II 

114TH CONGRESS 

1ST SESSION S. 1990 

To require Inspectors General and the Comptroller General of the United 

States to submit reports on the use of logical access controls and other 

security practices to safeguard classified and personally identifiable information on Federal computer systems, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

AUGUST 5, 2015 

Mr. HATCH (for himself and Mr. CARPER) introduced the following bill; which 

was read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

A BILL 

To require Inspectors General and the Comptroller General 

of the United States to submit reports on the use of 

logical access controls and other security practices to 

safeguard classified and personally identifiable information on Federal computer systems, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Computer Se5 curity Act’’. 


smartinez on DSK4TPTVN1PROD with BILLS
2 

•S 1990 IS

1 SEC. 2. DEFINITIONS. 

2 In this Act: 

3 (1) AGENCY.—The term ‘‘agency’’ has the 

4 meaning given the term in section 3502 of title 44, 

5 United States Code. 

6 (2) COVERED AGENCY.—The term ‘‘covered 

7 agency’’ means an agency that operates a Federal 

8 computer system that provides access to classified 

9 information or personally identifiable information. 

10 (3) LOGICAL ACCESS CONTROL.—The term 

11 ‘‘logical access control’’ means a process of granting 

12 or denying specific requests to obtain and use infor13 mation and related information processing services. 

14 (4) MULTI-FACTOR LOGICAL ACCESS CON15 TROLS.—The term ‘‘multi-factor logical access con16 trols’’ means a set of not less than 2 of the following 

17 logical access controls: 

18 (A) Information that is known to the user, 

19 such as a password or personal identification 

20 number. 

21 (B) An access device that is provided to 

22 the user, such as a cryptographic identification 

23 device or token. 

24 (C) A unique biometric characteristic of 

25 the user. 


smartinez on DSK4TPTVN1PROD with BILLS
3 

•S 1990 IS

1 SEC. 3. INSPECTOR GENERAL REPORT ON FEDERAL COM2 PUTER SYSTEMS. 

3 (a) IN GENERAL.—Not later than 240 days after the 

4 date of enactment of this Act, the Inspector General of 

5 each covered agency shall each submit to the Comptroller 

6 General of the United States and the appropriate commit7 tees of jurisdiction in the Senate and the House of Rep8 resentatives a report, which shall include information col9 lected from the covered agency for the contents described 

10 in subsection (b) regarding the Federal computer systems 

11 of the covered agency. 

12 (b) CONTENTS.—The report submitted by each In13 spector General of a covered agency under subsection (a) 

14 shall include, with respect to the covered agency, the fol15 lowing: 

16 (1) A description of the logical access standards 

17 used by the covered agency to access a Federal com18 puter system that provides access to classified or 

19 personally identifiable information, including— 

20 (A) in aggregate, a list and description of 

21 logical access controls used to access such a 

22 Federal computer system; and 

23 (B) whether the covered agency is using 

24 multi-factor logical access controls to access 

25 such a Federal computer system. 


smartinez on DSK4TPTVN1PROD with BILLS
4 

•S 1990 IS

1 (2) If the covered agency does not use logical 

2 access controls or multi-factor logical access controls 

3 to access a Federal computer system that provides 

4 access to classified or personally identifiable infor5 mation, a description of the reasons for not using 

6 such logical access controls or multi-factor logical 

7 access controls. 

8 (3) A description of the following data security 

9 management practices used by the covered agency: 

10 (A) The policies and procedures followed to 

11 conduct inventories of the software present on 

12 the Federal computer systems of the covered 

13 agency and the licenses associated with such 

14 software. 

15 (B) Whether the covered agency has en16 tered into a licensing agreement for the use of 

17 software security controls to monitor and detect 

18 exfiltration and other threats, including— 

19 (i) data loss prevention software; or 

20 (ii) digital rights management soft21 ware. 

22 (C) A description of how the covered agen23 cy is using software described in subparagraph 

24 (B). 


smartinez on DSK4TPTVN1PROD with BILLS
5 

•S 1990 IS

1 (D) If the covered agency has not entered 

2 into a licensing agreement for the use of, or is 

3 otherwise not using, software described in sub4 paragraph (B), a description of the reasons for 

5 not entering into such a licensing agreement or 

6 using such software. 

7 (4) A description of the policies and procedures 

8 of the covered agency with respect to ensuring that 

9 entities, including contractors, that provide services 

10 to the covered agency are implementing the data se11 curity management practices described in paragraph 

12 (3). 

13 (c) EXISTING REVIEW.—The report required under 

14 this section may be based in whole or in part on an audit, 

15 evaluation, or report relating to programs or practices of 

16 the covered agency, and may be submitted as part of an17 other report, including the report required under section 

18 3555 of title 44, United States Code. 

19 (d) CLASSIFIED INFORMATION.—A report submitted 

20 under this section shall be in unclassified form, but may 

21 include a classified annex. 

22 (e) AVAILABILITY TO MEMBERS OF CONGRESS.—A 

23 report submitted under this section shall be made available 

24 upon request by any Member of Congress. 


smartinez on DSK4TPTVN1PROD with BILLS
6 

•S 1990 IS

1 SEC. 4. GAO ECONOMIC ANALYSIS AND REPORT ON FED2 ERAL COMPUTER SYSTEMS. 

3 (a) REPORT.—Not later than 1 year after the date 

4 of enactment of this Act, the Comptroller General of the 

5 United States shall submit to Congress a report exam6 ining, including an economic analysis of, any impediments 

7 to agency use of effective security software and security 

8 devices. 

9 (b) CLASSIFIED INFORMATION.—A report submitted 

10 under this section shall be in unclassified form, but may 

11 include a classified annex. 

Æ 


smartinez on DSK4TPTVN1PROD with BILLS