I 

114TH CONGRESS 

2D SESSION H. R. 5069 

To amend the Sarbanes-Oxley Act of 2002 to protect investors by expanding 

the mandated internal controls reports and disclosures to include cybersecurity systems and risks of publicly traded companies. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 26, 2016 

Mr. MCDERMOTT introduced the following bill; which was referred to the 

Committee on Financial Services 

A BILL 

To amend the Sarbanes-Oxley Act of 2002 to protect investors by expanding the mandated internal controls reports 

and disclosures to include cybersecurity systems and 

risks of publicly traded companies. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Systems 

5 and Risks Reporting Act’’. 


smartinez on DSK3GLQ082PROD with BILLS
2 

•HR 5069 IH

1 SEC. 2. CYBERSECURITY AND INFORMATION SYSTEM RE2 QUIREMENTS. 

3 (a) DEFINITIONS.—Section 2(a) of the Sarbanes4 Oxley Act of 2002 (15 U.S.C. 7201(a)) is amended— 

5 (1) in paragraph (2), by inserting after ‘‘finan6 cial statements’’ the following: ‘‘and information sys7 tems’’; 

8 (2) in paragraph (3)(A), by striking ‘‘and fi9 nancial’’ and inserting ‘‘, financial, and cybersecurity 

10 systems’’; 

11 (3) in paragraph (10)(B), by inserting after 

12 ‘‘quality control policies and procedures,’’ the fol13 lowing: ‘‘cybersecurity systems standards and prac14 tices,’’; and 

15 (4) by adding at the end the following: 

16 ‘‘(18) INFORMATION SYSTEM.—The term ‘infor17 mation system’ means a set of activities, involving 

18 people, processes, data, or technology, which enable 

19 the issuer to obtain, generate, use, and communicate 

20 transactions and information to maintain account21 ability and measure and review the issuer’s perform22 ance or progress towards achievement of objectives. 

23 ‘‘(19) CYBERSECURITY SYSTEM.—The term ‘cy24 bersecurity system’ means a set of activities or state, 

25 involving people, processes, data or technology, 

26 whereby the protection of an information system of 


smartinez on DSK3GLQ082PROD with BILLS
3 

•HR 5069 IH

1 the issuer is secured from, or defended against, 

2 damage, unauthorized use or modification, misdirec3 tion, disruption or exploitation. 

4 ‘‘(20) CYBERSECURITY RISK.—The term ‘cyber5 security risk’ means a significant vulnerability to, or 

6 a significant deficiency in, the security and defense 

7 activities of a cybersecurity system.’’. 

8 (b) CORPORATE RESPONSIBILITY.—Section 302 of 

9 the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7241) is 

10 amended— 

11 (1) in the heading of such section, by inserting 

12 after ‘‘REPORTS’’ the following: ‘‘AND INFORMA13 TION SYSTEMS’’; and 

14 (2) in subsection (a)— 

15 (A) by striking ‘‘and the principal financial 

16 officer or officers,’’ and inserting ‘‘, the prin17 cipal financial officer or officers, and the prin18 cipal cybersecurity systems officer or officers’’; 

19 (B) in paragraph (4), by striking ‘‘internal 

20 controls’’ each place such term appears and in21 serting ‘‘internal controls and cybersecurity sys22 tems’’; 

23 (C) in paragraph (5)— 

24 (i) in subparagraph (A)— 


smartinez on DSK3GLQ082PROD with BILLS
4 

•HR 5069 IH

1 (I) by inserting after ‘‘operation 

2 of internal controls’’ the following: 

3 ‘‘and cybersecurity systems’’; and 

4 (II) by inserting before the semi5 colon the following: ‘‘and any signifi6 cant cybersecurity risks in issuer’s in7 formation systems’’; and 

8 (ii) in subparagraph (B), by inserting 

9 before the semicolon the following: ‘‘, cy10 bersecurity systems, or information sys11 tems’’; and 

12 (D) in paragraph (6)— 

13 (i) by striking ‘‘internal controls’’ 

14 each place such term appears and inserting 

15 ‘‘internal controls, cybersecurity systems, 

16 or information systems’’; and 

17 (ii) by striking ‘‘significant defi18 ciencies’’ and inserting ‘‘cybersecurity 

19 risks, significant deficiencies,’’. 

20 (c) MANAGEMENT ASSESSMENT.—Section 404 of the 

21 Sarbanes-Oxley Act of 2002 (15 U.S.C. 7262) is amend22 ed— 

23 (1) in the heading of such section, by inserting 

24 after ‘‘CONTROLS’’ the following: ‘‘AND INFORMA25 TION SYSTEMS’’; 


smartinez on DSK3GLQ082PROD with BILLS
5 

•HR 5069 IH

1 (2) in subsection (a)— 

2 (A) by inserting after ‘‘contain an internal 

3 control’’ the following: ‘‘and information sys4 tems’’; 

5 (B) in paragraph (1), by striking ‘‘an ade6 quate internal control structure and procedures 

7 for financial reporting’’ and inserting ‘‘adequate 

8 internal control and cybersecurity systems 

9 structures and procedures for financial and in10 formation systems reporting’’; and 

11 (C) by amending paragraph (2) to read as 

12 follows: 

13 ‘‘(2) contain assessments, as of the end of the 

14 most recent fiscal year of the issuer, of the effective15 ness of— 

16 ‘‘(A) the internal control structure and 

17 procedures of the issuer for financial reporting; 

18 and 

19 ‘‘(B) the cybersecurity systems structure of 

20 the issuer.’’; and 

21 (3) in subsection (b)— 

22 (A) in the heading of such subsection, by 

23 inserting after ‘‘INTERNAL CONTROL’’ the fol24 lowing; ‘‘AND CYBERSECURITY SYSTEMS’’; and 


smartinez on DSK3GLQ082PROD with BILLS
6 

•HR 5069 IH

1 (B) by striking ‘‘internal control assess2 ment’’ and inserting ‘‘internal control and cy3 bersecurity system structure assessments’’. 

4 (d) DISCLOSURE OF EXPERT.—Section 407 of the 

5 Sarbanes-Oxley Act of 2002 (15 U.S.C. 7265) is amend6 ed— 

7 (1) in the heading of such section, by striking 

8 ‘‘EXPERT’’ and inserting ‘‘AND CYBERSECURITY

9 SYSTEMS EXPERTS’’; 

10 (2) in subsection (a)— 

11 (A) in the heading of such subsection, by 

12 striking ‘‘EXPERT’’ and inserting ‘‘AND CYBER13 SECURITY EXPERTS’’; and 

14 (B) by striking ‘‘, as such term is defined 

15 by the Commission’’ and inserting ‘‘and at least 

16 1 member who is a cybersecurity systems ex17 pert, as such terms are defined by the Commis18 sion in consultation with the Secretary of 

19 Homeland Security and the Secretary of Com20 merce’’; and 

21 (3) by striking subsection (c) and inserting the 

22 following: 

23 ‘‘(c) CONSIDERATIONS WITH RESPECT TO CYBERSE24 CURITY EXPERTS.—In defining the term ‘cybersecurity 

25 expert’ for purposes of subsection (a), the Commission 


smartinez on DSK3GLQ082PROD with BILLS
7 

•HR 5069 IH

1 shall, in consultation with the Secretary of Homeland Se2 curity and the Secretary of Commerce, consider whether 

3 a person has, through education or experience as an infor4 mation technology officer or information systems security 

5 officer, or from a position involving the performance of 

6 similar functions— 

7 ‘‘(1) an understanding of generally accepted 

8 principles, practices, and law relating to computer 

9 security, computer network security, and data secu10 rity and privacy; 

11 ‘‘(2) experience in— 

12 ‘‘(A) the preparation of information sys13 tems audits for cybersecurity risk discovery; 

14 and 

15 ‘‘(B) the maintenance, implementation, 

16 and monitoring of information systems and 

17 their cybersecurity systems; 

18 ‘‘(3) experience with information systems as19 pects of internal accounting controls; and 

20 ‘‘(4) an understanding of audit committee func21 tions.’’. 

22 (e) ENHANCED REVIEW.—Section 408 of the Sar23 banes-Oxley Act of 2002 (15 U.S.C. 7265) is amended— 


smartinez on DSK3GLQ082PROD with BILLS
8 

•HR 5069 IH

1 (1) in subsection (a), by striking ‘‘financial 

2 statement’’ and inserting ‘‘financial, information sys3 tems, and cybersecurity systems statements’’; and 

4 (2) in subsection (b)— 

5 (A) in paragraph (5), by striking ‘‘and’’ at 

6 the end; 

7 (B) by redesignating paragraph (6) as 

8 paragraph (7); and 

9 (C) by inserting after paragraph (5) the 

10 following: 

11 ‘‘(6) issuers that have issued cybersecurity risks 

12 disclosures; and’’. 

13 (f) CLERICAL AMENDMENT.—The table of contents 

14 in section 1(b) of the Sarbanes-Oxley Act of 2002 is 

15 amended— 

16 (1) in the item relating to section 302, by in17 serting after ‘‘REPORTS’’ the following: ‘‘AND IN18 FORMATION SYSTEMS’’; 

19 (2) in the item relating to section 404, by in20 serting after ‘‘CONTROLS’’ the following: ‘‘AND 

21 INFORMATION SYSTEMS’’; and 

22 (3) in the item relating to section 407, by strik23 ing ‘‘EXPERT’’ and inserting ‘‘AND CYBERSE24 CURITY SYSTEMS EXPERTS’’. 

Æ 


smartinez on DSK3GLQ082PROD with BILLS