,,ii  #aaith ,,congress  #b;d ,session  
,s4 #defd  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,may #ai1      
#bjbf,mr4 ,scott of ,florida 7for       
himself and ,mr4 ,kim7 introduced the   
following bill2 which was read twice and
 referred to the ,committee on          
,commerce1 ,science1 and ,transportation
  ,a ,,bill  ,to amend title #df1       
,united ,states ,code1 to require the   
,secretary of the department in which   
the ,coast ,guard is operating to assess
 cybersecurity risks of certain software
 and hardware used in certain maritime  
facilities1 and for other purposes4  #a4
 ,short title ,this ,act may be cited as
 the ,maritime ,cybersecurity ,act4  #b4
 ,cybersecurity vulnerability           
assessments of certain maritime facility
 software and hardware ,section #gjajb  
of title #df1 ,united ,states ,code1 is 
amended-- 7#a7 in subsection 7b7-- 7,a7 
in paragraph 7#a77;,c71 by inserting    
7including1 with respect to covered     
facilities1 cybersecurity risks of      

covered software or hardware as provided
 under subsection 7d77#a77 after        
cybersecurity risks2  7,b7 in paragraph 
7#c71 by inserting before the period 1  
except that1 for covered facilities1 the
 ,secretary shall annually update each  
such vulnerability assessment with      
respect to the identification of        
weaknesses in security and cybersecurity
 risks of covered software or hardware  
in accordance with subsection 7d77#a72  
and  7,c7 in paragraph 7#d7-- 7i7 by    
striking ,in lieu and inserting 7,a7    
,except as provided in subparagraph     
7,b71 in lieu2 and  7ii7 by adding at   
the end the following3  7,b7 ,in the    
event that the ,secretary accepts an    
alternative assessment described in     
subparagraph 7,a7 for a covered         
facility1 the ,secretary shall still    
conduct an assessment under paragraph   
7#a7 of weaknesses in security and      
cybersecurity risks of covered software 
or hardware used at the facility in     
accordance with subsection 7d77#a74  2  

and  7#b7 by adding at the end the      
following3  7d7 ,assessing cybersecurity
 risks of covered software or hardware  
7#a7 ,assessments  7,a7 ,in general ,not
 later than #a year after the date of   
enactment of this subsection1 and       
annually thereafter1 the ,secretary1 in 
coordination with the ,director of the  
,cybersecurity and ,infrastructure      
,security ,agency1 shall conduct an     
assessment under subsection 7b77#a7 with
 respect to weaknesses in security and  
cybersecurity risks of covered software 
or hardware4  7,b7 ,reducing barriers   
,the ,secretary may conduct an          
assessment under this paragraph-- 7i7   
notwithstanding any provision of an end 
user licensing agreement or other       
contract that would otherwise hinder    
such assessment2 and  7ii7 without      
obtaining the consent of any owner or   
operator of a covered facility1 or any  
other person1 notwithstanding any other 
provision of law4  7#b7 ,covered        
facility reports and compliance  7,a7   

,in general ,not later than #ahj days   
after the date of enactment of this     
subsection1 and annually thereafter1 the
 owner or operator of a covered facility
 shall submit a report to the ,secretary
 that-- 7i7 identifies-- 7,i7 any       
covered software or hardware that-- 7aa7
 the owner or operator is using1 plans  
to use1 or during the previous year used
 at the facility2 and  7bb7 was         
manufactured-- 7,,aa7 by a foreign      
entity of concern or a foreign country  
of concern2 7,,bb7 by a company         
controlled or operated by a foreign     
entity of concern or a foreign country  
of concern2 or 7,,cc7 in a foreign      
country of concern2  7,,ii7 any instance
 with respect to the facility of a      
cybersecurity risk resulting in a       
transportation security incident        
involving the marine transportation     
system or any port security system2 and 
7,,iii7 any other cybersecurity risk    
with respect to the facility1 without   
regard to whether the risk resulted in a

 transportation security incident2 and  
7ii7 except as provided under           
subparagraph 7,b77ii71 certifies that   
any covered software or hardware that   
the owner or operator is using1 plans to
 use1 or during the previous year used  
has been assessed for consistency with  
standards of the ,national ,institute of
 ,standards and ,technology or          
equivalent standards within the previous
 year and the owner or operator has     
mitigated against any inconsistencies   
with such standards4  7,b7 ,compliance  
7i7 ,in general ,except as provided in  
clause 7ii71 the owner or operator of a 
covered facility may not use any covered
 software or hardware described in      
subparagraph 7,a77ii7 for which it      
cannot certify consistency with         
standards of the ,national ,institute of
 ,standards and ,technology or          
equivalent standards4  7ii7 ,waiver     
process ,the ,secretary may issue a     
waiver to allow an owner or operator of 
a covered facility to use covered       

software or hardware for which it cannot
 certify consistency with standards of  
the ,national ,institute of ,standards  
and ,technology or equivalent standards 
if the ,secretary determines that there 
is low risk to national security which  
is outweighed by the benefit to         
commerce4  7#c7 ,annual reports to      
,congress ,not later than #a year after 
the date of enactment of this           
subsection1 and annually thereafter1 the
 ,secretary1 in coordination with the   
,director of the ,cybersecurity and     
,infrastructure ,security ,agency1 shall
 provide a report1 to the ,committee on 
,homeland ,security and ,governmental   
,affairs of the ,senate and the         
,committee on ,homeland ,security of the
 ,house of ,representatives1 on-- 7,a7  
the findings of the most recent         
assessment under paragraph 7#a72  7,b7  
the findings of the most recent reports 
under paragraph 7#b72  7,c7 any actions 
taken by the ,secretary1 or the         
,director of the ,cybersecurity and     

,infrastructure ,security ,agency1 to   
mitigate cybersecurity risks with       
respect to covered software or hardware2
 and  7,d7 any recommendations to       
,congress on strengthening maritime     
transportation and port security with   
respect to cybersecurity risks of       
covered software or hardware4  7#d7     
,nondisclosure ,subject to paragraph    
7#e71 information in any assessment or  
report under this subsection shall not  
be disclosed to the public1 pursuant to 
section #eeb7;b77#c7 of the ,united     
,states ,code4  7#e7 ,coordination ,the 
,secretary shall coordinate1 as         
appropriate1 with ,federal entities1 and
 any other entities that have an        
agreement in effect with the ,secretary 
for the sharing of information1 to make 
information compiled by the ,secretary  
under this subsection available to such 
entities for the purposes of maritime   
transportation security1 cybersecurity  
risk mitigation1 or compliance          
assistance related to covered facilities

 or covered software or hardware4  7e7  
,definitions ,in this section3 7#a7     
,covered facility ,the term covered     
facility means a facility-- 7,a7 that is
 described in subsection 7b77#a72 and   
7,b7 to which part #aje or #ajf of title
 #cc1 ,code of ,federal ,regulations 7or
 successor regulations71 applies4  7#b7 
,covered software or hardware ,the term 
covered software or hardware means any  
software or hardware that-- 7,a7        
connects to the internet or otherwise   
poses a cybersecurity risk2  7,b7 is    
used at a covered facility2 and  7,c7 is
 used in-- 7i7 the marine transportation
 system1 including in a crane           
manufactured-- 7,i7 by a foreign entity 
of concern or a foreign country of      
concern2  7,,ii7 by a company controlled
 or operated by a foreign entity of     
concern or a foreign country of concern2
 or  7,,iii7 in a foreign country of    
concern2 or  7ii7 a business system     
that1 if compromised or exploited1 could
 result in a transportation security    

incident2  7iii7 a system whose         
ownership1 operation1 maintenance1 or   
control is delegated wholly or in part  
to any other party2 or  7iv7 any other  
maritime infrastructure determined by   
the ,secretary to be a high             
cybersecurity risk to the security of   
any covered facility or to maritime     
transportation security4  7#c7          
,cybersecurity vulnerability ,the term  
cybersecurity vulnerability means a     
characteristic or specific weakness that
 renders software or hardware or        
affiliated systems open to exploitation 
by a given threat or susceptible to a   
given hazard4  7#d7 ,foreign country of 
concern2 foreign entity of concern ,the 
terms foreign country of concern and    
foreign entity of concern have the      
meanings given such terms in section    
#ajfab7;a7 of the ,research and         
,development1 ,competition1 and         
,innovation ,act 7#db ,u4,s4,c4         
#aibba7;a774  4