,,ib ,union ,calendar ,no4 #gij #aahth ,,congress #b;d ,session ,h4 ,r4 #deeb ,report ,no4 #aah-ici1 ,part ,i ,,in ,,the ,,house ,,of ,,representatives ,july #aa1 #bjbc,ms4 ,mace 7for herself1 ,mr4 ,raskin1 ,mr4 ,comer1 and ,mr4 ,connolly7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,accountability1 and in addition to the ,committees on ,science1 ,space1 and ,technology1 ,homeland ,security1 and ,armed ,services1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,december #ai1 #bjbd;,additional sponsor3 ,mr4 ,davis of ,north ,carolina ,december #ai1 #bjbd,reported from the ,committee on ,oversight and ,accountability with an amendment,strike out all after the enacting clause and insert the part printed in italic ,december #ai1 #bjbd ,committees on ,science1 ,space1 and ,technology1 ,homeland ,security1 and ,armed ,services discharged2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed,for text of introduced bill1 see copy of bill as introduced on ,july #aa1 #bjbc ,a ,,bill ,to improve the cybersecurity of the ,federal ,government1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,federal ,information ,security ,modernization ,act of #bjbd4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,amendments to title #dd4,sec4 #d4 ,amendments to subtitle ,,iii of title #dj4,sec4 #e4 ,actions to enhance ,federal incident transparency4,sec4 #f4 ,agency requirements to notify private sector entities impacted by incidents4,sec4 #g4 ,federal penetration testing policy4,sec4 #h4 ,vulnerability disclosure policies4,sec4 #i4 ,implementing zero trust architecture4,sec4 #aj4 ,automation and artificial intelligence4,sec4 #aa4 ,federal cybersecurity requirements4,sec4 #ab4 ,federal ,chief ,information ,security ,officer4,sec4 #ac4 ,renaming ,office of the ,federal ,chief ,information ,officer4,sec4 #ad4 ,rules of construction4 #b4 ,definitions ,in this ,act1 unless otherwise specified3 7#a7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 and 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#c7 ,awardee ,the term awardee has the meaning given the term in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act4 7#d7 ,contractor ,the term contractor has the meaning given the term in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act4 7#e7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#f7 ,federal information system ,the term ,federal information system has the meaning given the term in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act4 7#g7 ,incident ,the term incident has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#h7 ,national security system ,the term national security system has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#i7 ,penetration test ,the term penetration test has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7#aj7 ,threat hunting ,the term threat hunting means proactively and iteratively searching systems for threats and vulnerabilities1 including threats or vulnerabilities that may evade detection by automated threat detection systems4 7#aa7 ,zero trust architecture ,the term zero trust architecture has the meaning given the term in ,special ,publication #hjj-bjg of the ,national ,institute of ,standards and ,technology1 or any successor document4 #c4 ,amendments to title #dd 7a7 ,subchapter ,i amendments ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #cejd-- 7,a7 in subsection 7a77#a77;,b7-- 7i7 by striking clause 7v7 and inserting the following3 7v7 privacy1 confidentiality1 disclosure1 and sharing of information2 2 7ii7 by redesignating clause 7vi7 as clause 7vii72 and 7iii7 by inserting after clause 7v7 the following3 7vi7 in consultation with the ,national ,cyber ,director1 security of information2 and 2 and 7,b7 in subsection 7g7-- 7i7 by redesignating paragraph 7#b7 as paragraph 7#c72 and 7ii7 by striking paragraph 7#a7 and inserting the following3 7#a7 develop and oversee the implementation of policies1 principles1 standards1 and guidelines on privacy1 confidentiality1 disclosure1 and sharing of information collected or maintained by or for agencies2 7#b7 in consultation with the ,national ,cyber ,director1 oversee the implementation of policies1 principles1 standards1 and guidelines on security1 of information collected or maintained by or for agencies2 and 2 7#b7 in section #ceje-- 7,a7 by striking the first subsection designated as subsection 7c72 7,b7 in paragraph 7#b7 of the second subsection designated as subsection 7c71 by inserting an identification of internet accessible information systems and after an inventory under this subsection shall include2 7,c7 in paragraph 7#c7 of the second subsection designated as subsection 7c7-- 7i7 in subparagraph 7,b7-- 7,i7 by inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and before the ,comptroller ,general2 and 7,,ii7 by striking and at the end2 7ii7 in subparagraph 7,c77v71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 maintained on a continual basis through the use of automation1 machine-readable data1 and scanning1 wherever practicable4 2 7#c7 in section #cejf-- 7,a7 in subsection 7a77#c71 by inserting ,in carrying out these duties1 the ,chief ,information ,officer shall consult1 as appropriate1 with the ,chief ,data ,officer in accordance with the designated functions under section #cebj7;c74 after reduction of information collection burdens on the public42 7,b7 in subsection 7b77#a77;,c71 by inserting availability1 after integrity12 7,c7 in subsection 7h77#c71 by inserting security1 after efficiency12 and 7,d7 by adding at the end the following3 7j7 7#a7 ,notwithstanding paragraphs 7#b7 and 7#c7 of subsection 7a71 the head of each agency shall1 in accordance with section #ebb7;a7 of division ,h of the ,consolidated ,appropriations ,act1 #bjje 7#db ,u4,s4,c4 #bjjj;ee-#b71 designate a ,chief ,privacy ,officer with the necessary skills1 knowledge1 and expertise1 who shall have the authority and responsibility to-- 7,a7 lead the privacy program of the agency2 and 7,b7 carry out the privacy responsibilities of the agency under this chapter1 section #eeb;a of title #e1 and guidance issued by the ,director4 7#b7 ,the ,chief ,privacy ,officer of each agency shall-- 7,a7 serve in a central leadership position within the agency2 7,b7 have visibility into relevant agency operations2 and 7,c7 be positioned highly enough within the agency to regularly engage with other agency leaders and officials1 including the head of the agency4 7#c7 ,a privacy officer of an agency established under a statute enacted before the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd may carry out the responsibilities under this subsection for the agency4 2 and 7#d7 in section #ceac-- 7,a7 by redesignating subsection 7c7 as subsection 7d72 and 7,b7 by inserting after subsection 7b7 the following3 7c7 ,each agency providing a written plan under subsection 7b7 shall provide any portion of the written plan addressing information security to the ,secretary of ,homeland ,security and the ,national ,cyber ,director4 4 7b7 ,subchapter ,,ii definitions 7#a7 ,in general ,section #ceeb7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by redesignating paragraphs 7#b71 7#c71 7#d71 7#e71 7#f71 and 7#g7 as paragraphs 7#c71 7#d71 7#e71 7#f71 7#h71 and 7#aj71 respectively2 7,b7 by inserting after paragraph 7#a7 the following3 7#b7 ,the term high value asset means information or an information system that the head of an agency1 using policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a71 determines to be so critical to the agency that the loss or degradation of the confidentiality1 integrity1 or availability of such information or information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business4 2 7,c7 by inserting after paragraph 7#f71 as so redesignated1 the following3 7#g7 ,the term major incident has the meaning given the term in guidance issued by the ,director under section #ceih7;a74 2 7,d7 in paragraph 7#h77;,a71 as so redesignated1 in the matter preceding clause 7i71 by striking used and inserting owned1 managed12 7,e7 by inserting after paragraph 7#h71 as so redesignated1 the following3 7#i7 ,the term penetration test-- 7,a7 means an authorized assessment that emulates attempts to gain unauthorized access to1 or disrupt the operations of1 an information system or component of an information system2 and 7,b7 includes any additional meaning given the term in policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a74 2 and 7,f7 by inserting after paragraph 7#aj71 as so redesignated1 the following3 7#aa7 ,the term shared service means a centralized mission capability or consolidated business function that is provided to multiple organizations within an agency or to multiple agencies4 7#ab7 ,the term zero trust architecture has the meaning given the term in ,special ,publication #hjj-bjg of the ,national ,institute of ,standards and ,technology1 or any successor document4 4 7#b7 ,conforming amendments 7,a7 ,homeland ,security ,act of #bjjb ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7;c77#a77;,a77 is amended by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f77;,a7 and inserting section #ceeb7;b77#h77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iii7 ,section #cjfh ,section #cjfh7;b7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iv7 ,section #cbeb ,section #cbeb7;e77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,c7 ,high-,performance ,computing ,act of #aiia ,section #bjg7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is amended by striking section #ceeb7;b77#f77;,a77i7 and inserting section #ceeb7;b77#h77;,a77i74 7,d7 ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj ,section #c7e7 of the ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7#e77 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,e7 ,national ,defense ,authorization ,act for fiscal ,year #bjac ,section #icc7;e77#a77;,b7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7#aj ,u4,s4,c4 #bbbd note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa ,the ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa 7,public ,law #aaa-chc7 is amended-- 7i7 in section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b72 and 7ii7 in section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,g7 ,e-,government ,act of #bjjb ,section #cja7;c77#a77;,a7 of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,h7 ,national ,institute of ,standards and ,technology ,act ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7i7 in subsection 7a77#b71 by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b72 and 7ii7 in subsection 7f7-- 7,i7 in paragraph 7#b71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7,,ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b74 7c7 ,subchapter ,,ii amendments ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceea-- 7,a7 in paragraph 7#d71 by striking diagnose and improve and inserting integrate1 deliver1 diagnose1 and improve2 7,b7 in paragraph 7#e71 by striking and at the end2 7,c7 in paragraph 7#f71 by striking the period at the end and inserting a semicolon2 and 7,d7 by adding at the end the following3 7#g7 recognize that each agency has specific mission requirements and1 at times1 unique cybersecurity requirements to meet the mission of the agency2 7#h7 recognize that each agency does not have the same resources to secure agency systems1 and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone2 and 7#i7 recognize that a holistic ,federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies4 2 7#b7 in section #ceec-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#e71 by striking and at the end2 7ii7 in paragraph 7#f71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7#g7 promoting1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and the ,director of the ,national ,institute of ,standards and ,technology-- 7,a7 the use of automation to improve ,federal cybersecurity and visibility with respect to the implementation of ,federal cybersecurity2 and 7,b7 the use of presumption of compromise and least privilege principles1 such as zero trust architecture1 to improve resiliency and timely response actions to incidents on ,federal systems4 2 7,b7 in subsection 7b7-- 7i7 in the matter preceding paragraph 7#a71 by inserting and the ,national ,cyber ,director after ,director2 7ii7 in paragraph 7#b77;,a71 by inserting and reporting requirements under subchapter ,,iv of this chapter after section #ceef2 7iii7 by redesignating paragraphs 7#h7 and 7#i7 as paragraphs 7#aj7 and 7#aa71 respectively2 and 7iv7 by inserting after paragraph 7#g7 the following3 7#h7 expeditiously seeking opportunities to reduce costs1 administrative burdens1 and other barriers to information technology security and modernization for agencies1 including through shared services 7and appropriate commercial off the shelf options for such shared services7 for cybersecurity capabilities identified as appropriate by the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and other agencies as appropriate2 2 7,c7 in subsection 7c7-- 7i7 in the matter preceding paragraph 7#a7-- 7,i7 by striking each year and inserting each year during which agencies are required to submit reports under section #ceed7;c72 7,,ii7 by inserting 1 which shall be unclassified but may include #a or more annexes that contain classified or other sensitive information1 as appropriate after a report2 and 7,,iii7 by striking preceding year and inserting preceding #b years2 7ii7 by striking paragraph 7#a72 7iii7 by redesignating paragraphs 7#b71 7#c71 and 7#d7 as paragraphs 7#a71 7#b71 and 7#c71 respectively2 7iv7 in paragraph 7#c71 as so redesignated1 by striking and at the end2 and 7v7 by inserting after paragraph 7#c71 as so redesignated1 the following3 7#d7 a summary of the risks and trends identified in the ,federal risk assessment required under subsection 7i72 and 2 7,d7 in subsection 7h7-- 7i7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting and the ,national ,cyber ,director after in coordination with the ,director2 7,,ii7 in subparagraph 7,b71 by inserting 1 the scope of the required action 7such as applicable software1 firmware1 or hardware versions71 after reasons for the required action2 and 7,,iii7 in subparagraph 7,d71 by inserting 1 the ,national ,cyber ,director1 after notify the ,director2 and 7ii7 in paragraph 7#c77;,a77iv71 by inserting 1 the ,national ,cyber ,director after the ,secretary provides prior notice to the ,director2 7,e7 by amending subsection 7i7 to read as follows3 7i7 ,federal risk assessment ,on an ongoing and continual basis1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall assess the ,federal risk posture using any available information on the cybersecurity posture of agencies1 and brief the ,director and ,national ,cyber ,director on the findings of such assessment1 including-- 7#a7 the status of agency cybersecurity remedial actions for high value assets described in section #ceed7;b77#g72 7#b7 any vulnerability information relating to the systems of an agency that is known by the agency2 7#c7 analysis of incident information under section #ceig2 7#d7 evaluation of penetration testing performed under section #ceei;,a2 7#e7 evaluation of vulnerability disclosure program information under section #ceei;,b2 7#f7 evaluation of agency threat hunting results2 7#g7 evaluation of ,federal and non-,federal cyber threat intelligence2 7#h7 data on agency compliance with standards issued under section #aacca of title #dj2 7#i7 agency system risk assessments required under section #ceed7;a77#a77;,a72 7#aj7 relevant reports from inspectors general of agencies and the ,government ,accountability ,office2 and 7#aa7 any other information the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines relevant4 2 and 7,f7 by adding at the end the following3 7m7 ,directives 7#a7 ,emergency directive updates ,if the ,secretary issues an emergency directive under this section1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,director1 the ,national ,cyber ,director1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives an update on the status of the implementation of the emergency directive at agencies not later than #g days after the date on which the emergency directive requires an agency to complete a requirement specified by the emergency directive1 and every #cj days thereafter until-- 7,a7 the date on which every agency has fully implemented the emergency directive2 7,b7 the ,secretary determines that an emergency directive no longer requires active reporting from agencies or additional implementation2 or 7,c7 the date that is #a year after the issuance of the directive4 7#b7 ,binding operational directive updates ,if the ,secretary issues a binding operational directive under this section1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,director1 the ,national ,cyber ,director1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives an update on the status of the implementation of the binding operational directive at agencies not later than #cj days after the issuance of the binding operational directive1 and every #ij days thereafter until-- 7,a7 the date on which every agency has fully implemented the binding operational directive2 7,b7 the ,secretary determines that a binding operational directive no longer requires active reporting from agencies or additional implementation2 or 7,c7 the date that is #a year after the issuance or substantive update of the directive4 7#c7 ,report ,if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency ceases submitting updates required under paragraphs 7#a7 or 7#b7 on the date described in paragraph 7#a77;,c7 or 7#b77;,c71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,director1 the ,national ,cyber ,director1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives a list of every agency that1 at the time of the report-- 7,a7 has not completed a requirement specified by an emergency directive2 or 7,b7 has not implemented a binding operational directive4 7n7 ,review of ,office of ,management and ,budget guidance and policy 7#a7 ,conduct of review ,not less frequently than once every #c years1 the ,director of the ,office of ,management and ,budget shall review the efficacy of the guidance and policy promulgated by the ,director in reducing cybersecurity risks1 including a consideration of reporting and compliance burden on agencies4 7#b7 ,congressional notification ,the ,director of the ,office of ,management and ,budget shall notify the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,accountability of the ,house of ,representatives of the results of the review under paragraph 7#a74 7#c7 ,,gao review ,the ,government ,accountability ,office shall review guidance and policy promulgated by the ,director to assess its efficacy in risk reduction and burden on agencies4 7o7 ,automated standard implementation verification ,when the ,director of the ,national ,institute of ,standards and ,technology issues a proposed standard or guideline pursuant to paragraphs 7#b7 or 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 the ,director of the ,national ,institute of ,standards and ,technology shall consider developing and1 if appropriate and practical1 develop specifications to enable the automated verification of the implementation of the controls4 7p7 ,inspectors general access to federal risk assessments ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall1 upon request1 make available ,federal risk assessment information under subsection 7i7 to the ,inspector ,general of the ,department of ,homeland ,security and the inspector general of any agency that was included in the ,federal risk assessment4 2 7#c7 in section #ceed-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a7-- 7,i7 by redesignating subparagraphs 7,a71 7,b71 and 7,c7 as subparagraphs 7,b71 7,c71 and 7,d71 respectively2 7,,ii7 by inserting before subparagraph 7,b71 as so redesignated1 the following3 7,a7 on an ongoing and continual basis1 assessing agency system risk1 as applicable1 by-- 7i7 identifying and documenting the high value assets of the agency using guidance from the ,director2 7ii7 evaluating the data assets inventoried under section #ceaa for sensitivity to compromises in confidentiality1 integrity1 and availability2 7iii7 identifying whether the agency is participating in federally offered cybersecurity shared services programs2 7iv7 identifying agency systems that have access to or hold the data assets inventoried under section #ceaa2 7v7 evaluating the threats facing agency systems and data1 including high value assets1 based on ,federal and non-,federal cyber threat intelligence products1 where available2 7vi7 evaluating the vulnerability of agency systems and data1 including high value assets1 including by analyzing-- 7,i7 the results of penetration testing performed by the ,department of ,homeland ,security under section #ceec7;b77#i72 7,,ii7 the results of penetration testing performed under section #ceei;,a2 7,,iii7 information provided to the agency through the vulnerability disclosure program of the agency under section #ceei;,b2 7,,iv7 incidents2 and 7,v7 any other vulnerability information relating to agency systems that is known to the agency2 7vii7 assessing the impacts of potential agency incidents to agency systems1 data1 and operations based on the evaluations described in clauses 7ii7 and 7v7 and the agency systems identified under clause 7iv72 and 7viii7 assessing the consequences of potential incidents occurring on agency systems that would impact systems at other agencies1 including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system2 2 7,,iii7 in subparagraph 7,b71 as so redesignated1 in the matter preceding clause 7i71 by striking providing information and inserting using information from the assessment required under subparagraph 7,a71 providing information2 7,,iv7 in subparagraph 7,c71 as so redesignated-- 7aa7 in clause 7ii7 by inserting binding before operational2 and 7bb7 in clause 7vi71 by striking and at the end2 7,v7 in subparagraph 7,d71 as so redesignated1 by inserting and after the semicolon at the end2 and 7,,vi7 by adding at the end the following3 7,e7 providing an update on the ongoing and continual assessment required under subparagraph 7,a7-- 7i7 upon request1 to the inspector general of the agency or the ,comptroller ,general of the ,united ,states2 and 7ii7 at intervals determined by guidance issued by the ,director1 and to the extent appropriate and practicable using automation1 to-- 7,i7 the ,director2 7,,ii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,,iii7 the ,national ,cyber ,director2 2 7ii7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting in accordance with the agency system risk assessment required under paragraph 7#a77;,a7 after information systems2 and 7,,ii7 in subparagraph 7,d71 by inserting 1 through the use of penetration testing1 the vulnerability disclosure program established under section #ceei;,b1 and other means1 after periodically2 7iii7 in paragraph 7#c77;,a7-- 7,i7 in the matter preceding clause 7i71 by striking senior agency information security officer and inserting ,chief ,information ,security ,officer2 7,,ii7 in clause 7i71 by striking this section and inserting subsections 7a7 through 7c72 7,,iii7 in clause 7ii71 by striking training and and inserting skills1 training1 and2 7,,iv7 by redesignating clauses 7iii7 and 7iv7 as clauses 7iv7 and 7v71 respectively2 7,v7 by inserting after clause 7ii7 the following3 7iii7 manage information security1 cybersecurity budgets1 and risk and compliance activities and explain those concepts to the head of the agency and the executive team of the agency2 2 and 7,,vi7 in clause 7iv71 as so redesignated1 by striking information security duties as that official's primary duty and inserting information1 computer network1 and technology security duties as the ,chief ,information ,security ,officers' primary duty2 7iv7 in paragraph 7#e71 by striking annually and inserting not less frequently than quarterly2 and 7v7 in paragraph 7#f71 by striking official delegated and inserting ,chief ,information ,security ,officer delegated2 7,b7 in subsection 7b7-- 7i7 by striking paragraph 7#a7 and inserting the following3 7#a7 the ongoing and continual assessment of agency system risk required under subsection 7a77#a77;,a71 which may include using guidance and automated tools consistent with standards and guidelines promulgated under section #aacca of title #dj1 as applicable2 2 7ii7 in paragraph 7#b7-- 7,i7 by striking subparagraph 7,b72 7,,ii7 by redesignating subparagraphs 7,c7 and 7,d7 as subparagraphs 7,b7 and 7,c71 respectively2 and 7,,iii7 in subparagraph 7,c71 as so redesignated-- 7aa7 by redesignating clauses 7iii7 and 7iv7 as clauses 7iv7 and 7v71 respectively2 7bb7 by inserting after clause 7ii7 the following3 7iii7 binding operational directives and emergency directives issued by the ,secretary under section #ceec2 2 and 7cc7 in clause 7iv71 as so redesignated1 by striking as determined by the agency2 and inserting as determined by the agency1 considering the agency risk assessment required under subsection 7a77#a77;,a722 7iii7 in paragraph 7#e77;,a71 by inserting 1 including penetration testing1 as appropriate1 after shall include testing2 7iv7 by redesignating paragraphs 7#g7 and 7#h7 as paragraphs 7#h7 and 7#i71 respectively2 7v7 by inserting after paragraph 7#f7 the following3 7#g7 a process for securely providing the status of remedial cybersecurity actions and un-remediated identified system vulnerabilities of high value assets to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data as appropriate2 2 and 7vi7 in paragraph 7#h77;,c71 as so redesignated-- 7,i7 by striking clause 7ii7 and inserting the following3 7ii7 notifying and consulting with the ,federal information security incident center established under section #ceef pursuant to the requirements of section #ceid2 2 7,,ii7 by redesignating clause 7iii7 as clause 7iv72 7,,iii7 by inserting after clause 7ii7 the following3 7iii7 performing the notifications and other activities required under subchapter ,,iv of this chapter2 and 2 and 7,,iv7 in clause 7iv71 as so redesignated-- 7aa7 in subclause 7,,ii71 by adding and at the end2 7bb7 by striking subclause 7,,iii72 and 7cc7 by redesignating subclause 7,,iv7 as subclause 7,,iii72 and 7,c7 in subsection 7c7-- 7i7 by redesignating paragraph 7#b7 as paragraph 7#d72 7ii7 by striking paragraph 7#a7 and inserting the following3 7#a7 ,biennial report ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd and not less frequently than once every #b years thereafter1 using the ongoing and continual agency system risk assessment required under subsection 7a77#a77;,a71 the head of each agency shall submit to the ,director1 the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,comptroller ,general of the ,united ,states1 the majority and minority leaders of the ,senate1 the ,speaker and minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,accountability of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives1 and the appropriate authorization and appropriations committees of ,congress a report that-- 7,a7 summarizes the agency system risk assessment required under subsection 7a77#a77;,a72 7,b7 evaluates the adequacy and effectiveness of information security policies1 procedures1 and practices of the agency to address the risks identified in the agency system risk assessment required under subsection 7a77#a77;,a71 including an analysis of the agency's cybersecurity and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 7,c7 summarizes the status of remedial actions identified by inspector general of the agency1 the ,comptroller ,general of the ,united ,states1 and any other source determined appropriate by the head of the agency2 and 7,d7 includes the cybersecurity shared services offered by the ,cybersecurity and ,infrastructure ,security ,agency that the agency participates in1 if any1 and explanations for any non-participation in such services4 7#b7 ,unclassified reports ,each report submitted under paragraph 7#a7-- 7,a7 shall be1 to the greatest extent practicable1 in an unclassified and otherwise uncontrolled form2 and 7,b7 may include #a or more annexes that contain classified or other sensitive information1 as appropriate4 7#c7 ,briefings ,during each year during which a report is not required to be submitted under paragraph 7#a71 the ,director shall provide to the congressional committees described in paragraph 7#a7 a briefing summarizing current agency and ,federal risk postures4 2 and 7iii7 in paragraph 7#d71 as so redesignated1 by striking the period at the end and inserting 1 including the reporting procedures established under section #aacae7;d7 of title #dj and subsection 7a77#c77;,a77v7 of this section42 7#d7 in section #ceee-- 7,a7 in the section heading1 by striking ,annual independent and inserting ,independent2 7,b7 in subsection 7a7-- 7i7 in paragraph 7#a71 by inserting during which a report is required to be submitted under section #ceec7;c71 after ,each year2 7ii7 in paragraph 7#b77;,a71 by inserting 1 including by performing1 or reviewing the results of1 agency penetration testing and analyzing the vulnerability disclosure program of the agency after information systems2 and 7iii7 by adding at the end the following3 7#c7 ,an evaluation under this section may include recommendations for improving the cybersecurity posture of the agency4 2 7,c7 in subsection 7b77#a71 by striking annual2 7,d7 in subsection 7e77#a71 by inserting during which a report is required to be submitted under section #ceec7;c7 after ,each year2 7,e7 in subsection 7g77#b7-- 7i7 by striking this subsection shall and inserting 8this subsection-- 7,a7 shall 2 7ii7 in subparagraph 7,a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,b7 identify any entity that performs an independent evaluation under subsection 7b74 2 7,f7 by striking subsection 7j7 and inserting the following3 7j7 ,guidance 7#a7 ,in general ,the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,chief ,information ,officers ,council1 the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 and other interested parties as appropriate1 shall ensure the development of risk-based guidance for evaluating the effectiveness of an information security program and practices4 7#b7 ,priorities ,the risk-based guidance developed under paragraph 7#a7 shall include-- 7,a7 the identification of the most common successful threat patterns2 7,b7 the identification of security controls that address the threat patterns described in subparagraph 7,a72 7,c7 any other security risks unique to ,federal systems2 and 7,d7 any other element the ,director determines appropriate4 2 and 7,g7 by adding at the end the following3 7k7 ,coordination ,the head of each agency shall coordinate with the inspector general of the agency1 as applicable1 to ensure consistent understanding of agency cybersecurity or information security policies for the purpose of evaluations of such policies conducted by the inspector general4 2 and 7#e7 in section #ceef7;a7-- 7,a7 in the matter preceding paragraph 7#a71 by inserting within the ,cybersecurity and ,infrastructure ,security ,agency after incident center2 and 7,b7 in paragraph 7#d71 by striking #ceed7;b7 and inserting #ceed7;a77#a77;,a74 7d7 ,conforming amendments 7#a7 ,table of sections ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the item relating to section #ceee and inserting the following3 #ceee4 ,independent evaluation4 4 7#b7 ,,omb reports ,section #bbf7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebd7;c77 is amended-- 7,a7 in paragraph 7#a77;,b71 in the matter preceding clause 7i71 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7,b7 in paragraph 7#b77;,b71 in the matter preceding clause 7i7-- 7i7 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7ii7 by striking the report required under section #ceec7;c7 of title #dd1 ,united ,states ,code and inserting that report4 7#c7 ,,nist responsibilities ,section #bj7;d77#c77;,b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is amended by striking annual4 7e7 ,federal system incident response 7#a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,iv ,federal system incident response #ceia4 ,definitions 7a7 ,in general ,except as provided in subsection 7b71 the definitions under sections #cejb and #ceeb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,appropriate reporting entities ,the term appropriate reporting entities means-- 7,a7 the majority and minority leaders of the ,senate2 7,b7 the ,speaker and minority leader of the ,house of ,representatives2 7,c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,d7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 7,e7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7,f7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,g7 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives2 7,h7 the appropriate authorization and appropriations committees of ,congress2 7,i7 the ,director2 7,j7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,k7 the ,national ,cyber ,director2 7,l7 the ,comptroller ,general of the ,united ,states2 and 7,m7 the inspector general of any impacted agency4 7#b7 ,awardee ,the term awardee1 with respect to an agency-- 7,a7 means-- 7i7 the recipient of a grant from an agency2 7ii7 a party to a cooperative agreement with an agency2 and 7iii7 a party to an other transaction agreement with an agency2 and 7,b7 includes a subawardee of an entity described in subparagraph 7,a74 7#c7 ,breach ,the term breach-- 7,a7 means the compromise1 unauthorized disclosure1 unauthorized acquisition1 or loss of control of personally identifiable information owned1 maintained or otherwise controlled by an agency1 or any similar occurrence2 and 7,b7 includes any additional meaning given the term in policies1 principles1 standards1 or guidelines issued by the ,director4 7#d7 ,contractor ,the term contractor means a prime contractor of an agency or a subcontractor of a prime contractor of an agency that creates1 collects1 stores1 processes1 maintains1 or transmits ,federal information on behalf of an agency4 7#e7 ,federal information ,the term ,federal information means information created1 collected1 processed1 maintained1 disseminated1 disclosed1 or disposed of by or for the ,federal ,government in any medium or form4 7#f7 ,federal information system ,the term ,federal information system means an information system owned1 managed1 or operated by an agency1 or on behalf of an agency by a contractor1 an awardee1 or another organization4 7#g7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consumer reporting agency ,the term nationwide consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vulnerability disclosure ,the term vulnerability disclosure means a vulnerability identified under section #ceei;,b4 #ceib4 ,notification of breach 7a7 ,definition ,in this section1 the term covered breach means a breach-- 7#a7 involving not less than #ej1jjj potentially affected individuals2 or 7#b7 the result of which the head of an agency determines that notifying potentially affected individuals is necessary pursuant to subsection 7b77#a71 regardless of whether-- 7,a7 the number of potentially affected individuals is less than #ej1jjj2 or 7,b7 the notification is delayed under subsection 7d74 7b7 ,notification ,as expeditiously as practicable and without unreasonable delay1 and in any case not later than #de days after an agency has a reasonable basis to conclude that a breach has occurred1 the head of the agency1 in consultation with the ,chief ,information ,officer and ,chief ,privacy ,officer of the agency and1 as appropriate1 any non-,federal entity supporting the remediation of the breach1 shall-- 7#a7 determine whether notice to any individual potentially affected by the breach is appropriate1 including by conducting an assessment of the risk of harm to the individual that considers-- 7,a7 the nature and sensitivity of the personally identifiable information affected by the breach2 7,b7 the likelihood of access to and use of the personally identifiable information affected by the breach2 7,c7 the type of breach2 and 7,d7 any other factors determined by the ,director2 and 7#b7 if the head of the agency determines notification is necessary pursuant to paragraph 7#a71 provide written notification in accordance with subsection 7c7 to each individual potentially affected by the breach-- 7,a7 to the last known mailing address of the individual2 or 7,b7 through an appropriate alternative method of notification4 7c7 ,contents of notification ,each notification of a breach provided to an individual under subsection 7b77#b7 shall include1 to the maximum extent practicable-- 7#a7 a brief description of the breach2 7#b7 if possible1 a description of the types of personally identifiable information affected by the breach2 7#c7 contact information of the agency that may be used to ask questions of the agency1 which-- 7,a7 shall include an e-mail address or another digital contact mechanism2 and 7,b7 may include a telephone number1 mailing address1 or a website2 7#d7 information on any remedy being offered by the agency2 7#e7 any applicable educational materials relating to what individuals can do in response to a breach that potentially affects their personally identifiable information1 including relevant contact information for the appropriate ,federal law enforcement agencies and each nationwide consumer reporting agency2 and 7#f7 any other appropriate information1 as determined by the head of the agency or established in guidance by the ,director4 7d7 ,delay of notification 7#a7 ,in general ,the head of an agency1 in coordination with the ,director and the ,national ,cyber ,director1 and as appropriate1 the ,attorney ,general1 the ,director of ,national ,intelligence1 or the ,secretary of ,homeland ,security1 may delay a notification required under subsection 7b7 or 7e7 if the notification would-- 7,a7 impede a criminal investigation or a national security activity2 7,b7 cause an adverse result 7as described in section #bgje7;a77#b7 of title #ah72 7,c7 reveal sensitive sources and methods2 7,d7 cause damage to national security2 or 7,e7 hamper security remediation actions4 7#b7 ,renewal ,a delay under paragraph 7#a7 shall be for a period of #fj days and may be renewed4 7#c7 ,national security systems ,the head of an agency delaying notification under this subsection with respect to a breach exclusively of a national security system shall coordinate such delay with the ,secretary of ,defense4 7e7 ,update notification ,if an agency determines there is a significant change in the reasonable basis to conclude that a breach occurred1 a significant change to the determination made under subsection 7b77#a71 or that it is necessary to update the details of the information provided to potentially affected individuals as described in subsection 7c71 the agency shall as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after such a determination1 notify each individual who received a notification pursuant to subsection 7b7 of those changes4 7f7 ,delay of notification report 7#a7 ,in general ,not later than #a year after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd1 and annually thereafter1 the head of an agency1 in coordination with any official who delays a notification under subsection 7d71 shall submit to the appropriate reporting entities a report on each delay that occurred during the previous #b years4 7#b7 ,component of other report ,the head of an agency may submit the report required under paragraph 7#a7 as a component of the report submitted under section #ceed7;c74 7g7 ,congressional reporting requirements 7#a7 ,review and update ,on a periodic basis1 the ,director of the ,office of ,management and ,budget shall review1 and update as appropriate1 breach notification policies and guidelines for agencies4 7#b7 ,required notice from agencies ,subject to paragraph 7#d71 the ,director of the ,office of ,management and ,budget shall require the head of an agency affected by a covered breach to expeditiously and not later than #cj days after the date on which the agency discovers the covered breach give notice of the breach1 which may be provided electronically1 to-- 7,a7 each congressional committee described in section #ceed7;c77#a72 and 7,b7 the ,committee on the ,judiciary of the ,senate and the ,committee on the ,judiciary of the ,house of ,representatives4 7#c7 ,contents of notice ,notice of a covered breach provided by the head of an agency pursuant to paragraph 7#b7 shall include1 to the extent practicable-- 7,a7 information about the covered breach1 including a summary of any information about how the covered breach occurred known by the agency as of the date of the notice2 7,b7 an estimate of the number of individuals affected by the covered breach based on information known by the agency as of the date of the notice1 including an assessment of the risk of harm to affected individuals2 7,c7 a description of any circumstances necessitating a delay in providing notice to individuals affected by the covered breach in accordance with subsection 7d72 and 7,d7 an estimate of when the agency will provide notice to individuals affected by the covered breach1 if applicable4 7#d7 ,exception ,any agency that is required to provide notice to ,congress pursuant to paragraph 7#b7 due to a covered breach exclusively on a national security system shall only provide such notice to-- 7,a7 the majority and minority leaders of the ,senate2 7,b7 the ,speaker and minority leader of the ,house of ,representatives2 7,c7 the appropriations committees of ,congress2 7,d7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,e7 the ,select ,committee on ,intelligence of the ,senate2 7,f7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 and 7,g7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7#e7 ,rule of construction ,nothing in paragraphs 7#a7 through 7#c7 shall be construed to alter any authority of an agency4 7h7 ,rule of construction ,nothing in this section shall be construed to-- 7#a7 limit-- 7,a7 the authority of the ,director to issue guidance relating to notifications of1 or the head of an agency to notify individuals potentially affected by1 breaches that are not determined to be covered breaches or major incidents2 7,b7 the authority of the ,director to issue guidance relating to notifications and reporting of breaches1 covered breaches1 or major incidents2 7,c7 the authority of the head of an agency to provide more information than required under subsection 7b7 when notifying individuals potentially affected by a breach2 7,d7 the timing of incident reporting or the types of information included in incident reports provided1 pursuant to this subchapter1 to-- 7i7 the ,director2 7ii7 the ,national ,cyber ,director2 7iii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 or 7iv7 any other agency2 7,e7 the authority of the head of an agency to provide information to ,congress about agency breaches1 including-- 7i7 breaches that are not covered breaches2 and 7ii7 additional information beyond the information described in subsection 7g77#c72 or 7,f7 any congressional reporting requirements of agencies under any other law2 or 7#b7 limit or supersede any existing privacy protections in existing law4 #ceic4 ,congressional and executive branch reports on major incidents 7a7 ,appropriate congressional entities ,in this section1 the term appropriate congressional entities means-- 7#a7 the majority and minority leaders of the ,senate2 7#b7 the ,speaker and minority leader of the ,house of ,representatives2 7#c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7#d7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 7#e7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7#f7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7#g7 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives2 and 7#h7 the appropriate authorization and appropriations committees of ,congress4 7b7 ,initial notification 7#a7 ,in general ,not later than #gb hours after an agency has a reasonable basis to conclude that a major incident occurred1 the head of the agency impacted by the major incident shall submit to the appropriate reporting entities a written notification1 which may be submitted electronically and include #a or more annexes that contain classified or other sensitive information1 as appropriate4 7#b7 ,contents ,a notification required under paragraph 7#a7 with respect to a major incident shall include the following1 based on information available to agency officials as of the date on which the agency submits the notification3 7,a7 ,a summary of the information available about the major incident1 including how the major incident occurred and the threat causing the major incident4 7,b7 ,if applicable1 information relating to any breach associated with the major incident1 regardless of whether-- 7i7 the breach was the reason the incident was determined to be a major incident2 and 7ii7 head of the agency determined it was appropriate to provide notification to potentially impacted individuals pursuant to section #ceib7;b77#a74 7,c7 ,a preliminary assessment of the impacts to-- 7i7 the agency2 7ii7 the ,federal ,government2 7iii7 the national security1 foreign relations1 homeland security1 and economic security of the ,united ,states2 and 7iv7 the civil liberties1 public confidence1 privacy1 and public health and safety of the people of the ,united ,states4 7,d7 ,if applicable1 whether any ransom has been demanded or paid1 or is expected to be paid1 by any entity operating a ,federal information system or with access to ,federal information or a ,federal information system1 including1 as available1 the name of the entity demanding ransom1 the date of the demand1 and the amount and type of currency demanded1 unless disclosure of such information will disrupt an active ,federal law enforcement or national security operation4 7c7 ,supplemental update ,within a reasonable amount of time1 but not later than #cj days after the date on which the head of an agency submits a written notification under subsection 7b71 the head of the agency shall provide to the appropriate congressional entities an unclassified and written update1 which may include #a or more annexes that contain classified or other sensitive information1 as appropriate1 on the major incident1 based on information available to agency officials as of the date on which the agency provides the update1 on-- 7#a7 system vulnerabilities relating to the major incident1 where applicable1 means by which the major incident occurred1 the threat causing the major incident1 where applicable1 and impacts of the major incident to-- 7,a7 the agency2 7,b7 other ,federal agencies1 ,congress1 or the judicial branch2 7,c7 the national security1 foreign relations1 homeland security1 or economic security of the ,united ,states2 or 7,d7 the civil liberties1 public confidence1 privacy1 or public health and safety of the people of the ,united ,states2 7#b7 the status of compliance of the affected ,federal information system with applicable security requirements at the time of the major incident2 7#c7 if the major incident involved a breach1 a description of the affected information1 an estimate of the number of individuals potentially impacted1 and any assessment to the risk of harm to such individuals2 7#d7 an update to the assessment of the risk to agency operations1 or to impacts on other agency or non-,federal entity operations1 affected by the major incident2 7#e7 the detection1 response1 and remediation actions of the agency1 including any support provided by the ,cybersecurity and ,infrastructure ,security ,agency under section #ceid7;d71 if applicable2 7#f7 as appropriate and available1 actions undertaken by any non-,federal entities impacted by or supporting remediation of the major incident2 and 7#g7 as appropriate and available1 recommendations for mitigating future similar incidents1 including recommendations from any non-,federal entity impacted by or supporting the remediation of the major incident4 7d7 ,additional update ,if the head of an agency1 the ,director1 or the ,national ,cyber ,director determines that there is any significant change in the understanding of the scope1 scale1 or consequence of a major incident for which the head of the agency submitted a written notification and update under subsections 7b7 and 7c71 the head of the agency shall submit to the appropriate congressional entities a written update that includes information relating to the change in understanding4 7e7 ,biennial report ,each agency shall submit as part of the biennial report required under section #ceed7;c77#a7 a description of each major incident that occurred during the #b-year period preceding the date on which the biennial report is submitted4 7f7 ,report delivery 7#a7 ,in general ,any written notification or update required to be submitted under this section-- 7,a7 shall be submitted in an electronic format2 and 7,b7 may be submitted in a paper format4 7#b7 ,classification status ,any written notification or update required to be submitted under this section-- 7,a7 shall be-- 7i7 unclassified2 and 7ii7 submitted through unclassified electronic means pursuant to paragraph 7#a77;,a72 and 7,b7 may include classified annexes1 as appropriate4 7g7 ,report consistency ,to achieve consistent and coherent agency reporting to ,congress1 the ,national ,cyber ,director1 in coordination with the ,director1 shall-- 7#a7 provide recommendations to agencies on formatting and the contents of information to be included in the reports required under this section1 including recommendations for consistent formats for presenting any associated metrics2 and 7#b7 maintain a comprehensive record of each major incident notification1 update1 and briefing provided under this section1 which shall-- 7,a7 include1 at a minimum-- 7i7 the full contents of the written notification or update2 7ii7 the identity of the reporting agency2 and 7iii7 the date of submission2 and 7iv7 a list of the recipient congressional entities2 and 7,b7 be made available upon request to the majority and minority leaders of the ,senate1 the ,speaker and minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committee on ,oversight and ,accountability of the ,house of ,representatives4 7h7 ,national security systems congressional reporting exemption ,with respect to a major incident that occurs exclusively on a national security system1 the head of the affected agency shall submit the notifications and reports required to be submitted to ,congress under this section only to-- 7#a7 the majority and minority leaders of the ,senate2 7#b7 the ,speaker and minority leader of the ,house of ,representatives2 7#c7 the appropriations committees of ,congress2 7#d7 the appropriate authorization committees of ,congress2 7#e7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7#f7 the ,select ,committee on ,intelligence of the ,senate2 7#g7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 and 7#h7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7i7 ,major incidents including breaches ,if a major incident constitutes a covered breach1 as defined in section #ceib7;a71 information on the covered breach required to be submitted to ,congress pursuant to section #ceib7;g7 may-- 7#a7 be included in the notifications required under subsection 7b7 or 7c72 or 7#b7 be reported to ,congress under the process established under section #ceib7;g74 7j7 ,rule of construction ,nothing in this section shall be construed to-- 7#a7 limit-- 7,a7 the ability of an agency to provide additional reports or briefings to ,congress2 7,b7 ,congress from requesting additional information from agencies through reports1 briefings1 or other means2 and 7,c7 any congressional reporting requirements of agencies under any other law2 or 7#b7 limit or supersede any privacy protections under any other law4 #ceid4 ,government information sharing and incident response 7a7 ,in general 7#a7 ,incident sharing ,subject to paragraph 7#d7 and subsection 7b71 and in accordance with the applicable requirements pursuant to section #ceec7;b77#b77;,a7 for reporting to the ,federal information security incident center established under section #ceef1 the head of each agency shall provide to the ,cybersecurity and ,infrastructure ,security ,agency information relating to any incident affecting the agency1 whether the information is obtained by the ,federal ,government directly or indirectly4 7#b7 ,contents ,a provision of information relating to an incident made by the head of an agency under paragraph 7#a7 shall include1 at a minimum-- 7,a7 a full description of the incident1 including-- 7i7 all indicators of compromise and tactics1 techniques1 and procedures2 7ii7 an indicator of how the intruder gained initial access1 accessed agency data or systems1 and undertook additional actions on the network of the agency2 7iii7 information that would support enabling defensive measures2 and 7iv7 other information that may assist in identifying other victims2 7,b7 information to help prevent similar incidents1 such as information about relevant safeguards in place when the incident occurred and the effectiveness of those safeguards2 and 7,c7 information to aid in incident response1 such as-- 7i7 a description of the affected systems or networks2 7ii7 the estimated dates of when the incident occurred2 and 7iii7 information that could reasonably help identify any malicious actor that may have conducted or caused the incident1 subject to appropriate privacy protections4 7#c7 ,information sharing ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 make incident information provided under paragraph 7#a7 available to the ,director and the ,national ,cyber ,director2 7,b7 to the greatest extent practicable1 share information relating to an incident with-- 7i7 the head of any agency that may be-- 7,i7 impacted by the incident2 7,,ii7 particularly susceptible to the incident2 or 7,,iii7 similarly targeted by the incident2 and 7ii7 appropriate ,federal law enforcement agencies to facilitate any necessary threat response activities1 as requested2 7,c7 coordinate any necessary information sharing efforts relating to a major incident with the private sector2 and 7,d7 notify the ,national ,cyber ,director of any efforts described in subparagraph 7,c74 7#d7 ,national security systems exemption 7,a7 ,in general ,notwithstanding paragraphs 7#a7 and 7#c71 each agency operating or exercising control of a national security system shall share information about an incident that occurs exclusively on a national security system with the ,secretary of ,defense1 the ,director1 the ,national ,cyber ,director1 and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to the extent consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president4 7,b7 ,protections ,any information sharing and handling of information under this paragraph shall be appropriately protected consistent with procedures authorized for the protection of sensitive sources and methods or by procedures established for information that have been specifically authorized under criteria established by an ,executive order or an ,act of ,congress to be kept classified in the interest of national defense or foreign policy4 7b7 ,automation ,in providing information and selecting a method to provide information under subsection 7a71 the head of each agency shall implement subsection 7a77#a7 in a manner that provides such information to the ,cybersecurity and ,infrastructure ,security ,agency in an automated and machine-readable format1 to the greatest extent practicable4 7c7 ,incident response ,each agency that has a reasonable basis to suspect or conclude that a major incident occurred involving ,federal information in electronic medium or form that does not exclusively involve a national security system shall coordinate with-- 7#a7 the ,cybersecurity and ,infrastructure ,security ,agency to facilitate asset response activities and provide recommendations for mitigating future incidents2 and 7#b7 consistent with relevant policies1 appropriate ,federal law enforcement agencies to facilitate threat response activities4 #ceie4 ,responsibilities of contractors and awardees 7a7 ,notification 7#a7 ,in general ,any contractor or awardee of an agency shall provide written notification to the agency if the contractor or awardee has a reasonable basis to conclude that-- 7,a7 an incident or breach has occurred with respect to ,federal information the contractor or awardee collected1 used1 or maintained on behalf of an agency2 7,b7 an incident or breach has occurred with respect to a ,federal information system used1 operated1 managed1 or maintained on behalf of an agency by the contractor or awardee2 7,c7 a component of any ,federal information system operated1 managed1 or maintained by a contractor or awardee contains a security vulnerability1 including a supply chain compromise or an identified software or hardware vulnerability1 for which there is reliable evidence of a successful exploitation of the vulnerability by an actor without authorization of the ,federal information system owner2 or 7,d7 the contractor or awardee has received from the agency personally identifiable information or personal health information that is beyond the scope of the contract or agreement with the agency that the contractor or awardee is not authorized to receive4 7#b7 ,third-party notification of vulnerabilities ,subject to the guidance issued by the ,director pursuant to paragraph 7#d71 any contractor or awardee of an agency shall provide written notification to the agency and the ,cybersecurity and ,infrastructure ,security ,agency if the contractor or awardee has a reasonable basis to conclude that a component of any ,federal information system operated1 managed1 or maintained on behalf of an agency by the contractor or awardee on behalf of the agency contains a security vulnerability1 including a supply chain compromise or an identified software or hardware vulnerability1 that has been reported to the contractor or awardee by a third party1 including through a vulnerability disclosure program4 7#c7 ,procedures 7,a7 ,sharing with ,,cisa ,as soon as practicable following a notification of an incident or vulnerability to an agency by a contractor or awardee under paragraph 7#a71 the head of the agency shall provide1 pursuant to section #ceid1 information about the incident or vulnerability to the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7,b7 ,timing of notifications ,unless a different time for notification is specified in a contract1 grant1 cooperative agreement1 or other transaction agreement1 a contractor or awardee shall-- 7i7 make a notification required under paragraph 7#a7 not later than #a day after the date on which the contractor or awardee has reasonable basis to suspect or conclude that the criteria under paragraph 7#a7 have been met2 and 7ii7 make a notification required under paragraph 7#b7 within a reasonable time1 but not later than #ij days after the date on which the contractor or awardee has reasonable basis to suspect or conclude that the criteria under paragraph 7#b7 have been met4 7,c7 ,procedures ,following a notification of a breach or incident to an agency by a contractor or awardee under paragraph 7#a71 the head of the agency1 in consultation with the contractor or awardee1 shall carry out the applicable requirements under sections #ceib1 #ceic1 and #ceid with respect to the breach or incident4 7,d7 ,rule of construction ,nothing in subparagraph 7,b7 shall be construed to allow the negation of the requirements to notify vulnerabilities under paragraph 7#a7 or 7#b7 through a contract1 grant1 cooperative agreement1 or other transaction agreement4 7#d7 ,guidance ,the ,director shall issue guidance as soon as practicable to agencies relating to the scope of vulnerabilities to be included in required notifications under paragraph 7#b71 such as the minimum severity or minimum risk level of a vulnerability included in required notifications1 whether vulnerabilities that are already publicly disclosed must be reported1 or likely cybersecurity impact to ,federal information systems4 7b7 ,regulations2 modifications 7#a7 ,in general ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd-- 7,a7 the ,federal ,acquisition ,regulatory ,council shall promulgate regulations1 as appropriate1 relating to the responsibilities of contractors and recipients of other transaction agreements and cooperative agreements to comply with this section2 and 7,b7 the ,office of ,federal ,financial ,management shall promulgate regulations under title #b1 ,code of ,federal ,regulations1 as appropriate1 relating to the responsibilities of grantees to comply with this section4 7#b7 ,implementation ,not later than #a year after the date on which the ,federal ,acquisition ,regulatory ,council and the ,office of ,federal ,financial ,management promulgates regulations under paragraph 7#a71 the head of each agency shall implement policies and procedures1 as appropriate1 necessary to implement those regulations4 7#c7 ,congressional notification 7,a7 ,in general ,the head of each agency head shall notify the ,director upon implementation of policies and procedures necessary to implement the regulations promulgated under paragraph 7#a74 7,b7 ,,omb notification ,not later than #cj days after the date described in paragraph 7#b71 the ,director shall notify the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives on the status of the implementation by each agency of the regulations promulgated under paragraph 7#a74 7c7 ,allowable use ,information provided to an agency pursuant to this section may be disclosed to1 retained by1 and used by any agency1 component1 officer1 employee1 or agent of the ,federal ,government solely for any of the following3 7#a7 ,a cybersecurity purpose 7as defined in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej774 7#b7 ,identifying-- 7,a7 a cyber threat 7as defined in such section #bbjj71 including the source of the cyber threat2 or 7,b7 a security vulnerability 7as defined in such section #bbjj74 7#c7 ,preventing1 investigating1 disrupting1 or prosecuting an offense arising out of an incident notified to an agency pursuant to this section or any of the offenses listed in section #aje7;d77#e77;,a77v7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7d7 ,harmonization of other private-sector cybersecurity reporting obligations ,any non-,federal entity required to report an incident under section #bbdb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fha;b7 may submit as part of the written notification requirements in this section all information required by such section #bbdb to the agency of which the entity is a contractor or recipient of ,federal financial assistance1 or with which the entity holds an other transaction agreement or cooperative agreement1 within the deadline specified in subsection 7a77#c77;,b77#a74 ,if such submission is completed1 the non-,federal entity shall not be required to subsequently report the same incident under the requirements of such section #bbdb4 ,any incident information shared under this subsection shall be shared with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency pursuant to subsection 7a77#c77;,a74 7e7 ,national security systems exemption ,notwithstanding any other provision of this section1 a contractor or awardee of an agency that would be required to report an incident or vulnerability pursuant to this section that occurs exclusively on a national security system shall-- 7#a7 report the incident or vulnerability to the head of the agency and the ,secretary of ,defense2 and 7#b7 comply with applicable laws and policies relating to national security systems4 #ceif4 ,training 7a7 ,covered individual defined ,in this section1 the term covered individual means an individual who obtains access to a ,federal information system because of the status of the individual as-- 7#a7 an employee1 contractor1 awardee1 volunteer1 or intern of an agency2 or 7#b7 an employee of a contractor or awardee of an agency4 7b7 ,best practices and consistency ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 the ,national ,cyber ,director1 and the ,director of the ,national ,institute of ,standards and ,technology1 shall consolidate best practices to support consistency across agencies in cybersecurity incident response training1 including-- 7#a7 information to be collected and shared with the ,cybersecurity and ,infrastructure ,security ,agency pursuant to section #ceid7;a7 and processes for sharing such information2 and 7#b7 appropriate training and qualifications for cyber incident responders4 7c7 ,agency training ,the head of each agency shall develop training for covered individuals on how to identify and respond to an incident1 including-- 7#a7 the internal process of the agency for reporting an incident2 and 7#b7 the obligation of a covered individual to report to the agency any suspected or confirmed incident involving ,federal information in any medium or form1 including paper1 oral1 and electronic4 7d7 ,inclusion in annual training ,the training developed under subsection 7c7 may be included as part of an annual privacy1 security awareness1 or other appropriate training of an agency4 #ceig4 ,analysis and report on ,federal incidents 7a7 ,analysis of ,federal incidents 7#a7 ,quantitative and qualitative analyses ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform and1 in coordination with the ,director and the ,national ,cyber ,director1 develop1 continuous monitoring and quantitative and qualitative analyses of incidents at agencies1 including major incidents1 including-- 7,a7 the causes of incidents1 including-- 7i7 attacker tactics1 techniques1 and procedures2 and 7ii7 system vulnerabilities1 including zero days1 unpatched systems1 and information system misconfigurations2 7,b7 the scope and scale of incidents at agencies2 7,c7 common root causes of incidents across multiple agencies2 7,d7 agency incident response1 recovery1 and remediation actions and the effectiveness of those actions1 as applicable2 7,e7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,f7 trends across multiple agencies to address intrusion detection and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7#b7 ,automated analysis ,the analyses developed under paragraph 7#a7 shall1 to the greatest extent practicable1 use machine-readable data1 automation1 and machine learning processes4 7#c7 ,sharing of data and analysis 7,a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall share on an ongoing basis the analyses and underlying data required under this subsection with agencies1 the ,director1 and the ,national ,cyber ,director to-- 7i7 improve the understanding of cybersecurity risk of agencies2 and 7ii7 support the cybersecurity improvement efforts of agencies4 7,b7 ,format ,in carrying out subparagraph 7,a71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall share the analyses-- 7i7 in human-readable written products2 and 7ii7 to the greatest extent practicable1 in machine-readable formats in order to enable automated intake and use by agencies4 7,c7 ,exemption ,this subsection shall not apply to incidents that occur exclusively on national security systems4 7b7 ,annual report on ,federal incidents ,not later than #b years after the date of enactment of this section1 and not less frequently than annually thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 the ,national ,cyber ,director and the heads of other agencies1 as appropriate1 shall submit to the appropriate reporting entities a report that includes-- 7#a7 a summary of causes of incidents from across the ,federal ,government that categorizes those incidents as incidents or major incidents2 7#b7 the quantitative and qualitative analyses of incidents developed under subsection 7a77#a7 on an agency-by-agency basis and comprehensively across the ,federal ,government1 including-- 7,a7 a specific analysis of breaches2 and 7,b7 an analysis of the ,federal ,government's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 and 7#c7 an annex for each agency that includes-- 7,a7 a description of each major incident2 7,b7 the total number of incidents of the agency2 and 7,c7 an analysis of the agency's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7c7 ,publication 7#a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall make a version of each report submitted under subsection 7b7 publicly available on the website of the ,cybersecurity and ,infrastructure ,security ,agency during the year during which the report is submitted4 7#b7 ,exemption ,the publication requirement under paragraph 7#a7 shall not apply to a portion of a report that contains content that should be protected in the interest of national security1 as determined by the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 or the ,national ,cyber ,director4 7#c7 ,limitation on exemption ,the exemption under paragraph 7#b7 shall not apply to any version of a report submitted to the appropriate reporting entities under subsection 7b74 7#d7 ,requirement for compiling information 7,a7 ,compilation ,subject to subparagraph 7,b71 in making a report publicly available under paragraph 7#a71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall sufficiently compile information so that no specific incident of an agency can be identified4 7,b7 ,exception ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency may include information that enables a specific incident of an agency to be identified in a publicly available report-- 7i7 with the concurrence of the ,director and the ,national ,cyber ,director2 7ii7 in consultation with the impacted agency1 which may1 as appropriate1 consult with any non-,federal entity impacted by or supporting the remediation of such incident2 and 7iii7 in consultation with the inspector general of the impacted agency4 7d7 ,information provided by agencies 7#a7 ,in general ,the analysis required under subsection 7a7 and each report submitted under subsection 7b7 shall use information provided by agencies under section #ceid7;a74 7#b7 ,noncompliance reports ,during any year during which the head of an agency does not provide data for an incident to the ,cybersecurity and ,infrastructure ,security ,agency in accordance with section #ceid7;a71 the head of the agency1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,director1 shall submit to the appropriate reporting entities a report that includes the information described in subsection 7b7 with respect to the agency4 7e7 ,national security system reports 7#a7 ,in general ,notwithstanding any other provision of this section1 the ,secretary of ,defense1 in consultation with the ,director1 the ,national ,cyber ,director1 the ,director of ,national ,intelligence1 and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall annually submit a report that includes the information described in subsection 7b7 with respect to national security systems1 to the extent that the submission is consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president1 to-- 7,a7 the majority and minority leaders of the ,senate2 7,b7 the ,speaker and minority leader of the ,house of ,representatives2 7,c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,d7 the ,select ,committee on ,intelligence of the ,senate2 7,e7 the ,committee on ,armed ,services of the ,senate2 7,f7 the ,committee on ,appropriations of the ,senate2 7,g7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7,h7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,i7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives2 7,j7 the ,committee on ,armed ,services of the ,house of ,representatives2 and 7,k7 the ,committee on ,appropriations of the ,house of ,representatives4 7#b7 ,classified form ,a report required under paragraph 7#a7 may be submitted in a classified form4 #ceih4 ,major incident definition 7a7 ,in general ,not later than #a year after the later of the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd and the most recent publication by the ,director of guidance to agencies regarding major incidents as of the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbd1 the ,director shall develop1 in coordination with the ,national ,cyber ,director1 and promulgate guidance on the definition of the term major incident for the purposes of subchapter ,,ii and this subchapter4 7b7 ,requirements ,with respect to the guidance issued under subsection 7a71 the definition of the term major incident shall-- 7#a7 include1 with respect to any information collected or maintained by or on behalf of an agency or a ,federal information system-- 7,a7 any incident the head of the agency determines is likely to result in demonstrable harm to-- 7i7 the national security interests1 foreign relations1 homeland security1 or economic security of the ,united ,states2 or 7ii7 the civil liberties1 public confidence1 privacy1 or public health and safety of the people of the ,united ,states2 7,b7 any incident the head of the agency determines likely to result in an inability or substantial disruption for the agency1 a component of the agency1 or the ,federal ,government1 to provide #a or more critical services2 7,c7 any incident the head of the agency determines substantially disrupts or substantially degrades the operations of a high value asset owned or operated by the agency2 7,d7 any incident involving the exposure to a foreign entity of sensitive agency information1 such as the communications of the head of the agency1 the head of a component of the agency1 or the direct reports of the head of the agency or the head of a component of the agency2 and 7,e7 any other type of incident determined appropriate by the ,director2 7#b7 stipulate that the ,national ,cyber ,director1 in consultation with the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 may declare a major incident at any agency1 and such a declaration shall be considered if it is determined that an incident-- 7,a7 occurs at not less than #b agencies2 and 7,b7 is enabled by-- 7i7 a common technical root cause1 such as a supply chain compromise1 or a common software or hardware vulnerability2 or 7ii7 the related activities of a common threat actor2 7#c7 stipulate that1 in determining whether an incident constitutes a major incident under the standards described in paragraph 7#a71 the head of the agency shall consult with the ,national ,cyber ,director2 and 7#d7 stipulate that the mere report of a vulnerability discovered or disclosed without a loss of confidentiality1 integrity1 or availability shall not on its own constitute a major incident4 7c7 ,evaluation and updates ,not later than #fj days after the date on which the ,director first promulgates the guidance required under subsection 7a71 and not less frequently than once during the first #ij days of each evenly numbered ,congress thereafter1 the ,director shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives a briefing that includes-- 7#a7 an evaluation of any necessary updates to the guidance2 7#b7 an evaluation of any necessary updates to the definition of the term major incident included in the guidance2 and 7#c7 an explanation of1 and the analysis that led to1 the definition described in paragraph 7#b74 4 7#b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,subchapter ,,iv--,federal system incident response #ceia4 ,definitions4 #ceib4 ,notification of breach4 #ceic4 ,congressional and executive branch reports on major incidents4#ceid4 ,government information sharing and incident response4 #ceie4 ,responsibilities of contractors and awardees4 #ceif4 ,training4 #ceig4 ,analysis and report on ,federal incidents4 #ceih4 ,major incident definition4 4 #d4 ,amendments to subtitle ,,iii of title #dj 7a7 ,modernizing government technology ,subtitle ,g of title ,x of division ,a of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjah 7#dj ,u4,s4,c4 #aacja note7 is amended in section #ajgh-- 7#a7 by striking subsection 7a7 and inserting the following3 7a7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,high value asset ,the term high value asset has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 2 7#b7 in subsection 7b71 by adding at the end the following3 7#h7 ,proposal evaluation ,the ,director shall-- 7,a7 give consideration for the use of amounts in the ,fund to improve the security of high value assets2 and 7,b7 require that any proposal for the use of amounts in the ,fund includes1 as appropriate1 and which may be incorporated into otherwise required project proposal documentation-- 7i7 cybersecurity risk management considerations2 and 7ii7 a supply chain risk assessment in accordance with section #acbf of title #da4 2 and 7#c7 in subsection 7c7-- 7,a7 in paragraph 7#b77;,a77i71 by inserting 1 including a consideration of the impact on high value assets after operational risks2 7,b7 in paragraph 7#e7-- 7i7 in subparagraph 7,a71 by striking and at the end2 7ii7 in subparagraph 7,b71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,c7 a senior official from the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 appointed by the ,director4 2 and 7,c7 in paragraph 7#f77;,a71 by striking shall be-- and all that follows through #d employees and inserting shall be #d employees4 7b7 ,subchapter ,i ,subchapter ,i of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacjb-- 7,a7 in subsection 7b71 by striking use1 security1 and disposal of and inserting use1 and disposal of1 and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director1 promote and improve the security of12 and 7,b7 in subsection 7h71 by inserting 1 including cybersecurity performances1 after the performances2 and 7#b7 in section #aacjc7;b77#b77;,b7-- 7,a7 in clause 7i71 by striking or at the end2 7,b7 in clause 7ii71 by adding or at the end2 and 7,c7 by adding at the end the following3 7iii7 whether the function should be performed by a shared service offered by another executive agency2 4 7c7 ,subchapter ,,ii ,subchapter ,,ii of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacab7;a71 by inserting 1 including security risks after managing the risks2 7#b7 in section #aacac7a71 by striking efficiency and effectiveness and inserting efficiency1 security1 and effectiveness2 7#c7 in section #aacag1 by inserting security1 before or schedule2 and 7#d7 in section #aacai7;b77#a71 in the paragraph heading1 by striking cios and inserting chief information officers4 #e4 ,actions to enhance ,federal incident transparency 7a7 ,responsibilities of the ,cybersecurity and ,infrastructure ,security ,agency 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 develop a plan for the development1 using systems in place on the date of enactment of this ,act1 of the analysis required under section #ceig7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act1 and the report required under subsection 7b7 of that section that includes-- 7i7 a description of any challenges the ,director of the ,cybersecurity and ,infrastructure ,security ,agency anticipates encountering2 and 7ii7 the use of automation and machine-readable formats for collecting1 compiling1 monitoring1 and analyzing data2 and 7,b7 provide to the appropriate congressional committees a briefing on the plan developed under subparagraph 7,a74 7#b7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a briefing on-- 7,a7 the execution of the plan required under paragraph 7#a77;,a72 and 7,b7 the development of the report required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7b7 ,responsibilities of the director of the office of management and budget 7#a7 ,updating ,,fisma #bjad ,section #b of the ,federal ,information ,security ,modernization ,act of #bjad 7,public ,law #aac-bhc2 #abh ,stat4 #cjgc7 is amended-- 7,a7 by striking subsections 7b7 and 7d72 and 7,b7 by redesignating subsections 7c71 7e71 and 7f7 as subsections 7b71 7c71 and 7d71 respectively4 7#b7 ,incident data sharing 7,a7 ,in general ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop1 and as appropriate update1 guidance1 on the content1 timeliness1 and format of the information provided by agencies under section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,requirements ,the guidance developed under subparagraph 7,a7 shall-- 7i7 enable the efficient development of-- 7,i7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,,ii7 the report on ,federal incidents required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this ,act2 and 7ii7 include requirements for the timeliness of data production4 7,c7 ,automation ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall promote1 as feasible1 the use of automation and machine-readable data for data sharing under section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7#c7 ,contractor and awardee guidance 7,a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director shall issue guidance to agencies on how to deconflict1 to the greatest extent practicable1 existing regulations1 policies1 and procedures relating to the responsibilities of contractors and awardees established under section #ceie of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,existing processes ,to the greatest extent practicable1 the guidance issued under subparagraph 7,a7 shall allow contractors and awardees to use existing processes for notifying agencies of incidents involving information of the ,federal ,government4 7c7 ,update to the ,privacy act of #aigd ,section #eeb;a7b7 of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd7 is amended-- 7#a7 in paragraph 7#aa71 by striking or at the end2 7#b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 or2 and 7#c7 by adding at the end the following3 7#ac7 to another agency1 to the extent necessary1 to assist the recipient agency in responding to an incident 7as defined in section #ceeb of title #dd7 or breach 7as defined in section #ceia of title #dd7 or to fulfill the information sharing requirements under section #ceid of title #dd4 4 #f4 ,agency requirements to notify private sector entities impacted by incidents 7a7 ,definitions ,in this section3 7#a7 ,reporting entity ,the term reporting entity means private organization or governmental unit that is required by statute or regulation to submit sensitive information to an agency4 7#b7 ,sensitive information ,the term sensitive information has the meaning given the term by the ,director in guidance issued under subsection 7b74 7b7 ,guidance on notification of reporting entities ,not later than #a year after the date of enactment of this ,act1 the ,director shall develop1 in consultation with the ,national ,cyber ,director1 and issue guidance requiring the head of each agency to notify a reporting entity in an appropriate and timely manner1 and take into consideration the need to coordinate with ,sector ,risk ,management ,agencies 7as defined in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej771 as appropriate1 of an incident at the agency that is likely to substantially affect-- 7#a7 the confidentiality or integrity of sensitive information submitted by the reporting entity to the agency pursuant to a statutory or regulatory requirement2 or 7#b7 any information system 7as defined in section #cejb of title #dd1 ,united ,states ,code7 used in the transmission or storage of the sensitive information described in paragraph 7#a74 #g4 ,federal penetration testing policy 7a7 ,in general ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceei;,a4 ,federal penetration testing 7a7 ,guidance ,the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies that-- 7#a7 requires agencies to perform penetration testing on information systems1 as appropriate1 including on high value assets2 7#b7 provides policies governing the development of-- 7,a7 rules of engagement for using penetration testing2 and 7,b7 procedures to use the results of penetration testing to improve the cybersecurity and risk management of the agency2 7#c7 ensures that operational support or a shared service is available2 and 7#d7 in no manner restricts the authority of the ,secretary of ,homeland ,security or the ,director of the ,cybersecurity and ,infrastructure ,agency to conduct threat hunting pursuant to section #ceec1 or penetration testing under this chapter4 7b7 ,exception for national security systems ,the guidance issued under subsection 7a7 shall not apply to national security systems4 7c7 ,delegation of authority for certain systems ,the authorities of the ,director described in subsection 7a7 shall be delegated to-- 7#a7 the ,secretary of ,defense in the case of a system described in section #ceec7;e77#b72 and 7#b7 the ,director of ,national ,intelligence in the case of a system described in section #ceec7;e77#c74 4 7b7 ,existing guidance 7#a7 ,in general ,compliance with guidance issued by the ,director relating to penetration testing before the date of enactment of this ,act shall be deemed to be compliant with section #ceei;,a of title #dd1 ,united ,states ,code1 as added by this ,act4 7#b7 ,immediate new guidance not required ,nothing in section #ceei;,a of title #dd1 ,united ,states ,code1 as added by this ,act1 shall be construed to require the ,director to issue new guidance to agencies relating to penetration testing before the date described in paragraph 7#c74 7#c7 ,guidance updates ,notwithstanding paragraphs 7#a7 and 7#b71 not later than #b years after the date of enactment of this ,act1 the ,director shall review and1 as appropriate1 update existing guidance requiring penetration testing by agencies4 7c7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei the following3 #ceei;,a4 ,federal penetration testing4 4 7d7 ,penetration testing by the ,secretary of ,homeland ,security ,section #ceec7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 is further amended by inserting after paragraph 7#h7 the following3 7#i7 performing penetration testing that may leverage manual expert analysis to identify threats and vulnerabilities within information systems-- 7,a7 without consent or authorization from agencies2 and 7,b7 with prior consultation with the head of the agency at least #gb hours in advance of such testing2 4 #h4 ,vulnerability disclosure policies 7a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by inserting after section #ceei;,a1 as added by this ,act1 the following3 #ceei;,b4 ,federal vulnerability disclosure policies 7a7 ,purpose2 sense of ,congress 7#a7 ,purpose ,the purpose of ,federal vulnerability disclosure policies is to create a mechanism to enable the public to inform agencies of vulnerabilities in ,federal information systems4 7#b7 ,sense of ,congress ,it is the sense of ,congress that1 in implementing the requirements of this section1 the ,federal ,government should take appropriate steps to reduce real and perceived burdens in communications between agencies and security researchers4 7b7 ,definitions ,in this section3 7#a7 ,contractor ,the term contractor has the meaning given the term in section #ceia4 7#b7 ,internet of things ,the term internet of things has the meaning given the term in ,special ,publication #hjj-bac of the ,national ,institute of ,standards and ,technology1 entitled ,io,t ,device ,cybersecurity ,guidance for the ,federal ,government3 ,establishing ,io,t ,device ,cybersecurity ,requirements1 or any successor document4 7#c7 ,security vulnerability ,the term security vulnerability has the meaning given the term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#d7 ,submitter ,the term submitter means an individual that submits a vulnerability disclosure report pursuant to the vulnerability disclosure process of an agency4 7#e7 ,vulnerability disclosure report ,the term vulnerability disclosure report means a disclosure of a security vulnerability made to an agency by a submitter4 7c7 ,guidance ,the ,director shall issue guidance to agencies that includes-- 7#a7 use of the information system security vulnerabilities disclosure process guidelines established under section #d7;a77#a7 of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;b7a77#a772 7#b7 direction to not recommend or pursue legal action against a submitter or an individual that conducts a security research activity that-- 7,a7 represents a good faith effort to identify and report security vulnerabilities in information systems2 or 7,b7 otherwise represents a good faith effort to follow the vulnerability disclosure policy of the agency developed under subsection 7f77#b72 7#c7 direction on sharing relevant information in a consistent1 automated1 and machine-readable manner with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7#d7 the minimum scope of agency systems required to be covered by the vulnerability disclosure policy of an agency required under subsection 7f77#b71 including exemptions under subsection 7g72 7#e7 requirements for providing information to the submitter of a vulnerability disclosure report on the resolution of the vulnerability disclosure report2 7#f7 a stipulation that the mere identification by a submitter of a security vulnerability1 without a significant compromise of confidentiality1 integrity1 or availability1 does not constitute a major incident2 and 7#g7 the applicability of the guidance to internet of things devices owned or controlled by an agency4 7d7 ,consultation ,in developing the guidance required under subsection 7c77#c71 the ,director shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7e7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide support to agencies with respect to the implementation of the requirements of this section2 7#b7 develop tools1 processes1 and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section2 7#c7 upon a request by an agency1 assist the agency in the disclosure to vendors of newly identified security vulnerabilities in vendor products and services2 and 7#d7 as appropriate1 implement the requirements of this section1 in accordance with the authority under section #ceec7;b77#h71 as a shared service available to agencies4 7f7 ,responsibilities of agencies 7#a7 ,public information ,the head of each agency shall make publicly available1 with respect to each internet domain under the control of the agency that is not a national security system and to the extent consistent with the security of information systems but with the presumption of disclosure-- 7,a7 an appropriate security contact2 and 7,b7 the component of the agency that is responsible for the internet accessible services offered at the domain4 7#b7 ,vulnerability disclosure policy ,the head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency1 which shall-- 7,a7 describe-- 7i7 the scope of the systems of the agency included in the vulnerability disclosure policy1 including for internet of things devices owned or controlled by the agency2 7ii7 the type of information system testing that is authorized by the agency2 7iii7 the type of information system testing that is not authorized by the agency2 7iv7 the disclosure policy for a contractor2 and 7v7 the disclosure policy of the agency for sensitive information2 7,b7 with respect to a vulnerability disclosure report to an agency1 describe-- 7i7 how the submitter should submit the vulnerability disclosure report2 and 7ii7 if the report is not anonymous1 when the reporter should anticipate an acknowledgment of receipt of the report by the agency2 7,c7 include any other relevant information2 and 7,d7 be mature in scope and cover every internet accessible information system used or operated by that agency or on behalf of that agency4 7#c7 ,identified security vulnerabilities ,the head of each agency shall-- 7,a7 consider security vulnerabilities reported in accordance with paragraph 7#b72 7,b7 commensurate with the risk posed by the security vulnerability1 address such security vulnerability using the security vulnerability management process of the agency2 and 7,c7 in accordance with subsection 7c77#e71 provide information to the submitter of a vulnerability disclosure report4 7g7 ,exemptions 7#a7 ,in general ,the ,director and the head of each agency shall carry out this section in a manner consistent with the protection of national security information4 7#b7 ,limitation ,the ,director and the head of each agency may not publish under subsection 7f77#a7 or include in a vulnerability disclosure policy under subsection 7f77#b7 host names1 services1 information systems1 or other information that the ,director or the head of an agency1 in coordination with the ,director and other appropriate heads of agencies1 determines would-- 7,a7 disrupt a law enforcement investigation2 7,b7 endanger national security or intelligence activities2 or 7,c7 impede national defense activities or military operations4 7#c7 ,national security systems ,this section shall not apply to national security systems4 7h7 ,delegation of authority for certain systems ,the authorities of the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency described in this section shall be delegated-- 7#a7 to the ,secretary of ,defense in the case of systems described in section #ceec7;e77#b72 and 7#b7 to the ,director of ,national ,intelligence in the case of systems described in section #ceec7;e77#c74 7i7 ,revision of ,federal acquisition regulation ,the ,federal ,acquisition ,regulation shall be revised as necessary to implement the provisions under this section4 4 7b7 ,existing guidance and policies 7#a7 ,in general ,compliance with guidance issued by the ,director relating to vulnerability disclosure policies before the date of enactment of this ,act shall be deemed to be compliance with section #ceei;,b of title #dd1 ,united ,states ,code1 as added by this title4 7#b7 ,immediate new guidance not required ,nothing in section #ceei;,b of title #dd1 ,united ,states ,code1 as added by this title1 shall be construed to require the ,director to issue new guidance to agencies relating to vulnerability disclosure policies before the date described in paragraph 7#d74 7#c7 ,immediate new policies not required ,nothing in section #ceei;,b of title #dd1 ,united ,states ,code1 as added by this title1 shall be construed to require the head of any agency to issue new policies relating to vulnerability disclosure policies before the issuance of any updated guidance under paragraph 7#d74 7#d7 ,guidance update ,notwithstanding paragraphs 7#a71 7#b7 and 7#c71 not later than #d years after the date of enactment of this ,act1 the ,director shall review and1 as appropriate1 update existing guidance relating to vulnerability disclosure policies4 7c7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei;,a1 as added by this ,act1 the following3 #ceei;,b4 ,federal vulnerability disclosure policies4 4 7d7 ,conforming update and repeal 7#a7 ,guidelines on the disclosure process for security vulnerabilities relating to information systems1 including internet of things devices ,section #e of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c7 is amended by striking subsections 7d7 and 7e74 7#b7 ,implementation and contractor compliance ,the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a et seq47 is amended-- 7,a7 by striking section #f 7#ae ,u4,s4,c4 #bgh;g-#c;d72 and 7,b7 by striking section #g 7#ae ,u4,s4,c4 #bgh;g-#c;e74 #i4 ,implementing zero trust architecture 7a7 ,briefings ,not later than #a year after the date of enactment of this ,act1 the ,director shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committees on ,oversight and ,accountability and ,homeland ,security of the ,house of ,representatives a briefing on progress in increasing the internal defenses of agency systems1 including-- 7#a7 shifting away from trusted networks to implement security controls based on a presumption of compromise1 including through the transition to zero trust architecture2 7#b7 implementing principles of least privilege in administering information security programs2 7#c7 limiting the ability of entities that cause incidents to move laterally through or between agency systems2 7#d7 identifying incidents quickly2 7#e7 isolating and removing unauthorized entities from agency systems as quickly as practicable1 accounting for intelligence or law enforcement purposes2 and 7#f7 otherwise increasing the resource costs for entities that cause incidents to be successful4 7b7 ,progress report ,as a part of each report required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code1 during the period beginning on the date that is #d years after the date of enactment of this ,act and ending on the date that is #aj years after the date of enactment of this ,act1 the ,director shall include an update on agency implementation of zero trust architecture1 which shall include-- 7#a7 a description of steps agencies have completed1 including progress toward achieving any requirements issued by the ,director1 including the adoption of any models or reference architecture2 7#b7 an identification of activities that have not yet been completed and that would have the most immediate security impact2 and 7#c7 a schedule to implement any planned activities4 7c7 ,classified annex ,each update required under subsection 7b7 may include #a or more annexes that contain classified or other sensitive information1 as appropriate4 7d7 ,national security systems 7#a7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,secretary of ,defense shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,accountability of the ,house of ,representatives1 the ,committee on ,armed ,services of the ,senate1 the ,committee on ,armed ,services of the ,house of ,representatives1 the ,select ,committee on ,intelligence of the ,senate1 and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives a briefing on the implementation of zero trust architecture with respect to national security systems4 7#b7 ,progress report ,not later than the date on which each update is required to be submitted under subsection 7b71 the ,secretary of ,defense shall submit to the congressional committees described in paragraph 7#a7 a progress report on the implementation of zero trust architecture with respect to national security systems4 #aj4 ,automation and artificial intelligence 7a7 ,definition ,in this section1 the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7b7 ,use of artificial intelligence 7#a7 ,in general ,as appropriate1 the ,director shall issue guidance on the use of artificial intelligence by agencies to improve the cybersecurity of information systems4 7#b7 ,considerations ,the ,director and head of each agency shall consider the use and capabilities of artificial intelligence systems in furtherance of the cybersecurity of information systems4 7#c7 ,report ,not later than #a year after the date of enactment of this ,act1 and annually thereafter until the date that is #e years after the date of enactment of this ,act1 the ,director shall submit to the appropriate congressional committees a report on the use of artificial intelligence to further the cybersecurity of information systems4 7c7 ,comptroller general reports 7#a7 ,in general ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the appropriate congressional committees a report on the risks to the privacy of individuals and the cybersecurity of information systems associated with the use by ,federal agencies of artificial intelligence systems or capabilities4 7#b7 ,study ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall perform a study1 and submit to the ,committees on ,homeland ,security and ,governmental ,affairs and ,commerce1 ,science1 and ,transportation of the ,senate and the ,committees on ,oversight and ,accountability1 ,homeland ,security1 and ,science1 ,space1 and ,technology of the ,house of ,representatives a report1 on the use of automation1 artificial intelligence1 including generative artificial intelligence1 and machine-readable data across the ,federal ,government for cybersecurity purposes1 including-- 7,a7 the automated updating of cybersecurity tools1 sensors1 or processes employed by agencies under paragraphs 7#a71 7#e77;,c71 and 7#h77;,b7 of section #ceed7;b7 of title #dd1 ,united ,states ,code1 as amended by this ,act2 and 7,b7 to combat social engineering attacks4 #aa4 ,federal cybersecurity requirements 7a7 ,codifying ,federal cybersecurity requirements in title #dd 7#a7 ,amendment to ,federal ,cybersecurity ,enhancement ,act of #bjae ,section #bbe of the ,federal ,cybersecurity ,enhancement ,act of #bjae 7#f ,u4,s4,c4 #aebc7 is amended by striking subsections 7b7 and 7c74 7#b7 ,title #dd ,section #ceed of title #dd1 ,united ,states ,code1 as amended by this ,act1 is further amended by adding at the end the following3 7f7 ,specific cybersecurity requirements at agencies 7#a7 ,in general ,consistent with policies1 standards1 guidelines1 and directives on information security under this subchapter1 and except as provided under paragraph 7#c71 the head of each agency shall-- 7,a7 identify sensitive and mission critical data stored by the agency consistent with the inventory required under section #ceje7;c72 7,b7 assess access controls to the data described in subparagraph 7,a71 the need for readily accessible storage of the data1 and the need of individuals to access the data2 7,c7 encrypt or otherwise render indecipherable to unauthorized users the data described in subparagraph 7,a7 that is stored on or transiting agency information systems2 7,d7 implement identity and access management systems to ensure the security of ,federal information systems and protect agency records and data from fraud resulting from the misrepresentation of identity or identity theft1 including-- 7i7 a single sign-on trusted identity platform for individuals accessing each public website of the agency that requires1 at a minimum1 user authentication and verification services consistent with applicable law and guidance issued by the ,director of the ,office of ,management and ,budget who shall consider any applicable standard or guideline developed by the ,national ,institute of ,standards and ,technology1 which may be one developed by the ,administrator of ,general ,services in consultation with the ,director of the ,office of ,management and ,budget2 and 7ii7 multi-factor authentication1 consistent with guidance issued by the ,director of the ,office of ,management and ,budget who shall consider any applicable standard or guideline developed by the ,national ,institute of ,standards and ,technology1 for-- 7,i7 remote access to an information system2 and 7,,ii7 each user account with elevated privileges on an information system4 7#b7 ,prohibition 7,a7 ,definition ,in this paragraph1 the term internet of things has the meaning given the term in section #ceei;,b4 7,b7 ,prohibition ,consistent with policies1 standards1 guidelines1 and directives on information security under this subchapter1 and except as provided under paragraph 7#c71 the head of an agency may not procure1 obtain1 renew a contract to procure or obtain in any amount1 notwithstanding section #aije of title #da1 or use an internet of things device if the ,chief ,information ,officer of the agency determines during a review required under section #aacai7;b77#a77;,c7 of title #dj of a contract for an internet of things device that the use of the device prevents compliance with the standards and guidelines developed under section #d of the ,io,t ,cybersecurity ,improvement ,act 7#ae ,u4,s4,c4 #bgh;g-#c;b7 with respect to the device4 7#c7 ,exceptions 7,a7 ,in general ,the requirements under subparagraphs 7,a71 7,b71 7,c71 and 7,d77ii7 of paragraph 7#a7 shall not apply to an information system for which the head of the agency1 without delegation1 has-- 7i7 certified to the ,director with particularity that-- 7,i7 operational requirements articulated in the certification and related to the information system would make it excessively burdensome to implement the cybersecurity requirement2 7,,ii7 the cybersecurity requirement is not necessary to secure the information system or agency information stored on or transiting it2 and 7,,iii7 the agency has taken all necessary steps to secure the information system and agency information stored on or transiting it2 and 7ii7 submitted the certification described in clause 7i7 to the appropriate congressional committees and the authorizing committees of the agency4 7,b7 ,identity management platform waiver ,the head of an agency shall be in compliance with the requirement under paragraph 7#a77;,d77i7 with respect to implementing a single-sign on trusted identity system or platform other than one developed by the ,administrator of ,general ,services as described under paragraph 7#a77;,d77i7 if the head of the agency-- 7i7 without delegation-- 7,i7 has certified to the ,director that the alternative system or platform1 including a procured system or platform1 conforms with applicable security and privacy requirements of this subchapter and guidance issued by the ,director1 at least #cj days before use of the system or platform2 or 7,,ii7 with regard to a system or platform in use as of the date of enactment of this subsection1 the head of the agency provides such certification to the ,director within #fj days after the date of enactment of this subsection2 7ii7 has received a written waiver from the ,director in response to the request submitted under clause 7i72 and 7iii7 has submitted the certification described in clause 7i7 and the waiver described clause 7ii7 to the appropriate congressional committees and the authorizing committees of the agency4 7#d7 ,duration of certification 7,a7 ,in general ,a certification and corresponding exemption of an agency under paragraph 7#c7 shall expire on the date that is #d years after the date on which the head of the agency submits the certification under paragraph 7#c74 7,b7 ,renewal ,upon the expiration of a certification of an agency under paragraph 7#c71 the head of the agency may submit an additional certification in accordance with that paragraph4 7#e7 ,presumption of adequacy ,a ,fed,r,a,m,p authorization issued pursuant to chapter #cf of title #dd shall be presumed adequate to fulfill the requirements under subparagraphs 7,a7 through 7,c7 of paragraph 7#a7 with respect to an agency authorization to operate cloud computing products and services if such presumption of adequacy does not alter or modify-- 7,a7 the responsibility of any agency to ensure compliance with this subchapter for any cloud computing product or service used by the agency2 or 7,b7 the authority of the head of any agency to make a determination that there is a demonstrable need to include additional security controls beyond those included in a ,fed,r,a,m,p authorization package for a particular cloud computing product or service4 7#f7 ,rules of construction ,nothing in this subsection shall be construed-- 7,a7 to alter the authority of the ,secretary1 the ,director1 or the ,director of the ,national ,institute of ,standards and ,technology in implementing subchapter ,,ii of this title2 7,b7 to affect the standards or process of the ,national ,institute of ,standards and ,technology2 7,c7 to affect the requirement under section #ceec7;a77#d72 7,d7 to discourage continued improvements and advancements in the technology1 standards1 policies1 and guidelines used to promote ,federal information security2 or 7,e7 to affect the requirements under subchapter ,,iii4 7g7 ,exception 7#a7 ,national security system requirements ,the requirements under subsection 7f77#a7 shall not apply to-- 7,a7 a national security system2 or 7,b7 an information system described in paragraph 7#b7 or 7#c7 of section #ceec7;e77#b74 7#b7 ,prohibition ,the prohibition under subsection 7f77#b7 shall not apply to-- 7,a7 necessary in the interest of national security2 7,b7 national security systems2 or 7,c7 a procured internet of things device described in subsection 7f77#b77;,b7 that the ,chief ,information ,officer of an agency determines is-- 7i7 necessary for research purposes2 7ii7 necessary in the interest of national security2 or 7iii7 secured using alternative and effective methods appropriate to the function of the internet of things device4 4 7b7 ,report on exemptions ,section #ceed7;c77#a7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 is further amended-- 7#a7 in subparagraph 7,c71 by striking and at the end2 7#b7 in subparagraph 7,d71 by striking the period at the end and inserting 2 and2 and 7#c7 by adding at the end the following3 7,e7 with respect to any exemption from the requirements of subsection 7f77#c7 that is effective on the date of submission of the report1 includes the number of information systems that have received an exemption from those requirements4 4 7c7 ,guidance for identity management systems used by agencies ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 shall issue1 and routinely update thereafter1 guidance for agencies to implement identity management systems and a single sign-on trusted identity platform as required under section #ceed7;f77#a77;,d77i7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 which shall at a minimum1 include the following3 7#a7 ,requirements for agencies to routinely certify that such systems are in compliance with this guidance4 7#b7 ,requirements for agencies to routinely verify and certify that information stored on or transiting through a commercially available product 7as defined in section #ajc of title #da1 ,united ,states ,code7 or commercial service 7as defined in section #ajc;a of title #da1 ,united ,states ,code7 used to fulfil such requirements is appropriately secured in conformity with subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code4 7#c7 ,address national security concerns and requirements to ensure the protection of sensitive personal records and biometric data of ,united ,states persons from malign foreign ownership1 control1 or influence and fraud actors4 7#d7 ,requirements or guidelines to comply with section #c of the #bast ,century ,idea ,act 7#dd ,u4,s4,c4 #ceja note74 7#e7 ,requirements to prevent discrimination in violation of title ,,vi of the ,civil ,rights ,act of #aifd 7#db ,u4,s4,c4 #bjjj;d et seq474 7#f7 ,a description of the information necessary to be submitted under the exception described in section #ceed7;f77#c77;,b7 of title #dd1 ,united ,states ,code1 as amended by this ,act4 7d7 ,,gao evaluation of technical capability of identity management systems and platforms ,not less frequently than every #c years for the next #f years1 the ,comptroller ,general shall submit to the appropriate congressional committees a report on whether the single sign-on trusted identity systems and platforms used by agencies or the one developed by the ,general ,services ,administration under section #ceed7;f77,d77i7 of title #dd1 ,united ,states ,code1 as amended by this ,act1 adhere to the information security requirements of chapter #ce of title #dd1 ,united ,states ,code1 guidance issued under subsection 7c71 and relevant identity management technical standards promulgated by the ,national ,institute of ,standards and ,technology1 as appropriate1 including section #ejd of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdfd74 7e7 ,duration of certification effective date ,paragraph 7#c7 of section #ceed7;f7 of title #dd1 ,united ,states ,code1 as added by this ,act1 shall take effect on the date that is #a year after the date of enactment of this ,act4 7f7 ,federal ,cybersecurity ,enhancement ,act of #bjae update ,section #bbb7c77;,b7 of the ,federal ,cybersecurity ,enhancement ,act of #bjae 7#f ,u4,s4,c4 #aeba7c77;,b77 is amended by inserting and the ,committee on ,oversight and ,accountability before of the ,house of ,representatives4 #ab4 ,federal ,chief ,information ,security ,officer 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #cfag4 ,federal ,chief ,information ,security ,officer 7a7 ,establishment ,there is established a ,federal ,chief ,information ,security ,officer1 who shall serve in-- 7#a7 the ,office of the ,federal ,chief ,information ,officer of the ,office of ,management and ,budget2 and 7#b7 the ,office of the ,national ,cyber ,director4 7b7 ,appointment ,the ,federal ,chief ,information ,security ,officer shall be appointed by the ,president4 7c7 ,,omb duties ,the ,federal ,chief ,information ,security ,officer shall report to the ,federal ,chief ,information ,officer and assist the ,federal ,chief ,information ,officer in carrying out-- 7#a7 every function under this chapter2 7#b7 every function assigned to the ,director under title ,,ii of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note2 ,public ,law #ajg-cdg72 7#c7 other electronic government initiatives consistent with other statutes2 and 7#d7 other ,federal cybersecurity initiatives determined by the ,federal ,chief ,information ,officer4 7d7 ,additional duties ,the ,federal ,chief ,information ,security ,officer shall-- 7#a7 support the ,federal ,chief ,information ,officer in overseeing and implementing ,federal cybersecurity under the ,e-,government ,act of #bjjb 7,public ,law #ajg-cdg2 #aaf ,stat4 #bhii7 and other relevant statutes in a manner consistent with law2 and 7#b7 perform every function assigned to the ,director under sections #acba through #acbh of title #da1 ,united ,states ,code4 7e7 ,coordination with ,,oncd ,the ,federal ,chief ,information ,security ,officer shall support initiatives determined by the ,federal ,chief ,information ,officer necessary to coordinate with the ,office of the ,national ,cyber ,director4 4 7b7 ,national cyber director duties ,section #ageb of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj7 is amended-- 7#a7 by redesignating subsection 7g7 as subsection 7h72 and 7#b7 by inserting after subsection 7f7 the following3 7g7 ,senior ,federal ,cybersecurity ,officer ,the ,federal ,chief ,information ,security ,officer appointed by the ,president under section #cfag of title #dd1 ,united ,states ,code1 shall be a senior official within the ,office and carry out duties applicable to the protection of information technology 7as defined in section #aaaja of title #dj1 ,united ,states ,code71 including initiatives determined by the ,director necessary to coordinate with the ,office of the ,federal ,chief ,information ,officer4 4 7c7 ,treatment of incumbent ,the individual serving as the ,federal ,chief ,information ,security ,officer appointed by the ,president as of the date of enactment of this ,act may serve as the ,federal ,chief ,information ,security ,officer under section #cfag of title #dd1 ,united ,states ,code1 as added by this ,act1 beginning on the date of enactment of this ,act1 without need for a further or additional appointment under such section4 7d7 ,clerical amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #cfag4 ,federal ,chief ,information ,security ,officer4 4 #ac4 ,renaming ,office of the ,federal ,chief ,information ,officer 7a7 ,definitions 7#a7 ,in general ,section #cfja of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by striking paragraph 7#a72 and 7,b7 by redesignating paragraphs 7#b7 through 7#h7 as paragraphs 7#a7 through 7#g71 respectively4 7#b7 ,conforming amendments 7,a7 ,title #aj ,section #bbbb7;i77#f7 of title #aj1 ,united ,states ,code1 is amended by striking section #cfja7d7 and inserting section #cfja4 7,b7 ,national ,security ,act of #aidg ,section #ejf;,d7k77#a7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cajj7k77#a77 is amended by striking section #cfja7d7 and inserting section #cfja4 7b7 ,office of electronic government ,section #cfjb of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in the heading1 by striking ,office of ,electronic ,government and inserting ,office of the ,federal ,chief ,information ,officer2 7#b7 in subsection 7a71 by striking ,office of ,electronic ,government and inserting ,office of the ,federal ,chief ,information ,officer2 7#c7 in subsection 7b71 by striking an ,administrator and inserting a ,federal ,chief ,information ,officer2 7#d7 in subsection 7c71 in the matter preceding paragraph 7#a71 by striking ,the ,administrator and inserting ,the ,federal ,chief ,information ,officer2 7#e7 in subsection 7d71 in the matter preceding paragraph 7#a71 by striking ,the ,administrator and inserting ,the ,federal ,chief ,information ,officer2 7#f7 in subsection 7e71 in the matter preceding paragraph 7#a71 by striking ,the ,administrator and inserting ,the ,federal ,chief ,information ,officer2 7#g7 in subsection 7f7-- 7,a7 in the matter preceding paragraph 7#a71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer2 7,b7 in paragraph 7#af71 by striking the ,office of ,electronic ,government and inserting the ,office of the ,federal ,chief ,information ,officer2 and 7,c7 in paragraph 7#ag71 by striking ,e-,government and inserting annual2 and 7#h7 in subsection 7g71 by striking the ,office of ,electronic ,government and inserting the ,office of the ,federal ,chief ,information ,officer4 7c7 ,chief information officers council ,section #cfjc of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7b77#b71 by striking ,the ,administrator of the ,office of ,electronic ,government and inserting ,the ,federal ,chief ,information ,officer2 7#b7 in subsection 7c77#a71 by striking ,the ,administrator of the ,office of ,electronic ,government and inserting ,the ,federal ,chief ,information ,officer2 and 7#c7 in subsection 7f7-- 7,a7 in paragraph 7#c71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer2 and 7,b7 in paragraph 7#e71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer4 7d7 ,e-,government fund ,section #cfjd of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a77#b71 by striking the ,administrator of the ,office of ,electronic ,government and inserting the ,federal ,chief ,information ,officer2 7#b7 in subsection 7b71 by striking ,administrator each place it appears and inserting ,federal ,chief ,information ,officer2 and 7#c7 in subsection 7c71 in the matter preceding paragraph 7#a71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer4 7e7 ,program to encourage innovative solutions to enhance electronic government services and processes ,section #cfje of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a71 by striking ,the ,administrator and inserting ,the ,federal ,chief ,information ,officer2 7#b7 in subsection 7b71 by striking 1 the ,administrator1 and inserting 1 the ,federal ,chief ,information ,officer12 and 7#c7 in subsection 7c7-- 7,a7 in paragraph 7#a7-- 7i7 by striking ,the ,administrator and inserting ,the ,federal ,chief ,information ,officer2 and 7ii7 by striking proposals submitted to the ,administrator and inserting proposals submitted to the ,federal ,chief ,information ,officer2 7,b7 in paragraph 7#b77;,b71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer2 and 7,c7 in paragraph 7#d71 by striking the ,administrator and inserting the ,federal ,chief ,information ,officer4 7f7 ,e-,government report ,section #cfjf of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in the section heading by striking ,e-,government and inserting ,annual2 7#b7 in subsection 7a71 by striking ,e-,government and inserting annual2 and 7#c7 in subsection 7b77#a71 by striking #bjb7;f7 and inserting #bjb7;g74 7g7 ,treatment of incumbent ,the individual serving as the ,administrator of the ,office of ,electronic ,government under section #cfjb of title #dd1 ,united ,states ,code1 as of the date of enactment of this ,act1 may continue to serve as the ,federal ,chief ,information ,officer commencing as of that date1 without need for a further or additional appointment under such section4 7h7 ,technical and conforming amendments ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended-- 7#a7 by striking the item relating to section #cfjb and inserting the following3 #cfjb4 ,office of the ,federal ,chief ,information ,officer4 2 and 7#b7 in the item relating to section #cfjf1 by striking ,e-,government and inserting ,annual4 7i7 ,references 7#a7 ,administrator ,any reference to the ,administrator of the ,office of ,electronic ,government in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,federal ,chief ,information ,officer4 7#b7 ,office of ,electronic ,government ,any reference to the ,office of ,electronic ,government in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,office of the ,federal ,chief ,information ,officer4 #ad4 ,rules of construction 7a7 ,agency actions ,nothing in this ,act1 or an amendment made by this ,act1 shall be construed to authorize the head of an agency to take an action that is not authorized by this ,act1 an amendment made by this ,act1 or existing law4 7b7 ,protection of rights ,nothing in this ,act1 or an amendment made by this ,act1 shall be construed to permit the violation of the rights of any individual protected by the ,constitution of the ,united ,states1 including through censorship of speech protected by the ,constitution of the ,united ,states or unauthorized surveillance4 7c7 ,protection of privacy ,nothing in this ,act1 or any amendment made by this ,act1 shall be construed to-- 7#a7 impinge on the privacy rights of individuals2 or 7#b7 allow the unauthorized access1 sharing1 or use of personal data4 ,december #ai1 #bjbd,reported from the ,committee on ,oversight and ,accountability with an amendment,december #ai1 #bjbd ,committees on ,science1 ,space1 and ,technology1 ,homeland ,security1 and ,armed ,services discharged2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed