II 

116TH CONGRESS 

1ST SESSION S. 734 

To leverage Federal Government procurement power to encourage increased 

cybersecurity for Internet of Things devices, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 11, 2019 

Mr. WARNER (for himself, Mr. GARDNER, Ms. HASSAN, and Mr. DAINES) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things 

devices, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Internet of Things Cy5 bersecurity Improvement Act of 2019’’ or the ‘‘IoT Cyber6 security Improvement Act of 2019’’. 

7 SEC. 2. DEFINITIONS. 

8 In this Act: 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

•S 734 IS

1 (1) AGENCY.—The term ‘‘agency’’ has the 

2 meaning given such term in section 3502 of title 44, 

3 United States Code. 

4 (2) COVERED DEVICE.— 

5 (A) IN GENERAL.—The term ‘‘covered de6 vice’’ means a physical object that— 

7 (i) is capable of connecting to and is 

8 in regular connection with the Internet; 

9 (ii) has computer processing capabili10 ties that can collect, send, or receive data; 

11 and 

12 (iii) is not a general-purpose com13 puting device, including personal com14 puting systems, smart mobile communica15 tions devices, programmable logic controls, 

16 and mainframe computing systems. 

17 (B) MODIFICATION OF DEFINITION.—The 

18 Director of the Office of Management and 

19 Budget shall establish a process by which— 

20 (i) interested parties may petition for 

21 a device that is not described in subpara22 graph (A) to be considered a device that is 

23 not a covered device; and 


pamtmann on DSKBFK8HB2PROD with BILLS
3 

•S 734 IS

1 (ii) the Director acts upon any peti2 tion submitted under clause (i) in a timely 

3 manner. 

4 (3) SECURITY VULNERABILITY.—The term ‘‘se5 curity vulnerability’’ means any attribute of hard6 ware, firmware, software, or combination of 2 or 

7 more of these factors that could enable the com8 promise of the confidentiality, integrity, or avail9 ability of an information system or its information 

10 or physical devices to which it is connected. 

11 SEC. 3. NATIONAL INSTITUTE OF STANDARDS AND TECH12 NOLOGY CONSIDERATIONS AND REC13 OMMENDATIONS REGARDING MANAGING 

14 INTERNET OF THINGS CYBERSECURITY 

15 RISKS. 

16 (a) COMPLETION OF ONGOING EFFORTS RELATING

17 TO CONSIDERATIONS FOR MANAGING INTERNET OF

18 THINGS CYBERSECURITY RISKS.— 

19 (1) IN GENERAL.—The Director of the National 

20 Institute of Standards and Technology shall ensure 

21 that the efforts of the Institute in effect on the date 

22 of the enactment of this Act regarding consider23 ations for managing Internet of Things cybersecurity 

24 risks, especially regarding examples of possible cyVerDate Sep 11 2014 00:21 Mar 20, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S734.IS S734

pamtmann on DSKBFK8HB2PROD with BILLS
4 

•S 734 IS

1 bersecurity capabilities of Internet of Things devices, 

2 are completed no later than September 30, 2019. 

3 (2) MATTERS ADDRESSED.—In ensuring efforts 

4 are completed under paragraph (1), the Director 

5 shall also ensure that such efforts address, at a min6 imum, the following considerations for covered de7 vices: 

8 (A) Secure Development. 

9 (B) Identity management. 

10 (C) Patching. 

11 (D) Configuration management. 

12 (b) DEVELOPMENT OF RECOMMENDED STANDARDS

13 FOR USE OF INTERNET OF THINGS DEVICES BY FED14 ERAL GOVERNMENT.— 

15 (1) IN GENERAL.—Not later than March 31, 

16 2020, the Director of the Institute shall develop rec17 ommendations for the Federal Government on the 

18 appropriate use and management by the Federal 

19 Government of Internet of Things devices owned or 

20 controlled by the Federal Government, including 

21 minimum information security requirements for 

22 managing cybersecurity risks associated with such 

23 devices. 

24 (2) CONSISTENCY WITH ONGOING EFFORTS.— 

25 The Director of the Institute shall ensure that the 


pamtmann on DSKBFK8HB2PROD with BILLS
5 

•S 734 IS

1 recommendations and standards developed under 

2 paragraph (1) are consistent with the efforts re3 ferred to in subsection (a), especially with respect to 

4 the examples of possible cybersecurity capabilities re5 ferred to in such subsection. 

6 (c) INSTITUTE REPORT ON CYBERSECURITY CONSID7 ERATIONS STEMMING FROM THE CONVERGENCE OF IN8 FORMATION TECHNOLOGY, INTERNET OF THINGS, AND

9 OPERATIONAL TECHNOLOGY DEVICES, NETWORKS AND

10 SYSTEMS.—Not later than 180 days following the enact11 ment of this Act, the Director of the Institute shall publish 

12 a draft report related to the increasing convergence of tra13 ditional Information Technology devices, networks, and 

14 systems with Internet of Things devices, networks and sys15 tems and Operational Technology devices, networks and 

16 systems, including considerations for managing cybersecu17 rity risks associated with such trends. 

18 SEC. 4. POLICIES FOR FEDERAL AGENCIES ON USE AND 

19 MANAGEMENT OF INTERNET OF THINGS DE20 VICES. 

21 (a) REVISIONS TO THE FEDERAL ACQUISITION REG22 ULATION.—Not later than 180 days after the date on 

23 which the Director of the National Institute of Standards 

24 and Technology completes the development of the rec25 ommendations required under section 3(b), the Director 


pamtmann on DSKBFK8HB2PROD with BILLS
6 

•S 734 IS

1 of the Office of Management and Budget shall issue guide2 lines for each agency that are consistent with such rec3 ommendations. 

4 (b) REQUIREMENT.—In issuing the guidelines re5 quired under subsection (a), the Director of the Office of 

6 Management and Budget shall ensure that the guidelines 

7 are consistent with the information security requirements 

8 in subchapter II of chapter 35 of title 44, United States 

9 Code. 

10 (c) QUINQUENNIAL REVIEWS AND REVISIONS.—Not 

11 less frequently than once every 5 years— 

12 (1) the Director of the Office of Management 

13 and Budget and the Director of the National Insti14 tute of Standards and Technology shall review the 

15 policies issued under subsection (a); and 

16 (2) the Director of the Office of Management 

17 and Budget shall, in consultation with the Director 

18 of the National Institute of Standards and Tech19 nology, revise such policies. 


pamtmann on DSKBFK8HB2PROD with BILLS
7 

•S 734 IS

1 SEC. 5. NATIONAL INSTITUTE OF STANDARDS AND TECH2 NOLOGY GUIDANCE ON COORDINATED DIS3 CLOSURE OF SECURITY VULNERABILITIES 

4 RELATING TO INTERNET OF THINGS DE5 VICES. 

6 (a) IN GENERAL.—Not later than 180 days after the 

7 date of the enactment of this Act, the Director of the Na8 tional Institute of Standards and Technology shall, in con9 sultation with such cybersecurity researchers and private10 sector industry experts as the Director considers appro11 priate, publish guidance on policies and procedures for the 

12 reporting, coordinating, publishing, and receiving of infor13 mation about— 

14 (1) a security vulnerability relating to a covered 

15 device used by the Federal Government; and 

16 (2) the resolution of such security vulnerability. 

17 (b) ELEMENTS.—The guidance published under sub18 section (a) shall include the following: 

19 (1) Policies and procedures described in sub20 section (a) that, to the maximum extent practicable, 

21 are aligned with Standards 29147 and 30111 of the 

22 International Standards Organization, or any suc23 cessor standards. Such policies and procedures shall 

24 include policies and procedures for a contractor or 

25 vendor providing a covered device to the Federal 

26 Government on— 


pamtmann on DSKBFK8HB2PROD with BILLS
8 

•S 734 IS

1 (A) receiving information about a potential 

2 security vulnerability relating to the covered de3 vice; and 

4 (B) disseminating information about the 

5 resolution of a security vulnerability relating to 

6 the covered device. 

7 (2) Guidance, including example content, on the 

8 information items that should be produced through 

9 the implementation of the security vulnerability dis10 closure process of the contractor. 

11 SEC. 6. GUIDELINES FOR FEDERAL AGENCIES ON COORDI12 NATED DISCLOSURE OF SECURITY 

13 VULNERABILITIES RELATING TO INTERNET 

14 OF THINGS DEVICES. 

15 (a) AGENCY GUIDELINES REQUIRED.—Not later 

16 than 180 days after the date on which the guidance re17 quired under section 4 is published, the Director of the 

18 Office of Management and Budget shall, in consultation 

19 with the Administrator of the General Services Adminis20 tration, issue guidelines for each agency on reporting, co21 ordinating, publishing, and receiving information about— 

22 (1) a security vulnerability relating to a covered 

23 device used by the agency; and 

24 (2) the resolution of such security vulnerability. 


pamtmann on DSKBFK8HB2PROD with BILLS
9 

•S 734 IS

1 (b) CONTRACTOR AND VENDOR COMPLIANCE WITH

2 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

3 GUIDANCE.—The guidelines required by subsection (a) 

4 shall include a limitation that prohibits an agency from 

5 acquiring or using any covered device from a contractor 

6 or vendor if the contractor or vendor fails to comply with 

7 the guidance published under section 5(a). 

8 (c) CONSISTENCY WITH GUIDANCE FROM NATIONAL

9 INSTITUTE OF STANDARDS AND TECHNOLOGY.—The Di10 rector shall ensure that the guidelines issued under sub11 section (a) are consistent with the guidance published 

12 under section 5(a). 

Æ 


pamtmann on DSKBFK8HB2PROD with BILLS