I 

113TH CONGRESS 

1ST SESSION H. R. 3635 

To ensure the functionality and security of new Federal websites that collect 

personally identifiable information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 3, 2013 

Mr. BENTIVOLIO introduced the following bill; which was referred to the 

Committee on Oversight and Government Reform 

A BILL 

To ensure the functionality and security of new Federal 

websites that collect personally identifiable information, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safe and Secure Fed5 eral Websites Act of 2013’’. 

6 SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 

7 FEDERAL WEBSITES THAT COLLECT PERSON8 ALLY IDENTIFIABLE INFORMATION. 

9 (a) CERTIFICATION REQUIREMENT.— 


smartinez on DSK6TPTVN1PROD with BILLS
2 

•HR 3635 IH

1 (1) IN GENERAL.—Except as otherwise pro2 vided under this subsection, an agency may not de3 ploy or make available to the public a new Federal 

4 PII website until the date on which a certification 

5 under subsection (b)(2) is submitted to Congress 

6 that the website is fully functional and secure. 

7 (2) TRANSITION.—In the case of a new Federal 

8 PII website that is operational on the date of the en9 actment of this Act, paragraph (1) shall not apply 

10 until the end of the 30-day period beginning on such 

11 date of enactment. If the certification under sub12 section (b)(2) for such website has not been sub13 mitted to Congress before the end of such period, 

14 the head of the responsible agency shall render the 

15 website inaccessible to the public until such certifi16 cation is submitted to Congress. 

17 (3) EXCEPTION FOR BETA WEBSITE WITH EX18 PLICIT PERMISSION.—Paragraph (1) shall not apply 

19 to a website (or portion thereof) that is designed for 

20 testing and development purposes, if the following 

21 conditions are met: 

22 (A) A member of the public may access 

23 PII-related portions of the website only after 

24 executing an agreement that acknowledges the 

25 risks involved. 


smartinez on DSK6TPTVN1PROD with BILLS
3 

•HR 3635 IH

1 (B) No agency compelled, enjoined, or oth2 erwise provided incentives for such a member to 

3 access the website for such purposes. 

4 (4) CONSTRUCTION.—Nothing in this section 

5 shall be construed as applying to a website that is 

6 operated entirely by an entity (such as a State or lo7 cality) that is independent of the Federal Govern8 ment, regardless of the receipt of funding in support 

9 of such website from the Federal Government. 

10 (b) PROCESS FOR STUDY AND CERTIFICATION OF

11 FUNCTIONALITY AND SECURITY OF NEW FEDERAL PII 

12 WEBSITES.— 

13 (1) GAO STUDY AND REPORT.— 

14 (A) STUDY.— 

15 (i) CURRENT WEBSITES.—Not later 

16 than 30 days after the date of the enact17 ment of this Act, the Comptroller General 

18 of the United States shall conduct a study 

19 of each new Federal PII website that is 

20 operational as of such date of enactment to 

21 determine whether such website is fully 

22 functional and secure. 

23 (ii) FUTURE WEBSITES.—Not later 

24 than 30 days after the date on which an 

25 advance notification is received under 


smartinez on DSK6TPTVN1PROD with BILLS
4 

•HR 3635 IH

1 paragraph (3) for a new Federal PII 

2 website that is not operational as of such 

3 date of enactment, the Comptroller Gen4 eral shall conduct a study of such website 

5 to determine whether such website is fully 

6 functional and secure. 

7 (B) REPORT TO APPROPRIATE CONGRES8 SIONAL COMMITTEES.—Upon the completion of 

9 a study of a website under subparagraph (A) or 

10 (C), the Comptroller General shall submit to 

11 the appropriate committees of Congress and the 

12 Chief Information Officer for the responsible 

13 agency a report on the results of the study. 

14 Such report shall include a determination of 

15 whether the website is fully functional and se16 cure. 

17 (C) FOLLOWUP STUDIES AND REPORT.— 

18 If, based on the results of the most recent study 

19 under subparagraph (A) or this subparagraph, 

20 the Comptroller General determines that the 

21 website is not fully functional or not secure, the 

22 Comptroller General shall conduct an additional 

23 study (and submit a report described in sub24 paragraph (B) on the results of such study) 

25 until the Comptroller General determines that 


smartinez on DSK6TPTVN1PROD with BILLS
5 

•HR 3635 IH

1 the website is determined to be fully functional 

2 and secure. 

3 (2) CERTIFICATION BY CIO OF RESPONSIBLE

4 AGENCY.—Upon the submission of a report under 

5 paragraph (1) that determines that a website oper6 ated by a responsible agency is fully functional and 

7 secure, the Chief Information Officer for such agen8 cy shall submit to Congress a certification of the re9 sults of such report and a certification as to whether 

10 the website is fully functional and secure. 

11 (3) ADVANCE NOTIFICATION FOR OPERATION

12 OF FUTURE WEBSITES.—Each agency that intends 

13 to operate a new Federal PII website on or after the 

14 date of the enactment of this Act shall notify the 

15 Comptroller General of such intention and provide to 

16 the Comptroller General, in advance of the website 

17 becoming operational, such information as the 

18 Comptroller General may require to conduct a study 

19 and perform an evaluation under this subsection. 

20 (c) DEFINITIONS.—In this section: 

21 (1) AGENCY.—The term ‘‘agency’’ has the 

22 meaning given that term under section 551 of title 

23 5, United States Code. 

24 (2) FULLY FUNCTIONAL.—The term ‘‘fully 

25 functional’’ means, with respect to a new Federal 


smartinez on DSK6TPTVN1PROD with BILLS
6 

•HR 3635 IH

1 PII website, that the website can fully support the 

2 activities for which it is designed or intended with 

3 regard to the eliciting, collection, or storage of per4 sonally identifiable information, including handling a 

5 volume of queries relating to such information com6 mensurate with the purpose for which the website is 

7 designed. 

8 (3) NEW FEDERAL PII WEBSITE.—The term 

9 ‘‘new Federal PII website’’ means a website that— 

10 (A) is operated by (or under a contract 

11 with) an agency; 

12 (B) elicits, collects, or stores personally 

13 identifiable information of individuals and is ac14 cessible to the public; and 

15 (C) is first made accessible to the public 

16 and collects or stores personally identifiable in17 formation of individuals, on or after July 1, 

18 2013. 

19 (4) OPERATIONAL.—The term ‘‘operational’’ 

20 means, with respect to a website, that such website 

21 elicits, collects, or stores personally identifiable in22 formation of members of the public and is accessible 

23 to the public. 

24 (5) PERSONALLY IDENTIFIABLE INFORMATION

25 (PII).—The terms ‘‘personally identifiable informaVerDate Mar 15 2010 01:51 Dec 04, 2013 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3635.IH H3635

smartinez on DSK6TPTVN1PROD with BILLS
7 

•HR 3635 IH

1 tion’’ and ‘‘PII’’ mean any information that can be 

2 associated with one individual through a social secu3 rity account number, taxpayer identification number, 

4 state identification number or other identifer, but 

5 does not include information (such as name, mailing 

6 or email address, telephone number, or similar con7 tact information) necessary to contact an individual. 

8 (6) RESPONSIBLE AGENCY.—The term ‘‘respon9 sible agency’’ means, with respect to a new Federal 

10 PII website, the agency that is responsible for the 

11 operation (whether directly or through contracts 

12 with other entities) of the website. 

13 (7) SECURE.—The term ‘‘secure’’ means, with 

14 respect to a new Federal PII website, that the fol15 lowing requirements are met: 

16 (A) The website has security features that 

17 meet a standard acceptable for banking pur18 poses and the responsible agency has a named 

19 overall security leader with a comprehensive, 

20 top-down view of the security posture for the 

21 website who has supervised a complete end-to22 end security test. 

23 (B) The website ensures that personally 

24 identifiable information elicited, collected, or 

25 stored in connection with the website is capVerDate Mar 15 2010 01:51 Dec 04, 2013 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H3635.IH H3635

smartinez on DSK6TPTVN1PROD with BILLS
8 

•HR 3635 IH

1 tured at the latest possible step in a user input 

2 sequence. 

3 (C) The responsible agency for the website 

4 has taken reasonable efforts to minimize do5 main name confusion, including through addi6 tional domain registrations and a program to 

7 educate consumers how to spot fraudulent 

8 websites. 

9 (D) The responsible agency requires all 

10 personnel who have access to personally identi11 fiable information in connection with the 

12 website to have completed a Standard Form 

13 85P and signed a non-disclosure agreement 

14 with respect to personally identifiable informa15 tion, and the agency takes proper precautions 

16 to ensure only trustworthy persons may access 

17 such information. 

18 (E) The responsible agency maintains (ei19 ther directly or through contract) ample per20 sonnel to respond in a timely manner to issues 

21 relating to the proper functioning and security 

22 of the website, and to monitor on an ongoing 

23 basis existing and emerging security threats to 

24 the website. 


smartinez on DSK6TPTVN1PROD with BILLS
9 

•HR 3635 IH

1 (8) STATE.—The term ‘‘State’’ means each 

2 State of the United States, the District of Columbia, 

3 each territory or possession of the United States, 

4 and each federally recognized Indian tribe. 

Æ 


smartinez on DSK6TPTVN1PROD with BILLS