IB 

Union Calendar No. 421 

113TH CONGRESS 

2D SESSION H. R. 3635 

[Report No. 113–562] 

To ensure the functionality and security of new Federal websites that collect 

personally identifiable information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 3, 2013 

Mr. BENTIVOLIO introduced the following bill; which was referred to the 

Committee on Oversight and Government Reform 

JULY 28, 2014 

Additional sponsors: Mr. COLE, Mr. WILSON of South Carolina, Mr. BROOKS

of Alabama, Mrs. BACHMANN, Mr. WESTMORELAND, Mr. DUNCAN of 

South Carolina, Mrs. LUMMIS, Mr. YOHO, Mr. WALBERG, Mr. HUIZENGA

of Michigan, Mr. MEADOWS, Mrs. BLACKBURN, Mr. BENISHEK, Mr. 

KINGSTON, Mr. WEBER of Texas, Mr. FRANKS of Arizona, Mr. 

LAMALFA, Mr. ROHRABACHER, Mr. MICA, Mr. KELLY of Pennsylvania, 

Mr. BARR, Mr. LUCAS, Mr. MILLER of Florida, Mr. SAM JOHNSON of 

Texas, Mr. MESSER, Mr. MULVANEY, Mr. HUDSON, Mr. RICE of South 

Carolina, Mr. POSEY, Mr. CRAMER, Mr. WILLIAMS, Mr. STOCKMAN, Mr. 

FARENTHOLD, Mr. JORDAN, Mr. MULLIN, Mr. BRIDENSTINE, Mr. 

FINCHER, Mr. HULTGREN, Mr. COLLINS of New York, Mr. 

FLEISCHMANN, Mr. GIBBS, Mr. WENSTRUP, Mr. LANKFORD, Mr. BROUN

of Georgia, Mr. RODNEY DAVIS of Illinois, Mr. YOUNG of Alaska, Mr. 

ROKITA, Mr. MCHENRY, Mr. GOSAR, Mr. CARTER, Mr. DIAZ-BALART, 

Mr. COLLINS of Georgia, Mr. DESANTIS, Mr. GOWDY, Mr. AMASH, Mr. 

GINGREY of Georgia, Mr. AMODEI, Mr. HALL, Mr. HUNTER, Mr. PRICE

of Georgia, Mrs. WAGNER, Mr. JOYCE, Mr. BURGESS, Mr. CASSIDY, Mr. 

SCHWEIKERT, Mr. STEWART, Ms. JENKINS, Mr. SCALISE, Mr. LATHAM, 

Mr. HURT, Mr. DESJARLAIS, Mr. ADERHOLT, Mr. COOK, Mr. 

CRAWFORD, Mr. KING of Iowa, Mr. THOMPSON of Pennsylvania, Mr. 

GRIFFIN of Arkansas, Mr. DUNCAN of Tennessee, Mrs. ROBY, Mr. 

CHABOT, Mr. PITTENGER, Mr. SANFORD, Mr. GRAVES of Georgia, Mr. 

CRENSHAW, Mr. GRIFFITH of Virginia, Mr. NUNNELEE, Mr. DUFFY, Mr. 

SHUSTER, Mr. HASTINGS of Washington, Mr. ROSKAM, Mr. LATTA, Mr. 


tkelley on DSK3SPTVN1PROD with BILLS
2 

•HR 3635 RH

GOODLATTE, Mr. COBLE, Mr. SENSENBRENNER, Mr. LANCE, Mr. 

SOUTHERLAND, Mr. CULBERSON, Mr. COTTON, Mr. MARCHANT, Mr. 

BOUSTANY, Mr. WHITFIELD, Mr. ROE of Tennessee, Mr. WITTMAN, Mr. 

TIBERI, Mr. POE of Texas, Mr. SMITH of Texas, Mr. FRELINGHUYSEN, 

Mr. ROSS, Mrs. HARTZLER, Mr. RIBBLE, Mr. TIPTON, Mr. SCHOCK, Mr. 

CALVERT, Mr. FORTENBERRY, Mr. BARLETTA, Mr. GIBSON, Mr. GUTHRIE, Mr. COFFMAN, Mr. BYRNE, Mrs. MCMORRIS RODGERS, Mr. 

MCCLINTOCK, Mr. KLINE, Mr. WOLF, Mr. CAMP, Mr. CONNOLLY, and 

Mr. JOHNSON of Ohio 

JULY 28, 2014 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on December 3, 2013] 

A BILL 

To ensure the functionality and security of new Federal 

websites that collect personally identifiable information, 

and for other purposes. 


tkelley on DSK3SPTVN1PROD with BILLS
3 

•HR 3635 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safe and Secure Federal 

5 Websites Act of 2014’’. 

6 SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 

7 FEDERAL WEBSITES THAT COLLECT PERSON8 ALLY IDENTIFIABLE INFORMATION. 

9 (a) CERTIFICATION REQUIREMENT.— 

10 (1) IN GENERAL.—Except as otherwise provided 

11 under this subsection, an agency may not deploy or 

12 make available to the public a new Federal PII 

13 website until the date on which the chief information 

14 officer of the agency submits a certification to Con15 gress that the website is fully functional and secure. 

16 (2) TRANSITION.—In the case of a new Federal 

17 PII website that is operational on the date of the en18 actment of this Act, paragraph (1) shall not apply 

19 until the end of the 90-day period beginning on such 

20 date of enactment. If the certification required under 

21 paragraph (1) for such website has not been submitted 

22 to Congress before the end of such period, the head of 

23 the responsible agency shall render the website inac24 cessible to the public until such certification is sub25 mitted to Congress. 


tkelley on DSK3SPTVN1PROD with BILLS
4 

•HR 3635 RH

1 (3) EXCEPTION FOR BETA WEBSITE WITH EX2 PLICIT PERMISSION.—Paragraph (1) shall not apply 

3 to a website (or portion thereof) that is in a develop4 ment or testing phase, if the following conditions are 

5 met: 

6 (A) A member of the public may access PII7 related portions of the website only after exe8 cuting an agreement that acknowledges the risks 

9 involved. 

10 (B) No agency compelled, enjoined, or other11 wise provided incentives for such a member to 

12 access the website for such purposes. 

13 (4) CONSTRUCTION.—Nothing in this section 

14 shall be construed as applying to a website that is op15 erated entirely by an entity (such as a State or local16 ity) that is independent of the Federal Government, 

17 regardless of the receipt of funding in support of such 

18 website from the Federal Government. 

19 (b) DEFINITIONS.—In this section: 

20 (1) AGENCY.—The term ‘‘agency’’ has the mean21 ing given that term under section 551 of title 5, 

22 United States Code. 

23 (2) FULLY FUNCTIONAL.—The term ‘‘fully func24 tional’’ means, with respect to a new Federal PII 

25 website, that the website can fully support the activiVerDate Mar 15 2010 23:23 Jul 28, 2014 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H3635.RH H3635

tkelley on DSK3SPTVN1PROD with BILLS
5 

•HR 3635 RH

1 ties for which it is designed or intended with regard 

2 to the eliciting, collection, storage, or maintenance of 

3 personally identifiable information, including han4 dling a volume of queries relating to such information 

5 commensurate with the purpose for which the website 

6 is designed. 

7 (3) NEW FEDERAL PERSONALLY IDENTIFIABLE

8 INFORMATION WEBSITE (NEW FEDERAL PII

9 WEBSITE).—The terms ‘‘new Federal personally iden10 tifiable information website’’ and ‘‘new Federal PII 

11 website’’ mean a website that— 

12 (A) is operated by (or under a contract 

13 with) an agency; 

14 (B) elicits, collects, stores, or maintains per15 sonally identifiable information of individuals 

16 and is accessible to the public; and 

17 (C) is first made accessible to the public 

18 and collects or stores personally identifiable in19 formation of individuals, on or after October 1, 

20 2012. 

21 (4) OPERATIONAL.—The term ‘‘operational’’ 

22 means, with respect to a website, that such website 

23 elicits, collects, stores, or maintains personally identi24 fiable information of members of the public and is ac25 cessible to the public. 


tkelley on DSK3SPTVN1PROD with BILLS
6 

•HR 3635 RH

1 (5) PERSONALLY IDENTIFIABLE INFORMATION

2 (PII).—The terms ‘‘personally identifiable informa3 tion’’ and ‘‘PII’’ mean any information about an in4 dividual elicited, collected, stored, or maintained by 

5 an agency, including— 

6 (A) any information that can be used to 

7 distinguish or trace the identity of an indi8 vidual, such as a name, a social security num9 ber, a date and place of birth, a mother’s maiden 

10 name, or biometric records; and 

11 (B) any other information that is linked or 

12 linkable to an individual, such as medical, edu13 cational, financial, and employment informa14 tion. 

15 (6) RESPONSIBLE AGENCY.—The term ‘‘respon16 sible agency’’ means, with respect to a new Federal 

17 PII website, the agency that is responsible for the op18 eration (whether directly or through contracts with 

19 other entities) of the website. 

20 (7) SECURE.—The term ‘‘secure’’ means, with re21 spect to a new Federal PII website, that the following 

22 requirements are met: 

23 (A) The website is in compliance with sub24 chapter III of chapter 35 of title 44, United 

25 States Code. 


tkelley on DSK3SPTVN1PROD with BILLS
7 

•HR 3635 RH

1 (B) The website ensures that personally 

2 identifiable information elicited, collected, stored, 

3 or maintained in connection with the website is 

4 captured at the latest possible step in a user 

5 input sequence. 

6 (C) The responsible agency for the website 

7 has taken reasonable efforts to minimize domain 

8 name confusion, including through additional 

9 domain registrations. 

10 (D) The responsible agency requires all per11 sonnel who have access to personally identifiable 

12 information in connection with the website to 

13 have completed a Standard Form 85P and 

14 signed a non-disclosure agreement with respect to 

15 personally identifiable information, and the 

16 agency takes proper precautions to ensure only 

17 trustworthy persons may access such informa18 tion. 

19 (E) The responsible agency maintains (ei20 ther directly or through contract) sufficient per21 sonnel to respond in a timely manner to issues 

22 relating to the proper functioning and security 

23 of the website, and to monitor on an ongoing 

24 basis existing and emerging security threats to 

25 the website. 


tkelley on DSK3SPTVN1PROD with BILLS
8 

•HR 3635 RH

1 (8) STATE.—The term ‘‘State’’ means each State 

2 of the United States, the District of Columbia, each 

3 territory or possession of the United States, and each 

4 federally recognized Indian tribe. 

5 SEC. 3. PRIVACY BREACH REQUIREMENTS. 

6 (a) INFORMATION SECURITY AMENDMENT.—Sub7 chapter III of chapter 35 of title 44, United States Code, 

8 is amended by adding at the end the following: 

9 ‘‘§ 3550. Privacy breach requirements 

10 ‘‘(a) POLICIES AND PROCEDURES.—The Director of 

11 the Office of Management and Budget shall establish and 

12 oversee policies and procedures for agencies to follow in the 

13 event of a breach of information security involving the dis14 closure of personally identifiable information, including re15 quirements for— 

16 ‘‘(1) not later than 72 hours after the agency dis17 covers such a breach, or discovers evidence that rea18 sonably indicates such a breach has occurred, notice 

19 to the individuals whose personally identifiable infor20 mation could be compromised as a result of such 

21 breach; 

22 ‘‘(2) timely reporting to a Federal cybersecurity 

23 center, as designated by the Director of the Office of 

24 Management and Budget; and 


tkelley on DSK3SPTVN1PROD with BILLS
9 

•HR 3635 RH

1 ‘‘(3) any additional actions that the Director 

2 finds necessary and appropriate, including data 

3 breach analysis, fraud resolution services, identity 

4 theft insurance, and credit protection or monitoring 

5 services. 

6 ‘‘(b) REQUIRED AGENCY ACTION.—The head of each 

7 agency shall ensure that actions taken in response to a 

8 breach of information security involving the disclosure of 

9 personally identifiable information under the authority or 

10 control of the agency comply with policies and procedures 

11 established by the Director of the Office of Management and 

12 Budget under subsection (a). 

13 ‘‘(c) REPORT.—Not later than March 1 of each year, 

14 the Director of the Office of Management and Budget shall 

15 report to Congress on agency compliance with the policies 

16 and procedures established under subsection (a). 

17 ‘‘(d) FEDERAL CYBERSECURITY CENTER DEFINED.— 

18 The term ‘Federal cybersecurity center’ means any of the 

19 following: 

20 ‘‘(1) The Department of Defense Cyber Crime 

21 Center. 

22 ‘‘(2) The Intelligence Community Incident Re23 sponse Center. 

24 ‘‘(3) The United States Cyber Command Joint 

25 Operations Center. 


tkelley on DSK3SPTVN1PROD with BILLS
10 

•HR 3635 RH

1 ‘‘(4) The National Cyber Investigative Joint 

2 Task Force. 

3 ‘‘(5) Central Security Service Threat Operations 

4 Center of the National Security Agency. 

5 ‘‘(6) The United States Computer Emergency 

6 Readiness Team. 

7 ‘‘(7) Any successor to a center, team, or task 

8 force described in paragraphs (1) through (6). 

9 ‘‘(8) Any center that the Director of the Office of 

10 Management and Budget determines is appropriate to 

11 carry out the requirements of this section.’’. 

12 (b) TECHNICAL AND CONFORMING AMENDMENT.—The 

13 table of sections for subchapter III of chapter 35 of title 

14 44, United States Code, is amended by adding at the end 

15 the following: 

‘‘3550. Privacy breach requirements.’’. 


tkelley on DSK3SPTVN1PROD with BILLS

tkelley on DSK3SPTVN1PROD with BILLS
Union Calendar No. 421 

113TH CONGRESS 

2D SESSION H. R. 3635 

[Report No. 113–562] 

A BILL 

To ensure the functionality and security of new 

able information, and for other purposes. Federal websites that collect personally identifiJULY 28, 2014 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


tkelley on DSK3SPTVN1PROD with BILLS