II 

117TH CONGRESS 

2D SESSION S. 3618 

To amend the Federal Cybersecurity Enhancement Act of 2015 to require 

Federal agencies to obtain exemptions from certain cybersecurity requirements in order to avoid compliance with those requirements, and for 

other purposes. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 9, 2022 

Mr. WYDEN introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend the Federal Cybersecurity Enhancement Act of 

2015 to require Federal agencies to obtain exemptions 

from certain cybersecurity requirements in order to avoid 

compliance with those requirements, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Cybersecurity 

5 Oversight Act of 2022’’. 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 3618 IS

1 SEC. 2. FEDERAL CYBERSECURITY REQUIREMENTS. 

2 (a) EXEMPTION FROM FEDERAL REQUIREMENTS.— 

3 Section 225(b)(2) of the Federal Cybersecurity Enhance4 ment Act of 2015 (6 U.S.C. 1523(b)(2)) is amended to 

5 read as follows: 

6 ‘‘(2) EXCEPTION.— 

7 ‘‘(A) IN GENERAL.—A particular require8 ment under paragraph (1) shall not apply to an 

9 agency information system of an agency if— 

10 ‘‘(i) with respect to the agency infor11 mation system, the head of the agency sub12 mits to the Director an application for an 

13 exemption from the particular requirement, 

14 in which the head of the agency personally 

15 certifies to the Director with particularity 

16 that— 

17 ‘‘(I) operational requirements ar18 ticulated in the certification and re19 lated to the agency information sys20 tem would make it excessively burden21 some to implement the particular re22 quirement; 

23 ‘‘(II) the particular requirement 

24 is not necessary to secure the agency 

25 information system or agency inforVerDate Sep 11 2014 05:00 Feb 11, 2022 Jkt 029200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3618.IS S3618

kjohnson on DSK79L0C42PROD with BILLS
3 

•S 3618 IS

1 mation stored on or transiting the 

2 agency information system; and 

3 ‘‘(III) the agency has taken all 

4 necessary steps to secure the agency 

5 information system and agency infor6 mation stored on or transiting the 

7 agency information system; 

8 ‘‘(ii) the head of the agency or the 

9 designee of the head of the agency has 

10 submitted the certification described in 

11 clause (i) to the appropriate congressional 

12 committees and any other congressional 

13 committee with jurisdiction over the agen14 cy; and 

15 ‘‘(iii) the Director grants the exemp16 tion from the particular requirement. 

17 ‘‘(B) DURATION OF EXEMPTION.— 

18 ‘‘(i) IN GENERAL.—An exemption 

19 granted under subparagraph (A) shall ex20 pire on the date that is 1 year after the 

21 date on which the Director granted the ex22 emption. 

23 ‘‘(ii) RENEWAL.—Upon the expiration 

24 of an exemption granted to an agency 

25 under subparagraph (A), the head of the 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 3618 IS

1 agency may apply for an additional exemp2 tion.’’. 

3 (b) REPORT ON EXEMPTIONS.—Section 

4 3554(c)(1)(A) of title 44, United States Code, is amend5 ed— 

6 (1) in clause (iii), by striking ‘‘and’’ at the end; 

7 (2) by redesignating clause (iv) as clause (v); 

8 and 

9 (3) by inserting after clause (iii) the following: 

10 ‘‘(iv) with respect to any exemption 

11 the Director of the Office of Management 

12 and Budget has granted the agency under 

13 section 225(b)(2) of the Federal Cyberse14 curity Enhancement Act of 2015 (6 U.S.C. 

15 1523(b)(2)) that is effective on the date of 

16 submission of the report— 

17 ‘‘(I) an identification of each par18 ticular requirement from which any 

19 agency information system (as defined 

20 in section 2210 of the Homeland Se21 curity Act of 2002 (6 U.S.C. 660)) is 

22 exempted; and 

23 ‘‘(II) for each requirement identi24 fied under subclause (I)— 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 3618 IS

1 ‘‘(aa) an identification of the 

2 agency information system de3 scribed in subclause (I) exempted 

4 from the requirement; and 

5 ‘‘(bb) an estimate of the 

6 date on which the agency will to 

7 be able to comply with the re8 quirement; and’’. 

9 (c) EFFECTIVE DATE.—This Act and the amend10 ments made by this Act shall take effect on the date that 

11 is 1 year after the date of enactment of this Act. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS