7 and inserting the following3 7c7 ,application of more stringent standards 7#a7 ,in general ,the head of an agency shall-- 7,a7 evaluate the need to employ standards for cost-effective1 risk-based information security for all systems1 operations1 and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the ,director under this section1 if such standards contain1 at a minimum1 the provisions of those applicable standards made compulsory and binding by the ,director2 and 7,b7 to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph 7,a7 are necessary1 employ those standards4 7#b7 ,evaluation of more stringent standards ,in evaluating the need to employ more stringent standards under paragraph 7#a71 the head of an agency shall consider available risk information1 including-- 7,a7 the status of cybersecurity remedial actions of the agency2 7,b7 any vulnerability information relating to agency systems that is known to the agency2 7,c7 incident information of the agency2 7,d7 information from-- 7i7 penetration testing performed under section #ceei;,a of title #dd2 and 7ii7 information from the verification disclosure program established under section #ceei;,b of title #dd2 7,e7 agency threat hunting results under section #bjg of the ,federal ,information ,security ,modernization ,act of #bjba2 7,f7 ,federal and non-,federal threat intelligence2 7,g7 data on compliance with standards issued under this section1 using the verification specifications developed under subsection 7f7 when appropriate2 7,h7 agency system risk assessments of the agency performed under section #ceed7;a77#a77;,a7 of title #dd2 and 7,i7 any other information determined relevant by the head of the agency4 2 7#d7 in subsection 7d77#b7-- 7,a7 by striking the paragraph heading and inserting ,consultation1 notice1 and comment2 7,b7 by inserting promulgate1 before significantly modify2 and 7,c7 by striking shall be made after the public is given an opportunity to comment on the ,director's proposed decision4 and inserting 8shall be made-- 7,a7 for a decision to significantly modify or not promulgate such a proposed standard1 after the public is given an opportunity to comment on the ,director's proposed decision2 7,b7 in consultation with the ,chief ,information ,officers ,council1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,comptroller ,general of the ,united ,states1 and the ,council of the ,inspectors ,general on ,integrity and ,efficiency2 7,c7 considering the ,federal risk assessments performed under section #ceec7;i7 of title #dd2 and 7,d7 considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard4 2 and 7#e7 by adding at the end the following3 7e7 ,review of promulgated standards 7#a7 ,in general ,not less frequently than once every #b years1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,chief ,information ,officers ,council1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,comptroller ,general of the ,united ,states1 and the ,council of the ,inspectors ,general on ,integrity and ,efficiency shall review the efficacy of the standards in effect promulgated under this section in reducing cybersecurity risks and determine whether any changes to those standards are appropriate based on-- 7,a7 the ,federal risk assessment developed under section #ceec7;i7 of title #dd2 7,b7 public comment2 and 7,c7 an assessment of the extent to which the proposed standards reduce risk relative to the cost of implementation of the standards4 7#b7 ,updated guidance ,not later than #ij days after the date of the completion of the review under paragraph 7#a71 the ,director of the ,office of ,management and ,budget shall issue guidance to agencies to make any necessary updates to the standards in effect promulgated under this section based on the results of the review4 7#c7 ,congressional report ,not later than #cj days after the date on which a review is completed under paragraph 7#a71 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report that includes-- 7,a7 the review of the standards in effect promulgated under this section conducted under paragraph 7#a72 7,b7 the risk mitigation offered by each standard described in subparagraph 7,a72 and 7,c7 a summary of-- 7i7 the standards to which changes were determined appropriate during the review2 and 7ii7 anticipated changes to the standards under this section in guidance issued under paragraph 7#b74 7f7 ,verification specifications ,not later than #a year after the date on which the ,director of the ,national ,institute of ,standards and ,technology issues a proposed standard pursuant to paragraphs 7#b7 and 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 as practicable1 shall develop technical specifications to enable the automated verification of the implementation of the controls within the standard4 4 #ajc4 ,actions to enhance ,federal incident response 7a7 ,responsibilities of the ,cybersecurity and ,infrastructure ,security ,agency 7#a7 ,recommendations ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,chair of the ,federal ,trade ,commission1 the ,chair of the ,securities and ,exchange ,commission1 the ,secretary of the ,treasury1 the ,director of the ,federal ,bureau of ,investigation1 the ,director of the ,national ,institute of ,standards and ,technology1 and the head of any other appropriate ,federal or non-,federal entity1 shall consolidate1 maintain1 and make publicly available recommendations for individuals whose personal information1 as defined in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act1 is inappropriately exposed as a result of a high risk incident described in section #ceih7;c77#b7 of title #dd1 ,united ,states ,code4 7#b7 ,plan for analysis of1 and report on1 ,federal incidents 7,a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7i7 develop a plan for the development of the analysis required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this ,act1 and the report required under subsection 7c7 of that section that includes-- 7,i7 a description of any challenges the ,director anticipates encountering2 and 7,,ii7 the use of automation and machine-readable formats for collecting1 compiling1 monitoring1 and analyzing data2 and 7ii7 provide to the appropriate congressional committees a briefing on the plan developed under clause 7i74 7,b7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a briefing on-- 7i7 the execution of the plan required under subparagraph 7,a72 and 7ii7 the development of the report required under section #ceig7;c7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7b7 ,responsibilities of the ,director of the ,office of ,management and ,budget 7#a7 ,,fisma ,section #b of the ,federal ,information ,security ,modernization ,act of #bjad 7#dd ,u4,s4,c4 #ceed note7 is amended-- 7,a7 by striking subsection 7b72 and 7,b7 by redesignating subsections 7c7 through 7f7 as subsections 7b7 through 7e71 respectively4 7#b7 ,incident data sharing 7,a7 ,in general ,the ,director shall develop guidance1 to be updated not less frequently than once every #b years1 on the content1 timeliness1 and format of the information provided by agencies under section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,requirements ,the guidance developed under subparagraph 7,a7 shall-- 7i7 prioritize the availability of data necessary to understand and analyze-- 7,i7 the causes of incidents2 7,,ii7 the scope and scale of incidents within the agency networks and systems2 7,,iii7 cross ,federal ,government root causes of incidents2 7,,iv7 agency response1 recovery1 and remediation actions2 and 7,v7 the effectiveness of incidents2 7ii7 enable the efficient development of-- 7,i7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,,ii7 the report on ,federal compromises required under section #ceig7;c7 of title #dd1 ,united ,states ,code1 as added by this ,act2 7iii7 include requirements for the timeliness of data production2 and 7iv7 include requirements for using automation and machine-readable data for data sharing and availability4 7#c7 ,guidance on responding to information requests ,not later than #a year after the date of enactment of this ,act1 the ,director shall develop guidance for agencies to implement the requirement under section #ceid7;c7 of title #dd1 ,united ,states ,code1 as added by this ,act1 to provide information to other agencies experiencing incidents4 7#d7 ,standard guidance and templates ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop guidance and templates1 to be reviewed and1 if necessary1 updated not less frequently than once every #b years1 for use by ,federal agencies in the activities required under sections #ceib1 #ceic1 and #ceif of title #dd1 ,united ,states ,code1 as added by this ,act4 7#e7 ,contractor and grantee guidance 7,a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 the ,administrator of ,general ,services1 and the heads of other agencies determined appropriate by the ,director1 shall issue guidance to ,federal agencies on how to deconflict existing regulations1 policies1 and procedures relating to the responsibilities of contractors and grant recipients established under section #ceie of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,existing processes ,to the greatest extent practicable1 the guidance issued under subparagraph 7,a7 shall allow contractors and grantees to use existing processes for notifying ,federal agencies of incidents involving information of the ,federal ,government4 7#f7 ,updated briefings ,not less frequently than once every #b years1 the ,director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs 7#b7 through 7#d74 7c7 ,update to the ,privacy ,act of #aigd ,section #eeb;a7b7 of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd7 is amended-- 7#a7 in paragraph 7#aa71 by striking or at the end2 7#b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 and2 and 7#c7 by adding at the end the following3 7#ac7 to another agency in furtherance of a response to an incident 7as defined in section #ceeb of title #dd7 and pursuant to the information sharing requirements in section #ceid of title #dd if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought4 4 #ajd4 ,additional guidance to agencies on ,,fisma updates ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance for agencies on-- 7#a7 completing the agency system risk assessment required under section #ceed7;a77#a77;,a7 of title #dd1 ,united ,states ,code1 as amended by this ,act2 7#b7 implementing additional cybersecurity procedures1 which shall include resources for shared services2 7#c7 establishing a process for providing the status of each remedial action under section #ceed7;b77#g7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 to the ,director and the ,cybersecurity and ,infrastructure ,security ,agency using automation and machine-readable data1 as practicable1 which shall include-- 7,a7 specific standards for the automation and machine-readable data2 and 7,b7 templates for providing the status of the remedial action2 7#d7 interpreting the definition of high value asset in section #ceeb of title #dd1 ,united ,states ,code1 as amended by this ,act2 7#e7 implementing standards in agency authorization processes to encourage the tailoring of processes to agency and system risk that are proportionate to the sensitivity of systems1 which shall include-- 7,a7 a clarification of-- 7i7 the acceptable use and development of customization of standards promulgated under section #aacca of title #dj1 ,united ,states ,code2 and 7ii7 the acceptable use of risk-based authorization procedures authorized on the date of enactment of this ,act2 and 7,b7 a requirement to coordinate with ,inspectors ,generals of agencies to ensure consistent understanding and application of agency policies for the purpose of ,inspector ,general audits2 and 7#f7 requiring1 as practicable and pursuant to section #bjc1 an evaluation of agency cybersecurity using metrics that are-- 7,a7 based on outcomes2 and 7,b7 based on time4 #aje4 ,agency requirements to notify entities impacted by incidents ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall issue guidance that requires agencies to notify entities that are compelled to share sensitive information with the agency of an incident that impacts-- 7#a7 sensitive information shared with the agency by the entity2 or 7#b7 the systems used to the transmit sensitive information described in paragraph 7#a7 to the agency4 ,,ii ,improving ,federal cybersecurity #bja4 ,evaluation of effectiveness of standards 7a7 ,in general ,as a component of the evaluation and report required under section #ceee7;h7 of title #dd1 ,united ,states ,code1 and not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall perform a study that-- 7#a7 assesses the standards promulgated under section #aacca7;b7 of title #dj1 ,united ,states ,code to determine the degree to which agencies use the authority under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code to customize the standards relative to the risks facing each agency and agency system2 7#b7 assesses the effectiveness of the standards described in paragraph 7#a71 including any standards customized by agencies under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code1 at improving agency cybersecurity2 7#c7 examines the quantification of cybersecurity risk in the private sector for any applicability for use by the ,federal ,government2 7#d7 examines cybersecurity metrics existing as of the date of enactment of this ,act used by the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the heads of other agencies to evaluate the effectiveness of information security policies and practices2 and 7#e7 with respect to the standards described in paragraph 7#a71 provides recommendations for-- 7,a7 the addition or removal of standards2 or 7,b7 the customization of-- 7i7 the standards by agencies under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code2 or 7ii7 specific controls within the standards4 7b7 ,incorporation of study ,the ,director shall incorporate the results of the study performed under subsection 7a7 into the review of standards required under section #aacca7;e7 of title #dj1 ,united ,states ,code4 7c7 ,briefing ,not later than #cj days after the date on which the study performed under subsection 7a7 is completed1 the ,comptroller ,general of the ,united ,states shall provide to the appropriate congressional committees a briefing on the study4 #bjb4 ,mobile security standards 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director shall-- 7#a7 evaluate mobile application security standards promulgated under section #aacca7;b7 of title #dd1 ,united ,states ,code2 and 7#b7 issue guidance to implement mobile security standards in effect on the date of enactment of this ,act promulgated under section #aacca7;b7 of title #dj1 ,united ,states ,code1 including for mobile applications1 for every agency4 7b7 ,contents ,the guidance issued under subsection 7a77#b7 shall include-- 7#a7 a requirement1 pursuant to section #cejf7;b77#d7 of title #dd1 ,united ,states ,code1 for every agency to maintain a continuous inventory of every-- 7,a7 mobile device operated by or on behalf of the agency2 7,b7 mobile application installed on a mobile device described in subparagraph 7,a72 and 7,c7 vulnerability identified by the agency associated with a mobile device or mobile application described in subparagraphs 7,a7 and 7,b72 and 7#b7 a requirement for every agency to perform continuous evaluation of the vulnerabilities described in paragraph 7#a77;,c7 and other risks4 7c7 ,information sharing ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies for sharing the inventory of the agency required under subsection 7b77#a7 with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable4 7d7 ,briefing ,not later than #fj days after the date on which the ,director issues guidance under subsection 7a77#b71 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall provide to the appropriate congressional committees a briefing on the guidance4 #bjc4 ,quantitative cybersecurity metrics 7a7 ,establishing time-,based metrics 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 update the metrics used to measure security under section #ceed of title #dd1 ,united ,states ,code1 including any metrics developed pursuant to section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c771 to include standardized metrics to quantitatively evaluate and identify trends in agency cybersecurity performance1 including performance for incident response2 and 7,b7 evaluate the metrics described in subparagraph 7,a74 7#b7 ,qualities ,with respect to the updated metrics required under paragraph 7#a7-- 7,a7 not less than #b of the metrics shall be time-based2 and 7,b7 the metrics may include other measurable outcomes4 7#c7 ,evaluation ,the evaluation required under paragraph 7#a77;,b7 shall evaluate-- 7,a7 the amount of time it takes for an agency to detect an incident2 and 7,b7 the amount of time that passes between-- 7i7 the detection and remediation of an incident2 and 7ii7 the remediation of an incident and the recovery from the incident4 7b7 ,implementation 7#a7 ,in general ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall promulgate guidance that requires the use of the updated metrics developed under subsection 7a77#a77;,a7 by every agency over a #d-year period beginning on the date on which the metrics are developed to track trends in the incident response capabilities of agencies4 7#b7 ,penetration tests ,on not less than #b occasions during the #b-year period following the date on which guidance is promulgated under paragraph 7#a71 not less than #c agencies shall be subjected to substantially similar penetration tests in order to validate the utility of the metrics developed under subsection 7a77#a77;,a74 7#c7 ,database ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop and use a database that-- 7,a7 stores agency metrics information2 and 7,b7 allows for the performance of cross-agency comparison of agency incident response capability trends4 7c7 ,updated metrics 7#a7 ,in general ,the ,director may issue guidance that updates the metrics developed under subsection 7a77#a77;,a7 if the updated metrics-- 7,a7 have the qualities described in subsection 7a77#b72 and 7,b7 can be evaluated under subsection 7a77#c74 7#b7 ,data sharing ,the guidance issued under paragraph 7#a7 shall require agencies to share with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency data demonstrating the performance of the agency with the updated metrics included in that guidance against the metrics developed under subsection 7a77#a77;,a74 7d7 ,congressional reports 7#a7 ,updated metrics ,not later than #cj days after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security completes the evaluation required under subsection 7a77#a77;,b71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the appropriate congressional committees a report on the updated metrics developed under subsection 7a77#a77;,a74 7#b7 ,program ,not later than #ahj days after the date on which guidance is promulgated under subsection 7b77#a71 the ,director shall submit to the appropriate congressional committees a report on the results of the use of the updated metrics developed under subsection 7a77#a77;,a7 by agencies4 #bjd4 ,data and logging retention for incident response 7a7 ,recommendations ,not later than #fj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,attorney ,general and the ,national ,cyber ,director1 shall submit to the ,director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency4 7b7 ,contents ,the recommendations provided under subsection 7a7 shall include-- 7#a7 the types of logs to be maintained2 7#b7 the time periods to retain the logs and other relevant data2 7#c7 the time periods for agencies to enable recommended logging and security requirements2 7#d7 how to ensure the confidentiality1 integrity1 and availability of logs2 7#e7 requirements to ensure that1 upon request1 agencies provide logs to-- 7,a7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency for a cybersecurity purpose2 and 7,b7 the ,federal ,bureau of ,investigation to investigate potential criminal activity2 and 7#f7 ensuring the highest level security operations center of each agency has visibility into all agency logs4 7c7 ,guidance ,not later than #ij days after receiving the recommendations submitted under subsection 7a71 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,attorney ,general1 shall promulgate guidance to agencies to establish requirements for logging1 log retention1 log management1 and sharing of log data with other appropriate agencies4 7d7 ,periodic review ,not later than #b years after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency submits the recommendations required under subsection 7a71 and not less frequently than every #b years thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,attorney ,general1 shall evaluate the recommendations and provide an update on the recommendations to the ,director as necessary4 #bje4 ,,cisa agency advisors 7a7 ,in general ,not later than #abj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall assign not less than #a cybersecurity professional employed by the ,cybersecurity and ,infrastructure ,security ,agency to be the ,cybersecurity and ,infrastructure ,security ,agency advisor to the ,chief ,information ,officer of each agency4 7b7 ,qualifications ,each advisor assigned under subsection 7a7 shall have knowledge of-- 7#a7 cybersecurity threats facing agencies1 including any specific threats to the assigned agency2 7#b7 performing risk assessments of agency systems2 and 7#c7 other ,federal cybersecurity initiatives4 7c7 ,duties ,the duties of each advisor assigned under subsection 7a7 shall include-- 7#a7 providing ongoing assistance and advice1 as requested1 to the agency ,chief ,information ,officer2 7#b7 serving as an incident response point of contact between the assigned agency and the ,cybersecurity and ,infrastructure ,security ,agency2 and 7#c7 familiarizing themselves with agency systems1 processes1 and procedures to better facilitate support to the agency in responding to incidents4 7d7 ,limitation ,an advisor assigned under subsection 7a7 shall not be a contractor4 7e7 ,multiple assignments ,one individual advisor made be assigned to multiple agency ,chief ,information ,officers under subsection 7a74 #bjf4 ,federal penetration testing policy 7a7 ,in general ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceei;,a4 ,federal penetration testing 7a7 ,definitions ,in this section3 7#a7 ,agency operational plan ,the term agency operational plan means a plan of an agency for the use of penetration testing4 7#b7 ,rules of engagement ,the term rules of engagement means a set of rules established by an agency for the use of penetration testing4 7b7 ,guidance 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall issue guidance that-- 7,a7 requires agencies to use1 when and where appropriate1 penetration testing on agency systems2 and 7,b7 requires agencies to develop an agency operational plan and rules of engagement that meet the requirements under subsection 7c74 7#b7 ,penetration testing guidance ,the guidance issued under this section shall-- 7,a7 permit an agency to use1 for the purpose of performing penetration testing-- 7i7 a shared service of the agency or another agency2 or 7ii7 an external entity1 such as a vendor2 7,b7 include templates and frameworks for reporting the results of penetration testing1 without regard to the status of the entity that performs the penetration testing2 and 7,c7 require agencies to provide the rules of engagement and results of penetration testing to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 without regard to the status of the entity that performs the penetration testing4 7c7 ,agency plans and rules of engagement ,the agency operational plan and rules of engagement of an agency shall-- 7#a7 require the agency to perform penetration testing on the high value assets of the agency2 7#b7 establish guidelines for avoiding1 as a result of penetration testing-- 7,a7 adverse impacts to the operations of the agency2 7,b7 adverse impacts to operational networks and systems of the agency2 and 7,c7 inappropriate access to data2 7#c7 require the results of penetration testing to include feedback to improve the cybersecurity of the agency2 and 7#d7 include mechanisms for providing consistently formatted1 and1 if applicable1 automated and machine-readable1 data to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7d7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 establish a certification process for the performance of penetration testing by both ,federal and non-,federal entities that establishes minimum quality controls for penetration testing2 7#b7 develop operational guidance for instituting penetration testing programs at agencies2 7#c7 develop and maintain a centralized capability to offer penetration testing as a service to ,federal and non-,federal entities2 and 7#d7 provide guidance to agencies on the best use of penetration testing resources4 7e7 ,responsibilities of ,,omb ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall-- 7#a7 not less frequently than annually1 inventory all ,federal penetration testing assets2 and 7#b7 develop and maintain a ,federal strategy for the use of penetration testing4 7f7 ,prioritization of penetration testing resources 7#a7 ,in general ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop a framework for prioritizing ,federal penetration testing resources among agencies4 7#b7 ,considerations ,in developing the framework under this subsection1 the ,director shall consider-- 7,a7 agency system risk assessments performed under section #ceed7;a77#a77;,a72 7,b7 the ,federal risk assessment performed under section #ceec7;i72 7,c7 the analysis of ,federal incident data performed under section #ceig2 and 7,d7 any other information determined appropriate by the ,director or the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 4 7b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei the following3 #ceei;,a4 ,federal penetration testing4 4 7c7 ,penetration testing by the ,secretary of ,homeland ,security ,section #ceec7;b7 of title #dd1 ,united ,states ,code1 as amended by section #agje of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7,public ,law #aaf-bhc7 and section #aja1 is further amended-- 7#a7 in paragraph 7#h77;,b71 by striking and at the end2 7#b7 by redesignating paragraph 7#i7 as paragraph 7#aj72 and 7#c7 by inserting after paragraph 7#h7 the following3 7#i7 performing penetration testing with or without advance notice to1 or authorization from1 agencies1 to identify vulnerabilities within ,federal information systems2 and 4 #bjg4 ,ongoing threat hunting program 7a7 ,threat hunting program 7#a7 ,in general ,not later than #edj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall establish a program to provide ongoing1 hypothesis-driven threat-hunting services on the network of each agency4 7#b7 ,plan ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish the program required under paragraph 7#a7 that describes how the ,director of the ,cybersecurity and ,infrastructure ,security ,agency plans to-- 7,a7 determine the method for collecting1 storing1 accessing1 and analyzing appropriate agency data2 7,b7 provide on-premises support to agencies2 7,c7 staff threat hunting services2 7,d7 allocate available human and financial resources to implement the plan2 and 7,e7 provide input to the heads of agencies on the use of-- 7i7 more stringent standards under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code2 and 7ii7 additional cybersecurity procedures under section #ceed of title #dd1 ,united ,states ,code4 7b7 ,reports ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the appropriate congressional committees-- 7#a7 not later than #cj days after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency completes the plan required under subsection 7a77#b71 a report on the plan to provide threat hunting services to agencies2 7#b7 not less than #cj days before the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services under the program1 a report providing any updates to the plan developed under subsection 7a77#b72 and 7#c7 not later than #a year after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services to agencies other than the ,cybersecurity and ,infrastructure ,security ,agency1 a report describing lessons learned from providing those services4 #bjh4 ,codifying vulnerability disclosure programs 7a7 ,in general ,chapter #ce of title #dd of ,united ,states ,code is amended by inserting after section #ceei;,a1 as added by section #bjf of this ,act1 the following3 #ceei;,b4 ,federal vulnerability disclosure programs 7a7 ,definitions ,in this section3 7#a7 ,report ,the term report means a vulnerability disclosure made to an agency by a reporter4 7#b7 ,reporter ,the term reporter means an individual that submits a vulnerability report pursuant to the vulnerability disclosure process of an agency4 7b7 ,responsibilities of ,,omb 7#a7 ,limitation on legal action ,the ,director1 in consultation with the ,attorney ,general1 shall issue guidance to agencies to not recommend or pursue legal action against a reporter or an individual that conducts a security research activity that the head of the agency determines-- 7,a7 represents a good faith effort to follow the vulnerability disclosure policy developed under subsection 7d77#b7 of the agency2 and 7,b7 is authorized under the vulnerability disclosure policy developed under subsection 7d77#b7 of the agency4 7#b7 ,sharing information with ,,cisa ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies on sharing relevant information in a consistent1 automated1 and machine readable manner with the ,cybersecurity and ,infrastructure ,security ,agency1 including-- 7,a7 any valid or credible reports of newly discovered or not publicly known vulnerabilities 7including misconfigurations7 on an agency information system that uses commercial software or services2 7,b7 information relating to vulnerability disclosure1 coordination1 or remediation activities of an agency1 particularly as those activities relate to outside organizations-- 7i7 with which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security can assist2 or 7ii7 about which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security should know2 and 7,c7 any other information with respect to which the head of the agency determines helpful or necessary to involve the ,cybersecurity and ,infrastructure ,security ,agency4 7#c7 ,agency vulnerability disclosure policies 7,a7 ,in general ,the ,director shall issue guidance to agencies on the required minimum scope of agency systems covered by the vulnerability disclosure policy of an agency required under subsection 7d77#b74 7,b7 ,deadline ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjba1 the ,director shall update the guidance issued under subparagraph 7,a7 to require that every agency system that is connected to the internet is covered by the vulnerability disclosure policy of the agency4 7c7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide support to agencies with respect to the implementation of the requirements of this section2 7#b7 develop tools1 processes1 and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section2 and 7#c7 upon a request by an agency1 assist the agency in the disclosure to vendors of newly identified vulnerabilities in vendor products and services4 7d7 ,responsibilities of agencies 7#a7 ,public information ,the head of each agency shall make publicly available1 with respect to each internet domain under the control of the agency that is not a national security system-- 7,a7 an appropriate security contact2 and 7,b7 the component of the agency that is responsible for the internet accessible services offered at the domain4 7#b7 ,vulnerability disclosure policy ,the head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency1 which shall-- 7,a7 describe-- 7i7 the scope of the systems of the agency included in the vulnerability disclosure policy2 7ii7 the type of information system testing that is authorized by the agency2 7iii7 the type of information system testing that is not authorized by the agency2 and 7iv7 the disclosure policy of the agency for sensitive information2 7,b7 include a provision that authorizes the anonymous submission of a vulnerability by a reporter2 7,c7 with respect to a report to an agency1 describe-- 7i7 how the reporter should submit the report2 and 7ii7 if the report is not anonymous under subparagraph 7,b71 when the reporter should anticipate an acknowledgment of receipt of the report by the agency2 and 7,d7 include any other relevant information4 7#c7 ,identified vulnerabilities ,the head of each agency shall incorporate any vulnerabilities reported under paragraph 7#b7 into the vulnerability management process of the agency in order to track and remediate the vulnerability4 7e7 ,paperwork ,reduction ,act exemption ,the requirements of subchapter ,i 7commonly known as the ,paperwork ,reduction ,act7 shall not apply to a vulnerability disclosure program established under this section4 7f7 ,congressional reporting ,not later than #ij days after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjba1 and annually thereafter for a #c-year period1 the ,director shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the status of the use of vulnerability disclosure policies under this section at agencies1 including1 with respect to the guidance issued under subsection 7b77#c71 an identification of the agencies that are compliant and not compliant4 4 7b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei;,a the following3 #ceei;,b4 ,federal vulnerability disclosure programs4 4 #bji4 ,implementing presumption of compromise and zero trust architectures 7a7 ,recommendations ,not later than #fj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall develop recommendations to increase the internal defenses of agency systems to-- 7#a7 limit the ability of entities that cause incidents to move laterally through or between agency systems2 7#b7 identify incidents more quickly2 7#c7 isolate and remove unauthorized entities from agency systems more quickly2 7#d7 implement zero trust architecture2 and 7#e7 otherwise increase the resource costs for entities that cause incidents2 and 7b7 ,,omb ,guidance ,not later than #ahj days after the date on which the recommendations under subsection 7a7 are completed1 the ,director shall issue guidance to agencies that requires the implementation of the recommendations4 7c7 ,agency implementation plans ,not later than #fj days after the date on which the ,director issues guidance under subsection 7b71 the head of each agency shall submit to the ,director a plan to implement zero trust architecture that includes-- 7#a7 a description of any steps the agency has completed2 7#b7 an identification of activities that will have the most immediate security impact2 and 7#c7 a schedule to implement the plan4 7d7 ,report and briefing ,not later than #ij days after the date on which the ,director issues guidance required under subsection 7b71 the ,director shall provide a briefing to the appropriate congressional committees on the guidance and the agency implementation plans submitted under subsection 7c74 #baj4 ,automation reports 7a7 ,,omb ,report ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall submit to the appropriate congressional committees a report on the use of automation under paragraphs 7#a71 7#e77;,c7 and 7#g77;,b7 of section #ceed7;b7 of title #dd1 ,united ,states ,code4 7b7 ,,gao ,report ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall perform a study on the use of automation and machine readable data across the ,federal ,government for cybersecurity purposes1 including the automated updating of cybersecurity tools1 sensors1 or processes by agencies4 #baa4 ,extension of ,federal ,acquisition ,security ,council ,section #acbh of title #da1 ,united ,states ,code1 is amended by striking the date and all that follows and inserting ,december #ca1 #bjbf44 ,,iii ,pilot programs to enhance ,federal cybersecurity #cja4 ,continuous independent ,,fisma evaluation pilot 7a7 ,in general ,not later than #b years after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall establish a pilot program to perform continual agency auditing of the standards promulgated under section #aacca of title #dj1 ,united ,states ,code4 7b7 ,purpose 7#a7 ,in general ,the purpose of the pilot program established under subsection 7a7 shall be to develop the capability to continuously audit agency cybersecurity postures1 rather than performing an annual audit4 7#b7 ,use of information ,it is the sense of ,congress that information relating to agency cybersecurity postures should be used1 on an ongoing basis1 to increase agency understanding of cybersecurity risk and improve agency cybersecurity4 7c7 ,participating agencies 7#a7 ,in general ,the ,director1 in coordination with the ,council of the ,inspectors ,general on ,integrity and ,efficiency and in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall identify not less than #a agency and the ,inspector ,general of each identified agency to participate in the pilot program established under subsection 7a74 7#b7 ,capabilities of agency ,an agency selected under paragraph 7#a7 shall have advanced cybersecurity capabilities1 including the capability to implement verification specifications and other automated and machine-readable means of sharing information4 7#c7 ,capabilities of ,inspector ,general ,the ,inspector ,general of an agency selected under paragraph 7#a7 shall have advanced cybersecurity capabilities1 including the ability-- 7,a7 to perform real-time or almost real-time and continuous analysis of the use of verification specifications by the agency to assess compliance with standards promulgated under section #aacca of title #dj1 ,united ,states ,code2 and 7,b7 to assess the impact and deployment of additional cybersecurity procedures4 7d7 ,duties ,the ,director1 in coordination with the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the head of each agency participating in the pilot program under subsection 7c71 shall develop processes and procedures to perform a continuous independent evaluation of-- 7#a7 the compliance of the agency with-- 7,a7 the standards promulgated under section #aacca of title #dj1 ,united ,states ,code1 using verification specifications to the greatest extent practicable2 and 7,b7 any additional cybersecurity procedures implemented by the agency as a result of the evaluation performed under section #ceed7;a77#a77;,f7 of title #dd1 ,united ,states ,code2 and 7#b7 the overall cybersecurity posture of the agency1 which may include an evaluation of-- 7,a7 the status of cybersecurity remedial actions of the agency2 7,b7 any vulnerability information relating to agency systems that is known to the agency2 7,c7 incident information of the agency2 7,d7 penetration testing performed by an external entity under section #ceei;,a of title #dd1 ,united ,states ,code2 7,e7 information from the vulnerability disclosure program information established under section #ceei;,b of title #dd1 ,united ,states ,code2 7,f7 agency threat hunting results2 and 7,g7 any other information determined relevant by the ,director4 7e7 ,independent evaluation waiver ,with respect to an agency that participates in the pilot program under subsection 7a7 during any year other than the first year during which the pilot program is conducted1 the ,director1 with the concurrence of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 may waive any requirement of the agency with respect to the annual independent evaluation under section #ceee of title #dd1 ,united ,states ,code4 7f7 ,duration ,the pilot program established under this section-- 7#a7 shall be performed over a period of not less than #b years at each agency that participates in the pilot program under subsection 7c71 unless the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 determines that continuing the pilot program would reduce the cybersecurity of the agency2 and 7#b7 may be extended by the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 if the ,director makes the determination described in paragraph 7#a74 7g7 ,reports 7#a7 ,pilot program plan ,before identifying any agencies to participate in the pilot program under subsection 7c71 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 shall submit to the appropriate congressional committees a plan for the pilot program that outlines selection criteria and preliminary plans to implement the pilot program4 7#b7 ,briefing ,before commencing a continuous independent evaluation of any agency under the pilot program established under subsection 7a71 the ,director shall provide to the appropriate congressional committees a briefing on-- 7,a7 the selection of agencies to participate in the pilot program2 and 7,b7 processes and procedures to perform a continuous independent evaluation of agencies4 7#c7 ,pilot results ,not later than #fj days after the final day of each year during which an agency participates in the pilot program established under subsection 7a71 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 shall submit to the appropriate congressional committees a report on the results of the pilot program for each agency that participates in the pilot program during that year4 #cjb4 ,active cyber defensive pilot 7a7 ,definition ,in this section1 the term active defense technique-- 7#a7 means an action taken on the systems of an entity to increase the security of information on the network of an agency by misleading an adversary2 and 7#b7 includes a honeypot1 deception1 or purposefully feeding false or misleading data to an adversary when the adversary is on the systems of the entity4 7b7 ,study ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform a study on the use of active defense techniques to enhance the security of agencies1 which shall include-- 7#a7 a review of legal restrictions on the use of different active cyber defense techniques on ,federal networks2 7#b7 an evaluation of-- 7,a7 the efficacy of a selection of active defense techniques determined by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,b7 factors that impact the efficacy of the active defense techniques evaluated under subparagraph 7,a72 and 7#c7 the development of a framework for the use of different active defense techniques by agencies4 7c7 ,pilot program ,not later than #ahj days after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall establish a pilot program at not less than #b agencies to implement1 and assess the effectiveness of1 not less than #a active cyber defense technique4 7d7 ,purpose ,the purpose of the pilot program established under subsection 7c7 shall be to-- 7#a7 identify any statutory or policy limitations on using active defense techniques2 7#b7 understand the efficacy of using active defense techniques2 and 7#c7 implement the use of effective techniques to improve agency systems4 7e7 ,plan ,not later than #cfj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall develop a plan to offer any active defense technique determined to be successful during the pilot program established under subsection 7c7 as a shared service to other agencies4 7f7 ,reports ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide to the appropriate congressional committees a briefing on-- 7,a7 the results of the study performed under subsection 7b72 and 7,b7 the agencies selected to participate in the pilot program established under subsection 7c72 7#b7 submit to the appropriate congressional committees a report on the results of the pilot program established under subsection 7c71 including any recommendations developed from the results of the pilot program2 and 7#c7 submit to the appropriate congressional committees a copy of the plan developed under subsection 7e74 7g7 ,sunset 7#a7 ,in general ,the requirements of this section shall terminate on the date that is #c years after the date of enactment of this ,act4 7#b7 ,authority to continue use of techniques ,notwithstanding paragraph 7#a71 after the date described in paragraph 7#a71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency may continue to offer any active defense technique determined to be successful during the pilot program established under subsection 7c7 as a shared service to agencies4 #cjc4 ,security operations center as a service pilot 7a7 ,purpose ,the purpose of this section is for the ,cybersecurity and ,infrastructure ,security ,agency to run a security operation center on behalf of another agency1 alleviating the need to duplicate this function at every agency1 and empowering a greater centralized cybersecurity capability4 7b7 ,plan ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish a centralized ,federal security operations center shared service offering within the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,contents ,the plan required under subsection 7b7 shall include considerations for-- 7#a7 collecting1 organizing1 and analyzing agency information system data in real time2 7#b7 staffing and resources2 and 7#c7 appropriate interagency agreements1 concepts of operations1 and governance plans4 7d7 ,pilot program 7#a7 ,in general ,not later than #ahj days after the date on which the plan required under subsection 7b7 is developed1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall enter into a #a-year agreement with not less than #b agencies to offer a security operations center as a shared service4 7#b7 ,additional agreements ,after the date on which the briefing required under subsection 7e77#a7 is provided1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 may enter into additional #a-year agreements described in paragraph 7#a7 with agencies4 7e7 ,briefing and report 7#a7 ,briefing ,not later than #bfj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the parameters of any #a-year agreements entered into under subsection 7d77#a74 7#b7 ,report ,not later than #ij days after the date on which the first #a-year agreement entered into under subsection 7d7 expires1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report on-- 7,a7 the agreement2 and 7,b7 any additional agreements entered into with agencies under subsection 7d74