IB 

Union Calendar No. 518 

116TH CONGRESS 

2D SESSION H. R. 1731 

[Report No. 116–633] 

To amend the Securities Exchange Act of 1934 to promote transparency 

in the oversight of cybersecurity risks at publicly traded companies. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 13, 2019 

Mr. HIMES (for himself, Mr. HECK, and Mr. MEEKS) introduced the following 

bill; which was referred to the Committee on Financial Services 

DECEMBER 8, 2020 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on March 13, 2019] 


SSpencer on DSK126QN23PROD with BILLS
2 

•HR 1731 RH

A BILL 

To amend the Securities Exchange Act of 1934 to promote 

transparency in the oversight of cybersecurity risks at 

publicly traded companies. 


SSpencer on DSK126QN23PROD with BILLS
3 

•HR 1731 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Disclosure 

5 Act of 2019’’. 

6 SEC. 2. CYBERSECURITY TRANSPARENCY. 

7 The Securities Exchange Act of 1934 (15 U.S.C. 78a 

8 et seq.) is amended by inserting after section 14B (15 

9 U.S.C. 78n–2) the following: 

10 ‘‘SEC. 14C. CYBERSECURITY TRANSPARENCY. 

11 ‘‘(a) DEFINITIONS.—In this section— 

12 ‘‘(1) the term ‘cybersecurity’ means any action, 

13 step, or measure to detect, prevent, deter, mitigate, or 

14 address any cybersecurity threat or any potential cy15 bersecurity threat; 

16 ‘‘(2) the term ‘cybersecurity threat’— 

17 ‘‘(A) means an action, not protected by the 

18 First Amendment to the Constitution of the 

19 United States, on or through an information sys20 tem that may result in an unauthorized effort to 

21 adversely impact the security, availability, con22 fidentiality, or integrity of an information sys23 tem or information that is stored on, processed 

24 by, or transiting an information system; and 


SSpencer on DSK126QN23PROD with BILLS
4 

•HR 1731 RH

1 ‘‘(B) does not include any action that solely 

2 involves a violation of a consumer term of service 

3 or a consumer licensing agreement; 

4 ‘‘(3) the term ‘information system’— 

5 ‘‘(A) has the meaning given the term in sec6 tion 3502 of title 44, United States Code; and 

7 ‘‘(B) includes industrial control systems, 

8 such as supervisory control and data acquisition 

9 systems, distributed control systems, and pro10 grammable logic controllers; 

11 ‘‘(4) the term ‘NIST’ means the National Insti12 tute of Standards and Technology; and 

13 ‘‘(5) the term ‘reporting company’ means any 

14 company that is an issuer— 

15 ‘‘(A) the securities of which are registered 

16 under section 12; or 

17 ‘‘(B) that is required to file reports under 

18 section 15(d). 

19 ‘‘(b) REQUIREMENT TO ISSUE RULES.—Not later than 

20 360 days after the date of enactment of this section, the 

21 Commission shall issue final rules to require each reporting 

22 company, in the annual report of the reporting company 

23 submitted under section 13 or section 15(d) or in the an24 nual proxy statement of the reporting company submitted 

25 under section 14(a)— 


SSpencer on DSK126QN23PROD with BILLS
5 

•HR 1731 RH

1 ‘‘(1) to disclose whether any member of the gov2 erning body, such as the board of directors or general 

3 partner, of the reporting company has expertise or ex4 perience in cybersecurity and in such detail as nec5 essary to fully describe the nature of the expertise or 

6 experience; and 

7 ‘‘(2) if no member of the governing body of the 

8 reporting company has expertise or experience in cy9 bersecurity, to describe what other aspects of the re10 porting company’s cybersecurity were taken into ac11 count by any person, such as an official serving on 

12 a nominating committee, that is responsible for iden13 tifying and evaluating nominees for membership to 

14 the governing body. 

15 ‘‘(c) CYBERSECURITY EXPERTISE OR EXPERIENCE.— 

16 For purposes of subsection (b), the Commission, in consulta17 tion with NIST, shall define what constitutes expertise or 

18 experience in cybersecurity using commonly defined roles, 

19 specialties, knowledge, skills, and abilities, such as those 

20 provided in NIST Special Publication 800–181, titled ‘Na21 tional Initiative for Cybersecurity Education (NICE) Cy22 bersecurity Workforce Framework’, or any successor there23 to.’’. 


SSpencer on DSK126QN23PROD with BILLS
Union Calendar No. 518 

116TH CONGRESS 

2D SESSION H. R. 1731 

[Report No. 116–633] 

A BILL 

To amend the Securities Exchange Act of 1934 to 

curity risks at publicly traded companies. promote transparency in the oversight of cyberseDECEMBER 8, 2020 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


SSpencer on DSK126QN23PROD with BILLS