NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017

To amend the National Institute of Standards and Technology Act to implement a framework, assessment, and audits for improving United States cybersecurity. 1. Short title This Act may be cited as the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 2. NIST mission to address cybersecurity threats Section 20(a)(1) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(a)(1) , emphasizing the principle that expanding cybersecurity threats require engineering security from the beginning of an information system’s life cycle, building more trustworthy and secure components and systems from the start, and applying well-defined security design principles throughout 3. Implementation of Cybersecurity Framework The National Institute of Standards and Technology Act ( 15 U.S.C. 271 20A. Framework for Improving Critical Infrastructure Cybersecurity (a) Implementation by Federal agencies The Institute shall promote the implementation by Federal agencies of the Framework for Improving Critical Infrastructure Cybersecurity (in this section and section 20B referred to as the Framework NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 chapter 35 (b) Guidance The guidance required under subsection (a) shall— (1) describe how the Framework aligns with or augments existing agency practices related to compliance with chapter 35 (2) identify any areas of conflict or overlap between the Framework and existing cybersecurity requirements, including gap areas where additional policies, standards, guidelines, or programs may be needed to encourage Federal agencies to use the Framework and improve the ability of Federal agencies to manage cybersecurity risk; (3) include a template for Federal agencies on how to use the Framework, and recommend procedures for streamlining and harmonizing existing and future cybersecurity-related requirements, in support of the goal of using the Framework to supplant Federal agency practices in compliance with chapter 35 (4) recommend other procedures for compliance with cybersecurity reporting, oversight, and policy review and creation requirements under such chapter 35 and any other applicable Federal law; and (5) be updated, as the Institute considers necessary, to reflect what the Institute learns from ongoing research, the audits conducted pursuant to section 20B(c), the information compiled by the Federal working group established pursuant to subsection (c), and the annual reports published pursuant to subsection (d). (c) Federal working group Not later than 3 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 Federal working group (1) not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (2) update such metrics as the Federal working group considers necessary; (3) compile information from Federal agencies on their use of the Framework and the results of the analysis and assessment described in paragraph (1); and (4) assist the Office of Management and Budget and the Office of Science and Technology Policy in publishing the annual report required under subsection (d). (d) Report The Office of Management and Budget and the Office of Science and Technology Policy shall develop and make publicly available an annual report on agency adoption rates and the effectiveness of the Framework. In preparing such report, the Offices shall use the information compiled by the Federal working group pursuant to subsection (c)(3). 20B. Cybersecurity audits (a) Initial assessment (1) Requirement Not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (2) Agencies The agencies referred to in paragraph (1) are the agencies referred to in section 901(b) of title 31, United States Code, and any other agency that has reported a major incident (as defined in the Office of Management and Budget Memorandum—16—03, published on October 30, 2015, or any successor document). (3) National security systems The requirement under paragraph (1) shall not apply to national security systems (as defined in section 3552(b) of title 44, United States Code). (b) Audit plan Not later than 6 months after the date of enactment of this Act, the Institute shall prepare a needs-based plan for carrying out the audits of agencies as required under subsection (c). Such plan shall include a description of staffing plans, workforce capabilities, methods for conducting such audits, coordination with agencies to support such audits, expected timeframes for the completion of audits, and other information the Institute considers relevant. The plan shall be transmitted by the Institute to the congressional entities described in subsection (c)(4)(F). (c) Audits (1) Requirement Not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (2) Relation to Framework Audits conducted under this subsection shall— (A) to the extent applicable and available, be informed by the report on agency adoption rates and the effectiveness of the Framework described in section 20A(d); and (B) if the agency is required by law or executive order to adopt the Framework, be based on the guidance described in section 20A(b) and metrics developed under section 20A(c)(1). (3) Schedule The Institute shall establish a schedule for completion of audits under this subsection to ensure that— (A) audits of agencies whose information security risk is high, based on the assessment conducted under subsection (a), are completed not later than 1 year after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (B) audits of all other agencies described in subsection (a)(2) are completed not later than 2 years after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (4) Report A report of each audit conducted under this subsection shall be transmitted by the Institute to— (A) the Office of Management and Budget; (B) the Office of Science and Technology Policy; (C) the Government Accountability Office; (D) the agency being audited; (E) the Inspector General of such agency, if there is one; and (F) Congress, including the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate. . October 31, 2017 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed

Summary: NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 (Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST), in developing standards for information systems, to emphasize the principle that expanding cybersecurity threats require: (1) engineering security from the beginning of a system's life cycle, (2) building more trustworthy and secure components and systems from the start, and (3) applying well-defined security design principles throughout systems. (Sec. 3) NIST must provide guidance for agencies to incorporate into their information security risk management efforts the Framework for Improving Critical Infrastructure Cybersecurity (Framework). Such guidance shall: describe how the Framework aligns or augments existing agency practices; identify any areas of conflict or overlap between the Framework and existing cybersecurity requirements; include a template for federal agencies on how to use the Framework and recommend procedures for streamlining and harmonizing existing and future cybersecurity-related requirements; recommend other procedures for compliance with cybersecurity reporting, oversight, and policy review; and be updated to reflect what NIST learns from ongoing research, cybersecurity audits, information compiled by the federal working group, and annual reports. NIST must chair a federal working group to coordinate the development of metrics and tools to measure the effectiveness of the Framework for federal agencies protecting their information and information systems. The federal working group must assist the Office of Management and Budget (OMB) and Office of Science and Technology Policy (OSTP) in publishing annual reports on agency adoption rates and the effectiveness of the Framework. NIST must initiate an individual cybersecurity audit of certain agencies to assess the extent to which each agency meets information security standards. NIST shall prepare a needs-based plan for the audits that includes: (1) a description of staffing plans, (2) workforce capabilities, (3) methods of conducting such audits, (4) coordination with agencies to support such audits, (5) expected timeframe for the completion of the audits, and (6) other relevant information. NIST must report on the audit of each agency to: (1) OMB, (2) the OSTP, (3) the Government Accountability Office, (4) the agency being audited and its inspector general, and (5) Congress.