II 

116TH CONGRESS 

2D SESSION S. 4912 

To amend the Federal Cybersecurity Enhancement Act of 2015 to require 

Federal agencies to obtain exemptions from certain cybersecurity requirements in order to avoid compliance with those requirements, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 18, 2020 

Mr. WYDEN introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend the Federal Cybersecurity Enhancement Act of 

2015 to require Federal agencies to obtain exemptions 

from certain cybersecurity requirements in order to avoid 

compliance with those requirements, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Cybersecurity 

5 Oversight Act of 2020’’. 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 4912 IS

1 SEC. 2. FEDERAL CYBERSECURITY REQUIREMENTS. 

2 (a) EXEMPTION FROM FEDERAL REQUIREMENTS.— 

3 Section 225(b)(2) of the Federal Cybersecurity Enhance4 ment Act of 2015 (6 U.S.C. 1523(b)(2)) is amended to 

5 read as follows: 

6 ‘‘(2) EXCEPTION.— 

7 ‘‘(A) IN GENERAL.—A particular require8 ment under paragraph (1) shall not apply to an 

9 agency information system of an agency if— 

10 ‘‘(i) with respect to the agency infor11 mation system, the head of the agency sub12 mits to the Director an application for an 

13 exemption from the particular requirement, 

14 in which the head of the agency personally 

15 certifies to the Director with particularity 

16 that— 

17 ‘‘(I) operational requirements ar18 ticulated in the certification and re19 lated to the agency information sys20 tem would make it excessively burden21 some to implement the particular re22 quirement; 

23 ‘‘(II) the particular requirement 

24 is not necessary to secure the agency 

25 information system or agency inforVerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4912.IS S4912

pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 4912 IS

1 mation stored on or transiting the 

2 agency information system; and 

3 ‘‘(III) the agency has taken all 

4 necessary steps to secure the agency 

5 information system and agency infor6 mation stored on or transiting the 

7 agency information system; 

8 ‘‘(ii) the head of the agency or the 

9 designee of the head of the agency has 

10 submitted the certification described in 

11 clause (i) to the appropriate congressional 

12 committees and any other congressional 

13 committee with jurisdiction over the agen14 cy; and 

15 ‘‘(iii) the Director grants the exemp16 tion from the particular requirement. 

17 ‘‘(B) DURATION OF EXEMPTION.— 

18 ‘‘(i) IN GENERAL.—An exemption 

19 granted under subparagraph (A) shall ex20 pire on the date that is 1 year after the 

21 date on which the Director grants the ex22 emption. 

23 ‘‘(ii) RENEWAL.—Upon the expiration 

24 of an exemption granted to an agency 

25 under subparagraph (A), the head of the 


pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 4912 IS

1 agency may apply for an additional exemp2 tion.’’. 

3 (b) REPORT ON EXEMPTIONS.—Section 

4 3554(c)(1)(A) of title 44, United States Code, is amend5 ed— 

6 (1) in clause (iii), by striking ‘‘and’’ at the end; 

7 (2) by redesignating clause (iv) as clause (v); 

8 and 

9 (3) by inserting after clause (iii) the following: 

10 ‘‘(iv) with respect to any exemptions 

11 the agency is granted by the Director of 

12 the Office of Management and Budget 

13 under section 225(b)(2) of the Federal Cy14 bersecurity Enhancement Act of 2015 (6 

15 U.S.C. 1523(b)(2)) that is effective on the 

16 date of submission of the report— 

17 ‘‘(I) an identification of the par18 ticular requirements from which any 

19 agency information system (as defined 

20 in section 2210 of the Homeland Se21 curity Act of 2002 (6 U.S.C. 660)) is 

22 exempted; and 

23 ‘‘(II) for each requirement identi24 fied under subclause (I)— 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 4912 IS

1 ‘‘(aa) an identification of the 

2 agency information system de3 scribed in subclause (I) exempted 

4 from the requirement; and 

5 ‘‘(bb) an estimate of the 

6 date on which the agency will to 

7 be able to comply with the re8 quirement; and’’. 

9 (c) EFFECTIVE DATE.—This Act and the amend10 ments made by this Act shall take effect on the date that 

11 is 1 year after the date of enactment of this Act. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS