,i  #aahth ,,congress  #ast ,session    
,h4 ,r4 #caff  ,,in ,,the ,,house ,,of  
,,representatives  ,may #i1 #bjbc,mr4   
,torres of ,new ,york introduced the    
following bill2 which was referred to   
the ,committee on ,homeland ,security1  
and in addition to the ,committee on    
,oversight and ,accountability1 for a   
period to be subsequently determined by 
the ,speaker1 in each case for          
consideration of such provisions as fall
 within the jurisdiction of the         
committee concerned  ,a ,,bill  ,to     
require the ,cybersecurity and          
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security to  
submit a report on the impact of the    
,solar,winds cyber incident on          
information systems owned and operated  
by ,federal departments and agencies and
 other critical infrastructure1 and for 
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,building      
,cyber ,resilience ,after ,solar,winds  
,act of #bjbc4  #b4 ,building cyber     

resilience after ,solar,winds  7a7      
,definitions ,in this section3 7#a7     
,critical infrastructure ,the term      
critical infrastructure has the meaning 
given such term in section #ajaf7;e7 of 
,public ,law #ajg-ef 7#db ,u4,s4,c4     
#eaie;c7e774  7#b7 ,director ,the term  
,director means the ,director of the    
,cybersecurity and ,infrastructure      
,security ,agency4  7#c7 ,information   
system ,the term information system has 
the meaning given such term in section  
#bbjj of the ,homeland ,security ,act of
 #bjjb 7#f ,u4,s4,c4 #fej74  7#d7       
,significant cyber incident ,the term   
significant cyber incident has the      
meaning given such term in section #bbdj
 of the ,homeland ,security ,act of     
#bjjb 7#f ,u4,s4,c4 #fha74  7#e7        
,solarwinds incident ,the term          
,solar,winds incident refers to the     
significant cyber incident that prompted
 the establishment of a ,unified ,cyber 
,coordination ,group1 as provided by    
section ,v7,b77#b7 of ,presidential     

,policy ,directive #da1 in ,december    
#bjbj4  7b7 ,solar,winds investigation  
and report  7#a7 ,investigation ,the    
,director1 in consultation with the     
,national ,cyber ,director and the heads
 of other relevant ,federal departments 
and agencies1 shall carry out an        
investigation to evaluate the impact of 
the ,solar,winds incident on information
 systems owned and operated by ,federal 
departments and agencies1 and1 to the   
extent practicable1 other critical      
infrastructure4  7#b7 ,elements ,in     
carrying out subsection 7b71 the        
,director shall review the following3   
7,a7 ,the extent to which ,federal      
information systems were accessed1      
compromised1 or otherwise impacted by   
the ,solar,winds incident1 and any      
potential ongoing security concerns or  
consequences arising from such incident4
  7,b7 ,the extent to which information 
systems that support other critical     
infrastructure were accessed1           
compromised1 or otherwise impacted by   

the ,solar,winds incident1 where such   
information is available to the         
,director4  7,c7 ,any ongoing security  
concerns or consequences arising from   
the ,solar,winds incident1 including any
 sensitive information that may have    
been accessed or exploited in a manner  
that poses a threat to national         
security4  7,d7 ,implementation of      
,executive ,order #adjbh 7,improving the
 ,nation's ,cybersecurity 7,may #ab1    
#bjba774  7,e7 ,efforts taken by the    
,director1 the heads of ,federal        
departments and agencies1 and critical  
infrastructure owners and operators to  
address cybersecurity vulnerabilities   
and mitigate risks associated with the  
,solar,winds incident4  7c7 ,report ,not
 later than #abj days after the date of 
the enactment of this ,act1 the         
,director shall submit to the ,committee
 on ,homeland ,security of the ,house of
 ,representatives and ,committee on     
,homeland ,security and ,governmental   
,affairs of the ,senate a report that   

includes the following3 7#a7 ,findings  
for each of the elements specified in   
subsection 7b74  7#b7 ,recommendations  
to address security gaps1 improve       
incident response efforts1 and prevent  
similar cyber incidents4  7#c7 ,any     
areas with respect to which the         
,director lacked the information        
necessary to fully review and assessment
 such elements1 the reason the          
information necessary was unavailable1  
and recommendations to close such       
informational gaps4  7d7 ,,gao report on
 ,cyber ,safety ,review ,board ,not     
later than one year after the date of   
the enactment of this ,act1 the         
,comptroller ,general of the ,united    
,states shall evaluate the activities of
 the ,cyber ,safety ,review ,board      
established pursuant to ,executive      
,order #adjbh 7,improving the ,nation's 
,cybersecurity 7,may #ab1 #bjba771 with 
a focus on the ,board's inaugural review
 announced in ,february #bjbb1 and      
assess whether the ,board has the       

authorities1 resources1 and expertise   
necessary to carry out its mission of   
reviewing and assessing significant     
cyber incidents4