,,ii #aai? ,,congress #a/ ,session ,s4 #ahge ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,may #bb1 #bjbe ,mr4 ,pet]s 7= himself & ,mr4 ,lank=d7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,a ,,bill ,to e/abli% an int]ag5cy committee to h>monize regulatory regimes 9 ! ,unit$ ,/ates relat+ to cyb]security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,/reaml9+ ,f$]al ,cyb]security ,regulations ,act ( #bjbe4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 t t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( ,repres5tatives2 7,c7 ea* committee ( ,congress ) jurisdiction ov] ! activities ( a regulatory ag5cy2 & 7,d7 ea* committee ( ,congress ) jurisdiction ov] ! activities ( a ,sector ,risk ,managem5t ,ag5cy ) respect to a sector regulat$ by a regulatory ag5cy4 7#c7 ,committee ,! t]m ,committee means ! ,h>monization ,committee e/abli%$ "u section #c7;a74 7#d7 ,cyb]security requirem5t ,! t]m cyb]security requirem5t means a regulation or sup]visory activity1 includ+ an exam9ation or b9d+ guidance1 t includes adm9i/rative1 te*nical1 or physical requirem5ts relat+ to in=mation security1 security ( in=mation te*nology or op]ational te*nology1 cyb]security1 or cyb] risk or resili5ce4 7#e7 ,h>monization 7,a7 ,def9ition ,! t]m h>monization means ! process ( align+ cyb]security requirem5ts issu$ by regulatory ag5cies su* t ! requirem5ts consi/ (-- 7i7 a common set ( m9imum requirem5ts t may apply across sectors & t c be updat$ p]iodically to address new or evolv+ risks relat+ to in=mation security or cyb]security2 & 7ii7 sector-specific requirem5ts1 :i* may include p]=mance-bas$ requirem5ts1 t-- 7,i7 are necess>y to address sector-specific risks t are n adequately address$ by ! m9imum requirem5ts describ$ 9 clause 7i72 7,,ii7 are sub/antially simil>1 :]e appropriate1 to o!r requirem5ts 9 t sector or a simil> sector2 & 7,,iii7 align ) int]national /&>ds1 :]e appropriate4 7,b7 ,rule ( con/ruction ,no?+ 9 ?is def9ition %all be con/ru$ to exempt regulatory ag5cies f any o!rwise applicable processes or laws relat+ to promulgat+ or am5d+ regulations1 includ+ sub*apt] ,,ii ( *apt] #e1 & *apt] #g1 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,adm9i/rative ,proc$ure ,act74 7#f7 ,head ,! t]m head includes1 9 ! case ( an ag5cy direct$ by multiple individuals1 su* z a commission1 a repres5tative select$ by su* individuals f among su* individuals4 7#g7 ,indep5d5t regulatory ag5cy ,! t]m indep5d5t regulatory ag5cy has ! mean+ giv5 t t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#h7 ,reciprocity ,! t]m reciprocity means ! recognition or acceptance by #a regulatory ag5cy ( an assessm5t1 det]m9ation1 exam9ation1 f9d+1 or conclusion ( ano!r regulatory ag5cy = det]m9+ t a regulat$ entity has compli$ ) a cyb]security requirem5t4 7#i7 ,regulatory ag5cy ,! t]m regulatory ag5cy means-- 7,a7 any indep5d5t regulatory ag5cy t has ! /atutory au?ority to issue or en=ce any m&atory cyb]security requirem5t2 or 7,b7 any o!r ag5cy t has ! /atutory au?ority to issue or en=ce any cyb]security requirem5t4 7#aj7 ,regulatory framework ,! t]m regulatory framework means ! framework develop$ "u section #c7;e77#a74 7#aa7 ,sector risk managem5t ag5cy ,! t]m ,sector ,risk ,managem5t ,ag5cy has ! mean+ giv5 t t]m 9 section #bbjj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,e/abli%m5t ( int]ag5cy committee to h>monize regulatory regimes 9 ! ,unit$ ,/ates relat+ to cyb]security 7a7 ,h>monization ,committee 7#a7 ,9 g5]al ,! ,national ,cyb] ,director %all e/abli% an int]ag5cy committee to be kn[n z ! ,h>monization ,committee to enhance ! h>monization & reciprocity ( cyb]security requirem5ts t are applicable )9 ! ,unit$ ,/ates1 includ+ ! =mulation ( basel9e & sector-specific requirem5ts t are risk-bas$4 7#b7 ,support ,! ,national ,cyb] ,director %all provide ! ,committee ) adm9i/rative & managem5t support z appropriate4 7b7 ,memb]s 7#a7 ,9 g5]al ,! ,committee %all be compos$ (-- 7,a7 ! ,national ,cyb] ,director2 7,b7 ! head ( ea* regulatory ag5cy1 includ+ ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,in/itute ( ,/&>ds & ,te*nology2 7,c7 ! head ( ! ,(fice ( ,in=mation & ,regulatory ,affairs ( ! ,(fice ( ,managem5t & ,budget2 & 7,d7 ! head ( o!r appropriate ag5cies1 z det]m9$ by ! *air ( ! ,committee4 7#b7 ,publication ( li/ ( memb]s ,! ,committee %all ma9ta91 on a publicly available website1 a li/ ( ! ag5cies t are repres5t$ on ! ,committee z det]m9$ by ! *air ( ! ,committee1 & %all update ! li/ z memb]s are add$ or remov$4 7c7 ,*air ,! ,national ,cyb] ,director %all be ! *air ( ! ,committee4 7d7 ,*>t] ,! ,committee %all develop1 deliv] to ,congress1 & make publicly available a *>t]1 :i* %all-- 7#a7 include ! processes & rules ( ! ,committee2 & 7#b7 detail-- 7,a7 ! objective & scope ( ! ,committee2 & 7,b7 o!r items z necess>y4 7e7 ,regulatory framework = h>monization 7#a7 ,9 g5]al 7,a7 ,developm5t ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,committee %all develop a regulatory framework = a*iev+ h>monization ( ! cyb]security requirem5ts ( ea* regulatory ag5cy4 7,b7 ,cont5ts ,! regulatory framework develop$ "u clause 7i7 %all-- 7i7 include a common set ( basel9e cyb]security requirem5ts across sectors2 & 7ii7 outl9e common approa*es & language = apply+ cyb]security requirem5ts promulgat$ or am5d$ foll[+ passage ( ?is ,act4 7,c7 ,public comm5t ,! process = develop+ su* regulatory framework %all include ! opportunity = public comm5t & consultation ) indu/ry exp]ts & o!r /akehold]s4 7,d7 ,factors ,9 develop+ ! framework "u subp>agraph 7,a71 ! ,committee %all acc\nt = exi/+ sector-specific cyb]security requirem5ts t are id5tifi$ z unique or critical to a sector4 7#b7 ,m9imum requirem5ts ,! framework %all conta91 at a m9imum1 processes =-- 7,a7 e/abli%+ a reciprocal compliance me*anism = m9imum requirem5ts relat+ to in=mation security or cyb]security = entities regulat$ by m ?an #a regulatory ag5cy2 7,b7 id5tify+ cyb]security requirem5ts t are ov]ly burd5some1 inconsi/5t1 or contradictory1 z det]m9$ by ! ,committee2 7,c7 develop+ recomm5dations = updat+ regulations1 guidance1 & exam9ations to address ov]ly burd5some1 inconsi/5t1 or contradictory cyb]security requirem5ts id5tifi$ "u subp>agraph 7,b7 to a*ieve h>monization2 & 7,d7 draft+ basel9e requirem5ts & regulatory language = cov]$ ag5cies to use1 z appropriate4 7#c7 ,publication ,^u completion ( ! regulatory framework1 ! ,committee %all publi% ! regulatory framework 9 ! ,f$]al ,regi/]4 7f7 ,pilot program on implem5tation ( regulatory framework 7#a7 ,9 g5]al ,n lat] ?an #ij days aft] ! publication ( ! framework develop$ "u subsection 7e71 n few] ?an #c regulatory ag5cies b n m ?an #e regulatory ag5cies1 select$ by ! ,committee1 %all c>ry out a pilot program to implem5t ! regulatory framework ) respect to n few] ?an #c cyb]security requirem5ts b n m ?an #f cyb]security requirem5ts1 ) at lea/ #a requirem5t f ea* regulatory ag5cy4 7#b7 ,duration ,! duration ( ! pilot program %all be det]m9$ by ! ,h>monization ,committee 9 coord9ation ) ! pilot program p>ticipants4 7#c7 ,p>ticipation by regulatory ag5cies & regulat$ entities 7,a7 ,regulatory ag5cies ,p>ticipation 9 ! pilot program by a regulatory ag5cy %all be volunt>y & subject to ! cons5t ( ! regulatory ag5cy foll[+ selection by ! ,committee "u p>agraph 7#a74 7,b7 ,regulat$ entities ,p>ticipation 9 ! pilot program by a regulat$ entity %all be volunt>y4 7#d7 ,selection ( cyb]security requirem5ts ,cyb]security requirem5ts select$ = ! pilot program "u p>agraph 7#a7 %all conta9 sub/antially simil> or sub/antially relat$ requirem5ts su* t n few] ?an #b ( ! select$ cyb]security requirem5ts gov]n ! same regulat$ entity ) sub/antially simil> or sub/antially relat$ requirem5ts relat+ to in=mation security or cyb]security4 7#e7 ,waiv]s 7,a7 ,9 g5]al ,not)/&+ any provision ( sub*apt] ,,ii ( *apt] #e1 & *apt] #g1 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,adm9i/rative ,proc$ure ,act7 & subject to ! cons5t ( any p>ticipat+ regulat$ entity1 9 implem5t+ ! pilot program "u p>agraph 7#a71 a regulatory ag5cy p>ticipat+ 9 ! pilot program %all h ! au?ority1 z ! regulatory ag5cy det]m9es appropriate1 to bo? issue waiv]s & e/abli% alt]native proc$ures = regulat$ entities p>ticipat+ 9 ! pilot program ) respect to ! cyb]security requirem5ts includ$ "u ! pilot program4 7,b7 ,compliance ,a regulat$ entity t notifies a regulatory ag5cy ( ! entity's p>ticipation 9 a pilot program %all be deem$ 9 compliance ) ! waiv$ requirem5ts to ! ext5t t ! entity complies ) requirem5ts ( ! pilot program4 7,c7 ,t]m9ation ,waiv]s issu$ & alt]native proc$ures e/abli%$ "u ?is p>agraph %all t]m9ate on ! date on :i* ! pilot program t]m9ates4 7#f7 ,subsequ5t pilot program ,! ,committee may only au?orize an additional pilot program aft] ! lat] (-- 7,a7 ! date ( ! conclusion ( all ( ! initial pilot programs "u p>agraph 7#a72 & 7,b7 ! date ( submission ( all reports requir$ "u subsection 7i7 = ea* initial pilot program4 7#g7 ,sunset ,! pilot program %all t]m9ate on ! date t is #g ye>s aft] ! date on :i* ! pilot program began "u p>agraph 7#a74 7g7 ,consultation ) ! ,committee 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( law-- 7,a7 except :5 an exig5t circum/ance describ$ 9 p>agraph 7#c7 exi/s1 be=e promulgat+ or am5d+ a cyb]security requirem5t1 a regulatory ag5cy %all consult ) ! ,committee reg>d+ su* requirem5t & ! regulatory framework2 7,b7 indep5d5t regulatory ag5cies1 :5 promulgat+ or am5d+ a cyb]security requirem5t1 %all consult ! ,committee dur+ ! developm5t ( ! updat$ cyb]security requirem5t or ! new cyb]security requirem5t to ensure t ! requirem5t is align$ to ! greate/ ext5t possible ) ! regulatory framework2 & 7,c7 su* consultation %\ld be integrat$ ) exi/+ int]ag5cy review & input processes adm9i/]$ by ! ,(fice ( ,in=mation & ,regulatory ,affairs ( ! ,(fice ( ,managem5t & ,budget4 7#b7 ,consultation report ,foll[+ a consultation "u p>agraph 7#a71 ! ,committee1 9 coord9ation ) ! ,(fice ( ,managem5t & ,budget z necess>y1 %all provide to ! ag5cy a report t %all be advisory 9 nature & %all-- 7,a7 include to :at degree ! propos$ cyb]security requirem5t or update to ! cyb]security requirem5t aligns ) ! regulatory framework1 tak+ into consid]ation ! au?orities ( ! ag5cy2 & 7,b7 provide a li/ ( recomm5dations to improve ! cyb]security requirem5t & to align ! cyb]security requirem5t ) ! regulatory framework4 7#c7 ,exig5t circum/ances ,9 ! case ( an exig5t circum/ance :]e an ag5cy is au?oriz$ by law to act exp$iti\sly1 ! ag5cy %all notify ! ,committee z soon z possible4 7h7 ,consultation ) sector risk managem5t ag5cies ,! ,committee %all consult ) appropriate ,sector ,risk ,managem5t ,ag5cies 9 ! developm5t ( ! regulatory framework & ! implem5tation ( ! pilot program "u subsection 7f7 & %all consult ) memb]s ( indu/ry & critical infra/ructure1 z appropriate1 = ! developm5t ( ! regulatory framework & pilot program4 7i7 ,reports 7#a7 ,annual report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] until ! date on :i* ! pilot program t]m9ates1 ! ,committee %all submit to ! appropriate congressional committees a report includ+-- 7,a7 in=mation ab\t memb] p>ticipation 9 ,committee activities1 includ+ ! rationale = any nonp>ticipation by ,committee memb]s2 7,b7 in=mation ab\t ! application ( ! regulatory framework1 once develop$1 on cyb]security requirem5ts1 includ+ consultations or discussions ) regulators2 7,c7 a g5]al summ>y ( reports made "u subsection 7g77#b72 & 7,d7 an analysis ( ! effici5cy ( ! regulatory framework4 7#b7 ,pilot program report ,n lat] ?an #a ye> aft] ! date on :i* a pilot program "u subsection 7f7 beg9s1 ! ,committee %all submit to ! appropriate congressional committees a report detail+-- 7,a7 ! cyb]security requirem5ts select$ = ! program1 includ+-- 7i7 ! reasons t ! regulatory ag5cy & cyb]security requirem5t 7 select$2 7ii7 a li/ ( ! pilot programs consid]$ by ! ,committee2 & 7iii7 ! rationale = select+ ! pilot program2 7,b7 ! in=mation le>n$ f ! program2 7,c7 any ob/acles enc\nt]$ dur+ ! program2 & 7,d7 an assessm5t ( ! applicability ( exp&+ ! program to o!r ag5cies & cyb]security requirem5ts4 #d4 ,coord9ation ) ,f$]al ag5cies & int]national bodies 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all1 9 consultation ) ! ,committee1 issue guidance to ,f$]al ag5cies1 includ+ ! ,cyb] ,incid5t ,report+ ,c\ncil1 on coord9ation ) ! ,committee4 7b7 ,guidance 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! completion ( ! initial pilot program & submission ( ! pilot program report1 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all1 9 coord9ation ) ! ,committee1 issue guidance to all ag5cies to ensure cyb]security requirem5ts are consi/5t ) ! framework develop$ "u subsection 7e71 incorporat+ ! results & lessons le>n$ f ! pilot program4 7#b7 ,cont5ts ,! guidance issu$ "u p>agraph 7#a7 %all1 at a m9imum-- 7,a7 include updates to ! regulatory review process1 z appropriate1 = propos$ cyb]security requirem5ts2 7,b7 provide draft regulatory language = cov]$ ag5cies to use :5 prep>+ cyb]security requirem5ts2 7,c7 provide guidance & proc$ures = cov]$ ag5cies to resolve inconsi/5cies ) ! framework2 & 7,d7 provide a template = cov]$ ag5cies on h[ to use ! guidance1 includ+ recomm5d$ proc$ures = implem5tation4 7c7 ,report+ ,all ag5cies %all report to appropriate congressional committees on ! /atus ( implem5t+ ! guidance issu$ "u subsection 7a74 7d7 ,assi/ance 7#a7 ,=eign entities ,! ,committee1 ) ! concurr5ce ( ! ,secret>y ( ,/ate1 & 9 coord9ation ) ! ,national ,in/itute ( ,/&>ds & ,te*nology1 may provide exp]tise or te*nical assi/ance on h>monization & reciprocity ( cyb] requirem5ts to a =eign gov]nm5t1 an int]national organization1 or an int]national entity1 z appropriate4 7#b7 ,local entities ,! ,committee may provide exp]tise or te*nical assi/ance on h>monization & reciprocity ( cyb] requirem5ts to ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts1 z appropriate4 #e4 ,rule ( con/ruction ,no?+ 9 ?is ,act %all be con/ru$-- 7#a7 to exp& or alt] ! exi/+ au?orities ( any ag5cy1 includ+ any indep5d5t regulatory ag5cy1 except = exemptions "u section #c7;f7 to implem5t ! pilot program e/abli%$ "u t section2 7#b7 to provide any su* ag5cy any new or additional au?orities1 except = exemptions "u section #c7;f7 to implem5t ! pilot program e/abli%$ "u t section2 or 7#c7 to affect1 augm5t1 or dim9i% ! au?ority ( ! ,secret>y ( ,/ate or any o!r (fic] ( ! ,f$]al ,gov]nm5t4