116TH CONGRESS 

2D SESSION H. R. 4458 

AN ACT 

To require the Board of Governors of the Federal Reserve 

System to issue reports on cybersecurity with respect 

to the functions of the Federal Reserve System, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•HR 4458 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Cybersecurity and Fi3 nancial System Resilience Act of 2019’’. 

4 SEC. 2. CYBERSECURITY AND FINANCIAL SYSTEM RESIL5 IENCE REPORT. 

6 (a) IN GENERAL.—Not later than the end of the 180- 

7 day period beginning on the date of enactment of this Act, 

8 and annually thereafter, each banking regulator shall sub9 mit a report to the Committee on Financial Services of 

10 the House of Representatives and the Committee on 

11 Banking, Housing, and Urban Affairs of the Senate that 

12 provides a detailed explanation of measures undertaken to 

13 strengthen cybersecurity with respect to the functions of 

14 the regulator, including the supervision and regulation of 

15 financial institutions and, where applicable, third-party 

16 service providers. Each such report shall specifically in17 clude a detailed analysis of— 

18 (1) policies and procedures (including those de19 scribed under section 3554(b) of title 44, United 

20 States Code) that guard against— 

21 (A) efforts to deny access to or degrade, 

22 disrupt, or destroy any information and com23 munications technology system or network, or 

24 exfiltrate information from such a system or 

25 network without authorization; 

26 (B) destructive malware attacks; 
3 

•HR 4458 EH

1 (C) denial of service activities; and 

2 (D) any other efforts that may threaten 

3 the functions of the banking regulator or enti4 ties overseen by the regulator by undermining 

5 cybersecurity and the resilience of the financial 

6 system; 

7 (2) activities to ensure the effective implemen8 tation of policies and procedures described under 

9 paragraph (1), including— 

10 (A) the appointment of qualified staff, the 

11 provision of staff training, the use of account12 ability measures to support staff performance, 

13 and the designation, if any, of senior appointed 

14 leadership to strengthen accountability for over15 sight of cybersecurity measures; 

16 (B) deployment of adequate resources and 

17 technologies; 

18 (C) efforts to respond to cybersecurity-re19 lated findings and recommendations of the In20 spector General of the banking regulator or the 

21 independent evaluation described under section 

22 3555 of title 42, United States Code; and 

23 (D) as appropriate, efforts to strengthen 

24 cybersecurity in coordination with other Federal 

25 departments and agencies, domestic and foreign 
4 

•HR 4458 EH

1 financial institutions, and other partners, in2 cluding the development and dissemination of 

3 best practices regarding cybersecurity and the 

4 sharing of threat information; and 

5 (3) any current or emerging threats that are 

6 likely to pose a risk to the resilience of the financial 

7 system. 

8 (b) FORM OF REPORT.—The report required under 

9 subsection (a) shall be submitted in unclassified form, but 

10 may include a classified annex, if appropriate. 

11 (c) CONGRESSIONAL BRIEFING.—Upon request, the 

12 head of each banking regulator shall provide a detailed 

13 briefing to the appropriate Members of Congress on each 

14 report submitted pursuant to subsection (a), except— 

15 (1) the Chairman of the Board of Governors of 

16 the Federal Reserve System may designate another 

17 member of the Board of Governors of the Federal 

18 Reserve System to provide such briefing; 

19 (2) the Chairperson of the Federal Deposit In20 surance Corporation may designate another member 

21 of the Board of Directors of the Corporation to pro22 vide such briefing; and 

23 (3) the Chairman of the National Credit Union 

24 Administration may designate another member of 
5 

•HR 4458 EH

1 the National Credit Union Administration Board to 

2 provide such briefing. 

3 (d) DEFINITIONS.—For the purposes of this Act: 

4 (1) APPROPRIATE MEMBERS OF CONGRESS.— 

5 The term ‘‘appropriate Members of Congress’’ 

6 means the following: 

7 (A) The Chairman and Ranking Member 

8 of the Committee on Financial Services of the 

9 House of Representatives. 

10 (B) The Chairman and Ranking Member 

11 of the Committee on Banking, Housing, and 

12 Urban Affairs of the Senate. 

13 (2) BANKING REGULATOR.—The term ‘‘banking 

14 regulator’’ means the Board of Governors of the 

15 Federal Reserve System, the Comptroller of the Cur16 rency, the Federal Deposit Insurance Corporation, 

17 and the National Credit Union Administration. 

18 (3) SENIOR APPOINTED LEADERSHIP.—With 

19 respect to a banking regulator, the term ‘‘senior ap20 pointed leadership’’ means a position that requires 

21 Senate confirmation. 

22 (e) SUNSET.—The provisions of this Act shall have 

23 no force or effect on or after the date that is 7 years after 

24 the date of enactment of this Act. 
6 

•HR 4458 EH

1 SEC. 3. DETERMINATION OF BUDGETARY EFFECTS. 

2 The budgetary effects of this Act, for the purpose of 

3 complying with the Statutory Pay-As-You-Go Act of 2010, 

4 shall be determined by reference to the latest statement 

5 titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 

6 Act, submitted for printing in the Congressional Record 

7 by the Chairman of the House Budget Committee, pro8 vided that such statement has been submitted prior to the 

9 vote on passage. 

Passed the House of Representatives January 13, 

2020. 

Attest: 

Clerk. 

116TH CONGRESS 

2D SESSION H. R. 4458 

AN ACT 

To require the Board of Governors of the Federal 

serve System, and for other purposes. with respect to the functions of the Federal ReReserve System to issue reports on cybersecurity