79–006 

115TH CONGRESS REPORT " ! HOUSE OF REPRESENTATIVES 2d Session 115–622 

STB INFORMATION SECURITY IMPROVEMENT ACT 

APRIL 5, 2018.—Committed to the Committee of the Whole House on the State of 

the Union and ordered to be printed 

Mr. SHUSTER, from the Committee on Transportation and 

Infrastructure, submitted the following 

R E P O R T 

[To accompany H.R. 4921] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Transportation and Infrastructure, to whom 

was referred the bill (H.R. 4921) to require the Surface Board of 

Transportation to implement certain recommendations of the Inspector General of the Department of Transportation, having considered the same, report favorably thereon with amendments and 

recommend that the bill as amended do pass. 

CONTENTS 

Page 

Purpose of Legislation ............................................................................................. 2 

Background and Need for Legislation .................................................................... 2 

Hearings ................................................................................................................... 3 

Legislative History and Consideration .................................................................. 3 

Committee Votes ...................................................................................................... 3 

Committee Oversight Findings ............................................................................... 3 

New Budget Authority and Tax Expenditures ...................................................... 3 

Congressional Budget Office Cost Estimate .......................................................... 4 

Performance Goals and Objectives ......................................................................... 5 

Advisory of Earmarks .............................................................................................. 5 

Duplication of Federal Programs ............................................................................ 5 

Disclosure of Directed Rule Makings ..................................................................... 5 

Federal Mandate Statement ................................................................................... 5 

Preemption Clarification ......................................................................................... 5 

Advisory Committee Statement .............................................................................. 5 

Applicability of Legislative Branch ........................................................................ 6 

Section-by-Section Analysis of Legislation ............................................................ 6 

Changes in Existing Law Made by the Bill, as Reported ..................................... 6 

The amendments are as follows: 

Strike all after the enacting clause and insert the following: 

2 

SECTION 1. SHORT TITLE. 

This Act may be cited as the ‘‘STB Information Security Improvement Act’’. 

SEC. 2. REQUIREMENTS. 

(a) IN GENERAL.—The Surface Transportation Board (in this section referred to 

as the ‘‘STB’’) shall develop a timeline and plan to implement the recommendations 

of the Inspector General of the Department of Transportation in Report No. 

FI2018002, including improvements— 

(1) to identify controls, including risk management, weakness remediation, 

and security authorization; 

(2) to protect controls, including configuration management, user identity and 

access management, and security training; 

(3) to detect controls, including continuous monitoring; 

(4) to respond controls, including incident handling and reporting; 

(5) to recover controls for contingency planning; and 

(6) any additional tools that will improve the implementation of the recommendations. 

(b) IMPLEMENTATION.— 

(1) IN GENERAL.—Not later than 180 days after the date of enactment of this 

Act, the STB shall submit the plan and timeline developed under subsection (a) 

to the Committee on Transportation and Infrastructure of the House of Representatives and the Committee on Commerce of the Senate. 

(2) REPORT.—The STB shall report annually to such Committees on the 

progress on implementation of the recommendations until the implementation 

is complete. 

(3) PLAN IMPLEMENTATION.—The STB shall designate an individual to implement the plan developed under subsection (a). 

SEC. 3. NO ADDITIONAL FUNDS AUTHORIZED. 

No additional funds are authorized to carry out the requirements of this Act. Such 

requirements shall be carried out using amounts otherwise authorized. 

Amend the title so as to read: 

A bill to require the Surface Transportation Board to implement 

certain recommendations of the Inspector General of the Department of Transportation. 

PURPOSE OF LEGISLATION

H.R. 4921, the STB Information Security Improvement Act, requires the Surface Transportation Board (STB) to develop a 

timeline and plan to modernize its information security program. 

The bill requires the STB to implement recommendations from the 

Department of Transportation Inspector General (DOT IG) Report 

Number FI2018002. 

BACKGROUND AND NEED FOR LEGISLATION

In October 2017, the DOT IG published a report that identified 

the STB’s information security system to be at the Ad Hoc maturity level. The Ad Hoc maturity level means that policies, procedures, and strategy are not formalized and activities are performed 

in a reactive manner. The report outlined recommendations necessary for the STB to develop an effective information security program. The DOT IG’s report made a series of recommendations to 

help STB improve its information security systems. The DOT IG 

outlined issues with the following: 

(1) STB’s Identify controls—risk management, weakness remediation, and security authorization—were inadequate. STB did not 

have a risk management program and its process to reauthorize 

systems was inadequate. 

(2) STB’s Protect controls—configuration management, user identity management, and security training—were inadequate. Policy 

and procedures did not cover software patch installation or parts 

3 

of user identity management. Only 66 percent of STB employees 

completed 2017 security awareness training. 

(3) STB did not have policy for Detect controls—to identify cybersecurity incidents in an information security continuous monitoring 

program—and lacked a monitoring strategy. 

(4) STB’s Respond controls—incident handling and reporting— 

were inadequate. The policy did not cover incident response planning and analysis. STB had not collaborated with DHS on incident 

response. 

(5) STB had not implemented Recover controls for contingency 

planning. STB lacked a plan for system recovery after emergency 

shutdowns, impact analysis, alternative sites, or data back-up 

As a result of its separation from DOT in December 2015, the 

STB gained full control over its information security program. With 

that control, a need to place security controls now resides within 

the STB. While the STB issued policies in May 2017 to create a cybersecurity program, the STB never completed its implementation, 

leaving its information security program encumbered by a number 

of weaknesses in five different function areas. Effective information 

security programs are necessary to ensure the STB can execute its 

mission safely and effectively. The STB must strive to improve information security systems to avoid an increasing risk of attack or 

compromise. 

HEARINGS

There were no hearings related to this legislation in the House. 

LEGISLATIVE HISTORY AND CONSIDERATION

On February 5, 2018, Representative Paul Mitchell (R–MI) introduced H.R. 4921, the STB Information Security Improvement Act. 

On February 14, 2018, the Committee on Transportation and Infrastructure met in open session to consider H.R. 4921. An amendment was offered in Committee by Representative Mitchell, which 

was adopted by voice vote. The amendment made technical corrections and added a recommendation from the DOT IG report. The 

Committee ordered H.R. 4921, as amended, reported favorably to 

the House by voice vote with a quorum present. 

COMMITTEE VOTES

Clause 3(b) of rule XIII of the Rules of the House of Representatives requires each committee report to include the total number of 

votes cast for and against on each record vote on a motion to report 

and on any amendment offered to the measure or matter, and the 

names of those members voting for and against. There were no recorded votes associated with this bill. 

COMMITTEE OVERSIGHT FINDINGS

With respect to the requirements of clause 3(c)(1) of rule XIII of 

the Rules of the House of Representatives, the Committee’s oversight findings and recommendations are reflected in this report. 

NEW BUDGET AUTHORITY AND TAX EXPENDITURES

In compliance with clause 3(c)(2) of rule XIII of the Rules of the 

House of Representatives, the Committee adopts as its own the esVerDate Sep 11 2014 05:12 Apr 06, 2018 Jkt 079006 PO 00000 Frm 00003 Fmt 6659 Sfmt 6602 E:\HR\OC\HR622.XXX HR622
4 

timate of new budget authority, entitlement authority, or tax expenditures or revenues contained in the cost estimate prepared by 

the Director of the Congressional Budget Office pursuant to section 

402 of the Congressional Budget Act of 1974, included below. 

CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

With respect to the requirement of clause 3(c)(3) of rule XIII of 

the Rules of the House of Representatives and section 402 of the 

Congressional Budget Act of 1974, the Committee has received the 

enclosed cost estimate for H.R. 4921, as amended, from the Director of the Congressional Budget Office: 

U.S. CONGRESS, 

CONGRESSIONAL BUDGET OFFICE, 

Washington, DC, March 20, 2018. 

Hon. BILL SHUSTER, 

Chairman, Committee on Transportation and Infrastructure, 

House of Representatives, Washington, DC. 

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 4921, the STB Information Security Improvement Act. 

If you wish further details on this estimate, we will be pleased 

to provide them. The CBO staff contact is Sarah Puro. 

Sincerely, 

KEITH HALL, 

Director. 

Enclosure. 

H.R. 4921—STB Information Security Improvement Act 

H.R. 4921 would require the Surface Transportation Board (STB) 

to develop a plan to comply with recommendations made by the Department of Transportation’s inspector general regarding its information security system. The bill would require the STB to report 

annually to the Congress on the status of its compliance with the 

inspector general’s report. 

Under current law, CBO expects that the STB will implement 

the inspector general’s recommendations regarding its information 

security system. The agency has already hired an employee to manage and implement the plan. As a result, CBO estimates that implementing the provisions of H.R. 4921 would have no significant 

effect on the federal budget over the 2018–2022 period. 

Enacting H.R. 4921 would not affect direct spending or revenues; 

therefore, pay-as-you-go procedures do not apply. 

CBO estimates that enacting H.R. 4921 would not increase net 

direct spending or on-budget deficits in any of the four consecutive 

10-year periods beginning in 2028. 

H.R. 4921 contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act. 

The CBO staff contact for this estimate is Sarah Puro. The estimate was approved by H. Samuel Papenfuss, Deputy Assistant Director for Budget Analysis. 

5 

PERFORMANCE GOALS AND OBJECTIVES

With respect to the requirement of clause 3(c)(4) of rule XIII of 

the Rules of the House of Representatives, the performance goals 

and objectives of this legislation are to ensure adequate information security at the STB. This bill, as amended, enhances cybersecurity by recommending specific measures the STB may take to improve information security. 

ADVISORY OF EARMARKS

Pursuant to clause 9 of rule XXI of the Rules of the House of 

Representatives, the Committee is required to include a list of congressional earmarks, limited tax benefits, or limited tariff benefits 

as defined in clause 9(e), 9(f), and 9(g) of rule XXI of the Rules of 

the House of Representatives. No provision in the bill, as amended, 

includes an earmark, limited tax benefit, or limited tariff benefit 

under clause 9(e), 9(f), or 9(g) of rule XXI. 

DUPLICATION OF FEDERAL PROGRAMS

Pursuant to section 3(g) of H. Res. 5, 114th Cong. (2015), the 

Committee finds that no provision of H.R. 4921, as amended, establishes or reauthorizes a program of the federal government known 

to be duplicative of another federal program, a program that was 

included in any report from the Government Accountability Office 

to Congress pursuant to section 21 of Public Law 111–139, or a 

program related to a program identified in the most recent Catalog 

of Federal Domestic Assistance. 

DISCLOSURE OF DIRECTED RULE MAKINGS

Pursuant to section 3(i) of H. Res. 5, 113th Cong. (2015), the 

Committee estimates that enacting H.R. 4921, as amended, does 

not specifically direct the completion of a specific rule making within the meaning of section 551 of title 5, United States Code. 

FEDERAL MANDATE STATEMENT

The Committee adopts as its own the estimate of federal mandates prepared by the Director of the Congressional Budget Office 

pursuant to section 423 of the Unfunded Mandates Reform Act 

(Public Law 104–4). 

PREEMPTION CLARIFICATION

Section 423 of the Congressional Budget Act of 1974 requires the 

report of any Committee on a bill or joint resolution to include a 

statement on the extent to which the bill or joint resolution is intended to preempt state, local, or tribal law. The Committee states 

that H.R. 4921, as amended, does not preempt any state, local, or 

tribal law. H.R. 4921, as amended, preserves the rights and permitting authorities of states. 

ADVISORY COMMITTEE STATEMENT

No advisory committees within the meaning of section 5(b) of the 

Federal Advisory Committee Act are created by this legislation, as 

amended. 

6 

APPLICABILITY OF LEGISLATIVE BRANCH

The Committee finds that the legislation, as amended, does not 

relate to the terms and conditions of employment or access to public services or accommodations within the meaning of section 

102(b)(3) of the Congressional Accountability Act (Public Law 104– 

1). 

SECTION–BY–SECTION ANALYSIS OF LEGISLATION

Section 1. Short title 

This section designates the short title of the bill as the ‘‘STB Information Security Improvement Act’’. 

Section 2. Requirements 

This section directs the STB to develop a timeline and plan to 

implement the recommendations from the DOT IG Report Number 

FI2018002. 

No later than 180 days after the date of enactment, the STB 

must submit the plan and timeline to Congress. 

The STB must annually update Congress on its implementation 

progress until it is completed. 

Section 3. No additional funds authorized 

This section lays out that no additional funds are authorized to 

carry out the requirements of the bill. 

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

H.R. 4921 makes no changes to existing law. 

Æ