,,ib ,union ,cal5d> ,no4 #cbh #aai? ,,congress #a/ ,session ,h4 ,r4 #ejgh ,report ,no4 #aai-cgg ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,septemb] #b1 #bjbe,mr4 ,ogles 7= himself1 ,mr4 ,g>b>9o1 ,mr4 ,swalwell1 & ,mr4 ,evans ( ,colorado7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,homel& ,security ,novemb] #ab1 #bjbe;,additional sponsor3 ,mr4 ,v9dman ,novemb] #ab1 #bjbe;,committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be pr9t$ ,a ,,bill ,to am5d ! ,homel& ,security ,act ( #bjjb to reau?orize ! ,/ate & local cyb]security grant program ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,protect+ ,in=mation by ,local ,lead]s = ,ag5cy ,resili5ce ,act or ! ,,pill> ,act4 #b4 ,reau?orization ( ,,cisa ,/ate & local cyb]security grant program ,section #bbbj;,a ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffe;g7 is am5d$-- 7#a7 9 subsection 7a7-- 7,a7 by r$esignat+ p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 & 7#g7 z p>agraphs 7#c71 7#d71 7#f71 7#h71 7#i71 7#aj71 & 7#aa71 respectively2 7,b7 by ins]t+ be=e p>agraph 7#c71 z s r$esignat$1 ! foll[+ new p>agraphs3 7#a7 ,artificial intellig5ce ,! t]m artificial intellig5ce has ! mean+ giv5 su* t]m 9 section #ejjb7c7 ( ! ,national ,artificial ,intellig5ce ,initiative ,act ( #bjbj 7enact$ z division ,e ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#ae ,u4,s4,c4 #idja7c7774 7#b7 ,artificial intellig5ce sy/em ,! t]m artificial intellig5ce sy/em means any data sy/em1 s(tw>e1 h>dw>e1 application tool1 or utility t op]ates 9 :ole or 9 "p us+ artificial intellig5ce4 2 7,c7 by ins]t+ aft] p>agraph 7#d71 z s r$esignat$1 ! foll[+ new p>agraph3 7#e7 ,=eign entity ( conc]n ,! t]m =eign entity ( conc]n has ! mean+ giv5 su* t]m 9 section #ajfcd ( ! ,rese>* & ,developm5t1 ,competition1 & ,innovation ,act 7#db ,u4,s4,c4 #aibcg2 ,public ,law #aag-afg2 popul>ly ref]r$ to z ! ,,*ips & ,sci5ce ,act74 2 & 7,d7 by ins]t+ aft] p>agraph 7#f71 z s r$esignat$1 ! foll[+ new p>agraph3 7#g7 ,multi-factor au!ntication ,! t]m multi factor au!ntication means an au!ntication sy/em t requires m ?an "o di/9ct type ( au!ntication factor = successful au!ntication ( a us]1 includ+ by us+ a multi-factor au!nticator or by comb9+ s+le-factor au!nticators t provide diff]5t types ( factors4 2 7#b7 9 subsection 7b77#a71 by /rik+ in=mation sy/ems own$ & ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or2 7#c7 9 subsection 7d77#d71 by /rik+ to ! in=mation sy/ems own$ & ins]t+ to ! in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or2 7#d7 9 subsection 7e7-- 7,a7 9 p>agraph 7#b7-- 7i7 9 subp>agraph 7,a77i71 by /rik+ in=mation sy/ems own$ & ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or2 7ii7 9 subp>agraph 7,b7-- 7,i7 by am5d+ clauses 7i7 ?r\gh 7v7 to read z foll[s3 7i7 manage1 monitor1 & track applications1 us] acc\nts1 & in=mation sy/ems & op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 t are ma9ta9$1 own$1 or op]at$ by1 or on behalf (1 ! eligible entity1 or1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity1 & ! in=mation te*nology deploy$ on su* in=mation sy/ems or op]ational te*nology sy/ems 7z ! case may be71 includ+ legacy in=mation sy/ems1 op]ational te*nology sy/ems1 & in=mation te*nology t are no long] support$ by ! manufactur] ( ! sy/ems or te*nology at issue2 7ii7 monitor1 audit1 & track network traffic & activity transit+ or travel+ to or f applications1 us] acc\nts1 & in=mation sy/ems & op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or op]at$ by1 or on behalf (1 ! eligible entity or1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity2 7iii7 enhance ! prep>ation1 response1 & resili5cy ( applications1 us] acc\nts1 & in=mation sy/ems & op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or op]at$ by1 or on behalf (1 ! eligible entity or1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity1 aga9/ cyb]security risks & cyb]security ?reats2 7iv7 implem5t a process ( cont9u\s cyb]security vuln]ability assessm5ts & ?reat mitigation practices prioritiz$ by degree ( risk to address cyb]security risks & cyb]security ?reats on applications1 us] acc\nts1 & in=mation sy/ems & op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or op]at$ by1 or on behalf (1 ! eligible entity or1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity2 7v7 ensure t ! eligible entity &1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity1 adopt & use be/ practices & me?odologies to enhance cyb]security1 p>ticul>ly id5tity & access managem5t solutions su* z multi-factor au!ntication1 :i* may include-- 7,i7 ! practices set =? 9 a cyb]security framework develop$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology or ! ,ag5cy2 7,,ii7 cyb] *a9 supply *a9 risk managem5t be/ practices id5tifi$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology or ! ,ag5cy2 7,,iii7 k bases ( adv]s>y tools & tactics2 7,,iv7 te*nologies su* z artificial intellig5ce2 & 7,v7 improv+ cyb] incid5t response capabilities ?r\gh adoption ( automat$ cyb]security practices2 2 7,,ii7 9 clause 7x71 by ins]t+ or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 aft] in=mation sy/ems2 7,,iii7 9 clause 7xi77,i71 by ins]t+ 1 includ+ ?r\gh ,dep>tm5t ( ,homel& ,security ,/ate1 ,local1 & ,regional ,fusion ,c5t] ,initiative "u section #baj7;,a7 be=e ! semicolon2 7,,iv7 9 clause 7xii71 by ins]t+ 1 includ+ = bol/]+ ! resili5ce ( outdat$ or vuln]able in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce be=e ! semicolon2 7,v7 by am5d+ clause 7xiii7 to read z foll[s3 7xiii7 implem5t an in=mation te*nology or op]ational te*nology1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 mod]nization cyb]security review process t ensures alignm5t betwe5 in=mation te*nology1 op]ational te*nology1 & artificial intellig5ce cyb]security objectives2 2 7,,vi7 9 clause 7xiv77,,ii7-- 7aa7 9 item 7aa71 by /rik+ & aft] ! semicolon2 7bb7 9 item 7bb71 by ins]t+ & aft] ! semicolon2 & 7cc7 by add+ at ! end ! foll[+ new item3 7cc7 academic & nonpr(it entities1 includ+ cyb]security cl9ics & o!r nonpr(it te*nical assi/ance programs2 2 & 7,,vii7 by am5d+ clause 7xv7 to read z foll[s3 7xv7 ensure adequate access to1 & p>ticipation 91 ! s]vices & programs describ$ 9 ?is subp>agraph by rural areas & o!r local gov]nm5ts ) small populations )9 ! jurisdiction ( ! eligible entity1 includ+ by direct outrea* to su* rural areas & local gov]nm5ts ) small populations2 & 2 & 7iii7 9 subp>agraph 7,f7-- 7,i7 9 clause 7i71 by /rik+ & aft] ! semicolon2 7,,ii7 by am5d+ clause 7ii7 to read z foll[s3 7ii7 r$uc+ cyb]security risks to1 & id5tify+1 respond+ to1 & recov]+ f cyb]security ?reats to1 in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$ or op]at$ by1 or on behalf (1 ! eligible entity or1 if ! eligible entity is a ,/ate1 local gov]nm5ts )9 ! jurisdiction ( ! eligible entity2 & 2 & 7,,iii7 by add+ at ! end ! foll[+ new clause3 7iii7 assum+ ! co/ or p>tial co/ ( cyb]security inve/m5ts made z a result ( ! plan4 2 & 7,b7 9 p>agraph 7#c77;,a71 by /rik+ ! ,multi-,/ate ,in=mation ,%>+ & ,analysis ,c5t] & ins]t+ ,in=mation ,%>+ & ,analysis ,organizations2 7#e7 9 subsection 7g7-- 7,a7 9 p>agraph 7#b77;,a77ii71 by ins]t+ includ+1 z appropriate1 repres5tatives ( rural1 suburban1 & high-population jurisdictions 7includ+ su* jurisdictions ) l[ or o!rwise limit$ op]at+ budgets7 be=e ! semicolon2 & 7,b7 by am5d+ p>agraph 7#e7 to read z foll[s3 7#e7 ,rule ( con/ruction reg>d+ control ( c]ta9 in=mation sy/ems or op]ational te*nology sy/ems ( eligible entities ,no?+ 9 ?is subsection may be con/ru$ to p]mit a cyb]security plann+ committee ( an eligible entity t meets ! requirem5ts ( ?is subsection to make decisions relat+ to in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$1 or op]at$ by1 or on behalf (1 ! eligible entity4 2 7#f7 9 subsection 7i7-- 7,a7 9 p>agraph 7#a77;,b71 by /rik+ #b-ye> p]iod & ins]t+ #c-ye> p]iod2 7,b7 9 p>agraph 7#c7-- 7i7 9 ! matt] prec$+ subp>agraph 7,a71 by /rik+ #bjbc & ins]t+ #bjbg2 & 7ii7 9 subp>agraph 7,b71 by /rik+ #bjbc & ins]t+ #bjbg2 & 7,c7 9 p>agraph 7#d7-- 7i7 9 ! matt] prec$+ subp>agraph 7,a71 by /rik+ %all & ins]t+ may2 & 7ii7 9 subp>agraph 7,a71 by /rik+ in=mation sy/ems own$ ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$12 7#g7 9 subsection 7j77#a7-- 7,a7 9 subp>agraph 7,d71 by /rik+ or aft] ! semicolon2 7,b7 9 subp>agraph 7,e7-- 7i7 by /rik+ in=mation sy/ems own$ & ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$12 & 7ii7 by /rik+ ! p]iod & ins]t+ a semicolon2 & 7,c7 by add+ at ! end ! foll[+ new subp>agraphs3 7,e7 to pur*ase s(tw>e or h>dw>e1 or products or s]vices ( su* s(tw>e or h>dw>e1 z ! case may be1 t d n align ) guidance relevant to su* s(tw>e or h>dw>e1 or products or s]vices1 z ! case may be1 provid$ by ! ,ag5cy1 includ+ ,secure by ,design or successor guidance2 or 7,f7 to pur*ase s(tw>e or h>dw>e1 or products or s]vices ( su* s(tw>e or h>dw>e1 z ! case may be1 t are design$1 develop$1 op]at$1 ma9ta9$1 manufactur$1 or sold by a =eign entity ( conc]n & d n align ) guidance provid$ by ! ,ag5cy4 2 7#h7 9 subsection 7l71 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ #bjbb & ins]t+ #bjbf2 7#i7 9 subsection 7m71 by am5d+ p>agraph 7#a7 to read z foll[s3 7#a7 ,9 g5]al ,! ,f$]al %>e ( activities c>ri$ out us+ funds made available pursuant to ! aw>d ( a grant "u ?is section may n exce$-- 7,a7 9 ! case ( a grant to an eligible entity1 #fj p]c5t = ea* fiscal ye> ?r\gh fiscal ye> #bjce2 & 7,b7 9 ! case ( a grant to a multi-entity gr\p1 #gj p]c5t = ea* fiscal ye> ?r\gh fiscal ye> #bjce4 ,not)/&+ subp>agraphs 7,a7 & 7,b71 ! ,f$]al %>e ( ! co/ = an eligible entity or multi-entity gr\p %all be #fe p]c5t = an entity & #ge p]c5t = a multi-gr\p entity = ea* fiscal ye> beg9n+ ) fiscal ye> #bjbh ?r\gh fiscal ye> #bjce if su* entity or multi-entity gr\p entity1 z ! case may be1 implem5ts or enables1 by n lat] ?an ,octob] #a1 #bjbg1 multi-factor au!ntication & id5tity & access managem5t tools t support multi-factor au!ntication ) respect to critical infra/ructure1 includ+ ! in=mation sy/ems & op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ( su* critical infra/ructure1 t is )9 ! jurisdiction ( su* entity or multi-entity gr\p is responsible4 2 7#aj7 9 subsection 7n7-- 7,a7 9 p>agraph 7#b7-- 7i7 9 subp>agraph 7,a7-- 7,i7 9 ! matt] prec$+ clause 7i71 by /rik+ a grant & ins]t+ a grant on or aft] ,janu>y #a1 #bjbf1 or *anges ! allocation ( fund+ z p]missible )9 ! all[ances (2 & 7,,ii7 by am5d+ clauses 7ii7 & 7iii7 to read z foll[s3 7ii7 ) ! cons5t ( ! local gov]nm5ts1 items1 9-k9d s]vices1 capabilities1 or activities1 or a comb9ation ( fund+ & o!r s]vices1 hav+ a value ( n less ?an #hj p]c5t ( ! am\nt ( ! grant2 or 7iii7 ) ! cons5t ( ! local gov]nm5ts1 grant funds comb9$ ) o!r items1 9-k9d s]vices1 capabilities1 or activities1 or a comb9ation ( fund+ & o!r s]vices1 hav+ ! total value ( n less ?an #hj p]c5t ( ! am\nt ( ! grant4 2 & 7ii7 9 subp>agraph 7,b71 by am5d+ clauses 7ii7 & 7iii7 to read z foll[s3 7ii7 items1 9 k9d s]vices1 capabilities1 or activities1 or a comb9ation ( fund+ & o!r s]vices1 hav+ a value ( n less ?an #be p]c5t ( ! am\nt ( ! grant aw>d$ to ! eligible entity2 or 7iii7 grant funds comb9$ ) o!r items1 9 k9d s]vices1 capabilities1 or activities1 or a comb9ation ( fund+ & o!r s]vices1 hav+ ! total value ( n less ?an #be p]c5t ( ! grant aw>d$ to ! eligible entity4 2 & 7,b7 by am5d+ p>agraph 7#e7 to read z foll[s3 7#e7 ,direct fund+ ,if an eligible entity does n make a di/ribution to a local gov]nm5t requir$ "u p>agraph 7#b7 )9 #fj days ( ! anticipat$ grant disbursem5t date1 su* local gov]nm5t may petition ! ,secret>y to reque/ ! ,secret>y to provide funds directly to su* local gov]nm5t4 2 7#aa7 9 subsection 7o71 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ & repres5tatives f rural areas & o!r local gov]nm5ts ) small populations aft] gov]nm5ts2 7#ab7 by r$esignat+ subsections 7p7 ?r\gh 7s7 z subsections 7q7 ?r\gh 7t71 respectively2 7#ac7 by ins]t+ aft] subsection 7o7 ! foll[+ new subsection3 7p7 ,outrea* to local gov]nm5ts ,! ,secret>y1 act+ ?r\gh ! ,director1 %all implem5t an outrea* plan to in=m local gov]nm5ts1 includ+ ^? 9 rural areas or ) small populations1 ab\t no-co/ cyb]security s]vice (f]+s available f ! ,ag5cy4 2 7#ad7 9 subsection 7r71 z s r$esignat$-- 7,a7 9 p>agraph 7#a77;,a7-- 7i7 9 clause 7i71 by /rik+ & aft] ! semicolon2 7ii7 9 clause 7ii7-- 7,i7 by /rik+ in=mation sy/ems own$ ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$12 & 7,,ii7 by /rik+ ! p]iod & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+ new clause3 7iii7 assum+ ! co/s associat$ ) cont9u+ ! programs specifi$ 9 ! ,cyb]security ,plan by includ+ su* programs 9 ,/ate & local gov]nm5t budgets ^u full exp5diture ( grant funds by ! eligible entity4 2 7,b7 9 p>agraph 7#b77;,e77ii71 by /rik+ in=mation sy/ems own$ & ins]t+ in=mation sy/ems or op]ational te*nology sy/ems1 includ+ ei!r or bo? ( su* sy/ems us+ artificial intellig5ce1 ma9ta9$1 own$2 & 7,c7 by am5d+ p>agraph 7#f7 to read z foll[s3 7#f7 ,,gao review ,n lat] ?an f\r ye>s aft] ! date ( ! enactm5t ( ?is p>agraph & e f\r ye>s !reaft] until ! t]m9ation ( ! ,/ate & ,local ,cyb]security ,grant ,program1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all conduct a review ( ! ,program1 includ+ relat+ to ! foll[+3 7,a7 ,! grant selection process ( ! ,secret>y4 7,b7 ,a sample ( grants aw>d$ "u ?is section4 7,c7 ,a review ( artificial intellig5ce adoption across ! sample ( grants review$4 2 7#ae7 9 subsection 7s71 z s r$esignat$1 by am5d+ p>agraph 7#a7 to read z foll[s3 7#a7 ,9 g5]al ,! activities "u ?is section are subject to ! availability ( appropriations4 2 & 7#af7 9 subsection 7t71 z s r$esignat$1 9 p>agraph 7#a71 by /rik+ #bjbe & ins]t+ #bjce4 ,novemb] #ab1 #bjbe;,committ$ to ! ,committee ( ! ,:ole ,h\se on ! ,/ate ( ! ,union & ord]$ to be pr9t$