,,ii #aahth ,,congress #b;d ,session ,s4 #cgeh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #g1 #bjbd,mr4 ,warner 7for himself and ,mr4 ,thune7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to address security vulnerabilities with respect to unmanned aircraft systems used by civilian ,federal agencies1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,drone ,evaluation ,to ,eliminate ,cyber ,threats ,act or the ,,detect ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,critical component ,the term critical component includes a flight controller1 a radio1 a data transmission device1 a camera1 a gimbal1 a ground control system1 operating software1 network connectivity1 and data storage4 7#c7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#d7 ,information system ,the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#e7 ,national security system ,the term national security system has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#g7 ,security vulnerability ,the term security vulnerability has the meaning given the term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#h7 ,under ,secretary ,the term ,under ,secretary means the ,under ,secretary of ,commerce for ,standards and ,technology4 7#i7 ,unmanned aircraft system ,the term unmanned aircraft system has the meaning given the term in section #cca of the ,,faa ,modernization and ,reform ,act of #bjab 7#di ,u4,s4,c4 #ddhjb note74 #c4 ,security guidelines for ,federal agencies on use and management of unmanned aircraft systems 7a7 ,national ,institute of ,standards and ,technology development of standards and guidelines for ,federal use of unmanned aircraft systems by agencies 7#a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,under ,secretary shall commence the development of guidelines for the ,federal ,government on the appropriate use and management by agencies of unmanned aircraft systems owned or controlled by an agency and regularly connected to or exchanging data with information systems owned or controlled by an agency1 including minimum information security requirements for managing cybersecurity risks associated with such devices4 7#b7 ,publication ,not later than #a year after the date of the enactment of this ,act1 the ,under ,secretary shall publish the guidelines developed pursuant to paragraph 7#a7 in a manner that is consistent with section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7#c7 ,consistency with ongoing efforts ,the ,under ,secretary shall ensure that the standards and guidelines developed under paragraph 7#a7 are consistent with the efforts of the ,national ,institute of ,standards and ,technology in effect on the date of the enactment of this ,act-- 7,a7 regarding-- 7i7 examples of possible security vulnerabilities of unmanned aircraft systems2 and 7ii7 considerations for managing the security vulnerabilities of unmanned aircraft systems2 and 7,b7 with respect to the following considerations for unmanned aircraft systems3 7i7 ,secure ,development4 7ii7 ,identity management4 7iii7 ,patch management4 7iv7 ,configuration management4 7v7 ,supply chain security4 7vi7 ,corporate cyber hygiene4 7vii7 ,software and hardware transparency4 7#d7 ,considering relevant guidelines ,in developing the guidelines under paragraph 7#a71 the ,under ,secretary shall consider relevant standards1 guidelines1 and best practices developed by the private sector1 agencies1 and public-private partnerships1 including the following3 7,a7 ,national ,institute of ,standards and ,technology ,special ,publication #hjj-bac 7relating to ,io,t device cybersecurity guidance for the ,federal ,government74 7,b7 ,national ,institute of ,standards and ,technology ,special ,publication #hjj-cg 7relating to risk management framework for information systems and organizations74 7,c7 ,the ,green ,,uas ,frameworks of the ,association for ,uncrewed ,vehicle ,systems ,international 7,,auvsi71 as amended and extended4 7,d7 ,the ,cross-,sector ,cybersecurity ,performance ,goals of ,the ,cybersecurity and ,infrastructure ,security ,agency4 7#e7 ,consultation ,in developing the guidelines required by paragraph 7#a71 the ,under ,secretary shall consult with the ,administrator of the ,federal ,aviation ,administration1 the ,attorney ,general1 and the heads of such other departments and agencies of the ,federal ,government as the ,under ,secretary considers appropriate4 7b7 ,review of ,federal agency information security policies and principles 7#a7 ,requirement 7,a7 ,in general ,not later than #a year after the date on which the ,under ,secretary completes the development of the guidelines required under subsection 7a71 the ,director shall require not less than #a agency1 on a pilot basis1 to implement policies and principles based on the guidelines with respect to unmanned aircraft systems owned or controlled by the agency4 7,b7 ,exception ,a pilot implementation under subparagraph 7,a7 shall not apply to any unmanned aircraft system comprised of any national security system4 7#b7 ,policies and principles ,not later than #a year after the conclusion of the pilot implementation under paragraph 7#a77;,a71 the ,director shall issue policies and principles necessary to ensure that the policies and principles of each agency relating to the cybersecurity of unmanned aircraft systems are consistent with the guidelines developed under subsection 7a74 7#c7 ,national security systems ,any policy or principle issued by the ,director under paragraph 7#b7 shall not apply to national security systems4 7c7 ,quinquennial review and revision 7#a7 ,review and revision of ,,nist guidelines ,not later than #e years after the date on which the ,under ,secretary publishes the guidelines under subsection 7a71 and not less frequently than once every #e years thereafter1 the ,under ,secretary1 shall-- 7,a7 review such guidelines2 and 7,b7 revise such guidelines as the ,under ,secretary considers appropriate4 7#b7 ,updated ,,omb policies and principles for ,federal agencies ,not later than #ahj days after the ,under ,secretary makes a revision pursuant to paragraph 7#a71 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 shall update any policy or principle issued under subsection 7b77#a7 as necessary to ensure those policies and principles are consistent with the review and any revision under paragraph 7#a7 under this subsection and paragraphs 7#b7 and 7#c7 of subsection 7b74 7d7 ,revision of ,federal ,acquisition ,regulation ,the ,federal ,acquisition ,regulation shall be revised as necessary to implement any standards and guidelines promulgated in this section4 #d4 ,guidelines on the disclosure process for security vulnerabilities relating to unmanned aircraft systems 7a7 ,in general 7#a7 ,guidance ,the ,director shall issue guidance to agencies that includes-- 7,a7 requirements for the reporting1 coordinating1 and receiving of information about-- 7i7 a security vulnerability relating to an unmanned aircraft system owned or controlled by an agency2 and 7ii7 the resolution of a security vulnerability described in clause 7i72 and 7,b7 requirements relating to the scope of vulnerabilities required to be reported under subparagraph 7,a71 such as the minimum severity of a vulnerability required to be reported or whether vulnerabilities that are publicly disclosed are required to be reported4 7#b7 ,contractor compliance with coordinated disclosure of security vulnerabilities relating to agency unmanned aircraft systems ,subject to the guidance issued under paragraph 7#a71 a contractor or awardee of an agency shall report to the agency and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency if-- 7,a7 a critical component of any unmanned aircraft system operated1 managed1 or maintained by the contractor or awardee contains a security vulnerability1 including a supply chain compromise or an identified software or hardware vulnerability1 for which there is reliable evidence of attempted or successful exploitation by an actor without the authorization of the owner of the unmanned aircraft system2 or 7,b7 the contractor or awardee has a reasonable basis to suspect or conclude that a critical component of any unmanned aircraft system operated1 managed1 or maintained on behalf of an agency by the contractor or awardee contains a security vulnerability1 including a supply chain compromise or an identified software or hardware vulnerability1 that has been reported to the contractor or awardee by a third party1 including through a vulnerability disclosure program4 7b7 ,regulations2 modifications 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act-- 7,a7 the ,federal ,acquisition ,regulatory ,council shall promulgate regulations1 as appropriate1 relating to the responsibilities of contractors and recipients of other transaction agreements and cooperative agreements to comply with subsection 7a77#b72 and 7,b7 the ,office of ,federal ,financial ,management shall promulgate regulations under title #b1 ,code of ,federal ,regulations1 as appropriate1 relating to the responsibilities of grantees to comply with subsection 7a77#b74 7#b7 ,implementation ,not later than #a year after the date on which the ,federal ,acquisition ,regulatory ,council and the ,office of ,federal ,financial ,management promulgate regulations under paragraph 7#a71 the head of each agency shall implement policies and procedures1 as appropriate1 necessary to implement those regulations4 7c7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide support to agencies with respect to the implementation of the requirements of this section2 7#b7 develop tools1 processes1 and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section2 and 7#c7 upon request by an agency1 assist the agency in the disclosure to vendors of newly identified security vulnerabilities in vendor products and services4 #e4 ,contractor compliance with coordinated disclosure of security vulnerabilities relating to agency unmanned aircraft systems 7a7 ,prohibition on procurement and use 7#a7 ,in general ,subject to paragraph 7#b71 the head of an agency may not procure or obtain1 renew a contract to procure or obtain1 or use an unmanned aircraft system if the ,chief ,information ,officer of the agency determines1 in conducting the review required under section #aacai7;b77#a77;,c7 of title #dj1 ,united ,states ,code1 of the contract for the unmanned aircraft system1 that the use of the unmanned aircraft system prevents compliance with the standards and guidelines developed under section #c7;a77#a7 of this ,act or the guidelines issued under section #d7;a77#a7 of this ,act with respect to the unmanned aircraft system4 7#b7 ,exemption for commercial data buys ,paragraph 7#a7 shall not apply when the head of an agency acquires data-- 7,a7 solely from a commercial or nonprofit entity1 the contract or agreement for which does not specify the type of unmanned aircraft system or the specifications for the unmanned aircraft system2 7,b7 that will never connect to any network of the ,federal ,government2 and 7,c7 over which the head of the agency will not have operational direction or control4 7#c7 ,simplified acquisition threshold ,notwithstanding section #aije of title #da1 ,united ,states ,code1 the requirements under paragraph 7#a7 shall apply to a contract or subcontract in amounts not greater than the simplified acquisition threshold4 7b7 ,waiver 7#a7 ,authority ,the head of an agency may waive the prohibition under subsection 7a77#a7 with respect to an unmanned aircraft system if the ,chief ,information ,officer of that agency determines that-- 7,a7 the waiver is necessary in the interest of national security2 7,b7 procuring1 obtaining1 or using the unmanned aircraft system is necessary for research1 testing1 evaluation1 or training purposes2 or 7,c7 the unmanned aircraft system is used-- 7i7 in a manner that does not implicate agency operational or cybersecurity concerns2 or 7ii7 in other circumstances in which the head of the agency determines the risks are minimal or acceptable4 7#b7 ,agency process ,the ,director shall establish a standardized process for the ,chief ,information ,officer of each agency to follow in determining whether the waiver under paragraph 7#a7 may be granted4 7c7 ,reports to ,congress 7#a7 ,report ,not later than #b years after the date of enactment of this ,act1 and every #b years thereafter until the date that is #f years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states1 in consultation with the heads of other ,federal agencies as appropriate1 shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,accountability of the ,house of ,representatives1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report-- 7,a7 on the effectiveness of the process established under subsection 7b77#b72 7,b7 that contains recommended best practices for the procurement of unmanned aircraft systems2 and 7,c7 that lists-- 7i7 the number and type of each unmanned aircraft system for which a waiver under subsection 7b77#a7 was granted during the #b-year period prior to the submission of the report2 and 7ii7 the legal authority under which each such waiver was granted1 such as whether the waiver was granted pursuant to subparagraph 7,a71 7,b71 or 7,c7 of subsection 7b74 7#b7 ,classification of report ,each report submitted under this subsection shall be submitted in unclassified form1 but may include-- 7,a7 a classified annex that contains the information described in paragraph 7#a77;,c72 and 7,b7 a committee-use only annex that contains information described in paragraph 7#a77;,c7 that is law enforcement sensitive4 7d7 ,effective date ,the prohibition under subsection 7a77#a7 shall take effect on the date that is #b years after the date of enactment of this ,act4 #f4 ,government ,accountability ,office report on cybersecurity considerations of unmanned aircraft systems 7a7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall provide a briefing to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,accountability of the ,house of ,representatives1 and the ,committee on ,homeland ,security of the ,house of ,representatives on broader unmanned aircraft system cybersecurity efforts4 7b7 ,report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,accountability of the ,house of ,representatives1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report on broader unmanned aircraft system cybersecurity efforts addressed in the briefing required under subsection 7a74