Building Cyber Resilience After SolarWinds Act of 2022

To require the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to submit a report on the impact of the SolarWinds cyber incident on information systems owned and operated by Federal departments and agencies and other critical infrastructure, and for other purposes. 1. Short title This Act may be cited as the Building Cyber Resilience After SolarWinds Act of 2022 2. Building cyber resilience after SolarWinds (a) Definitions In this section: (1) Critical infrastructure The term critical infrastructure Public Law 107–56 42 U.S.C. 5195c(e) (2) Director The term Director (3) Information system The term information system 6 U.S.C. 681 (4) Significant cyber incident The term significant cyber incident (5) Solarwinds incident The term SolarWinds incident (b) SolarWinds investigation and report (1) Investigation The Director, in consultation with the National Cyber Director and the heads of other relevant Federal departments and agencies, shall carry out an investigation to evaluate the impact of the SolarWinds incident on information systems owned and operated by Federal departments and agencies, and, to the extent practicable, other critical infrastructure. (2) Elements In carrying out subsection (b), the Director shall review the following: (A) The extent to which Federal information systems were accessed, compromised, or otherwise impacted by the SolarWinds incident, and any potential ongoing security concerns or consequences arising from such incident. (B) The extent to which information systems that support other critical infrastructure were accessed, compromised, or otherwise impacted by the SolarWinds incident, where such information is available to the Director. (C) Any ongoing security concerns or consequences arising from the SolarWinds incident, including any sensitive information that may have been accessed or exploited in a manner that poses a threat to national security. (D) Implementation of Executive Order 14028 (Improving the Nation’s Cybersecurity (May 12, 2021)). (E) Efforts taken by the Director, the heads of Federal departments and agencies, and critical infrastructure owners and operators to address cybersecurity vulnerabilities and mitigate risks associated with the SolarWinds incident. (c) Report Not later than 120 days after the date of the enactment of this Act, the Director shall submit to the Committee on Homeland Security in the House of Representatives and Committee on Homeland Security and Government Affairs in the Senate a report that includes the following: (1) Findings for each of the elements specified in subsection (b). (2) Recommendations to address security gaps, improve incident response efforts, and prevent similar cyber incidents. (3) Any areas where the Director lacked the information necessary to fully review and assessment such elements, the reason the information necessary was unavailable, and recommendations to close such informational gaps. (d) GAO report on cyber safety review board Not later than one year after the date of the enactment of this Act, the Comptroller General of the United States shall evaluate the activities of the Cyber Safety Review Board established pursuant to Executive Order 14028 (Improving the Nation’s Cybersecurity (May 12, 2021)), with a focus on the Board’s inaugural review announced in February 2022, and assess whether the Board has the authorities, resources, and expertise necessary to carry out its mission of reviewing and assessing significant cyber incidents.

Summary: Building Cyber Resilience After SolarWinds Act of 2022 This bill requires evaluations of the impact of the SolarWinds cyber incident and the activities of the Cyber Safety Review Board. Specifically, the bill directs the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to evaluate and report to Congress on the impact of the SolarWinds cyber incident on information systems owned and operated by federal departments and agencies and other critical infrastructure. Additionally, the Government Accountability Office must evaluate the activities of the Cyber Safety Review Board and assess whether the board has the authorities, resources, and expertise necessary to carry out its mission of reviewing and assessing significant cyber incidents.