Federal Information Security Modernization Act of 2021

To modernize Federal information security management, and for other purposes. 1. Short title This Act may be cited as the Federal Information Security Modernization Act of 2021 2. Table of contents The table of contents for this Act is as follows: Sec. 1. Short title. Sec. 2. Table of contents. Sec. 3. Definitions. TITLE I—Updates to FISMA Sec. 101. Title 44 amendments. Sec. 102. Amendments to subtitle III of title 40. Sec. 103. Actions to enhance Federal incident response. Sec. 104. Additional guidance to agencies on FISMA updates. Sec. 105. Agency requirements to notify entities impacted by incidents. TITLE II—Improving Federal cybersecurity Sec. 201. Evaluation of effectiveness of standards. Sec. 202. Mobile security standards. Sec. 203. Quantitative cybersecurity metrics. Sec. 204. Data and logging retention for incident response. Sec. 205. CISA agency advisors. Sec. 206. Federal penetration testing policy. Sec. 207. Ongoing threat hunting program. Sec. 208. Codifying vulnerability disclosure programs. Sec. 209. Implementing presumption of compromise and zero trust architectures. Sec. 210. Automation reports. Sec. 211. Extension of Federal Acquisition Security Council. TITLE III—Pilot programs to enhance Federal cybersecurity Sec. 301. Continuous independent FISMA evaluation pilot. Sec. 302. Active cyber defensive pilot. Sec. 303. Security operations center as a service pilot. 3. Definitions In this Act, unless otherwise specified: (1) Additional cybersecurity procedure The term additional cybersecurity procedure (2) Agency The term agency (3) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Homeland Security and Governmental Affairs of the Senate (B) the Committee on Oversight and Reform of the House of Representatives (C) the Committee on Homeland Security of the House of Representatives. (4) Director The term Director (5) Incident The term incident (6) Penetration test The term penetration test (7) Threat hunting The term threat hunting (8) Verification specification The term verification specification I Updates to FISMA 101. Title 44 amendments (a) Subchapter I amendments Subchapter I of chapter 35 (1) in section 3504— (A) in subsection (a)(1)(B)(v), by striking confidentiality, security, disclosure, and sharing of information disclosure, sharing of information, and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, confidentiality and security (B) in subsection (b)(2)(B), by inserting in coordination with the Director of the Cybersecurity and Infrastructure Security Agency standards for security (C) in subsection (g), by striking paragraph (1) and inserting the following: (1) with respect to information collected or maintained by or for agencies— (A) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, disclosure, and sharing of the information; and (B) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, develop and oversee policies, principles, standards, and guidelines on confidentiality and security of the information; and ; and (D) in subsection (h)(1)— (i) in the matter preceding subparagraph (A)— (I) by inserting the Director of the Cybersecurity and Infrastructure Security Agency, the Director (II) by inserting a comma before and the Administrator (ii) in subparagraph (A), by inserting security and information technology (2) in section 3505— (A) in paragraph (3) of the first subsection designated as subsection (c)— (i) in subparagraph (B)— (I) by inserting and the Director of the Cybersecurity and Infrastructure Security Agency Comptroller General (II) by striking and (ii) in subparagraph (C)(v), by striking the period at the end and inserting ; and (iii) by adding at the end the following: (D) maintained on a continual basis through the use of automation, machine-readable data, and scanning. ; and (B) by striking the second subsection designated as subsection (c); (3) in section 3506— (A) in subsection (b)— (i) in paragraph (1)(C), by inserting , availability integrity (ii) in paragraph (4), by inserting the Director of the Cybersecurity and Infrastructure Security Agency, General Services, (B) in subsection (h)(3), by inserting security, efficiency, (4) in section 3513— (A) in subsection (a), by inserting the Director of the Cybersecurity and Infrastructure Security Agency, the Administrator of General Services (B) by redesignating subsection (c) as subsection (d); and (C) by inserting after subsection (b) the following: (c) Each agency providing a written plan under subsection (b) shall provide any portion of the written plan addressing information security or cybersecurity to the Director of the Cybersecurity and Infrastructure Security Agency. ; and (5) in section 3520A(b)— (A) in paragraph (1), by striking , protection (B) by redesignating paragraphs (2), (3), (4), and (5) as paragraphs (3), (4), (5), and (6), respectively; and (C) by inserting after paragraph (1) the following: (2) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, establish Governmentwide best practices for the protection of data; . (b) Suchapter II definitions (1) In general Section 3552(b) of title 44, United States Code, is amended— (A) by redesignating paragraphs (1), (2), (3), (4), (5), (6), and (7) as paragraphs (2), (3), (4), (5), (6), (9), and (11), respectively; (B) by inserting before paragraph (2), as so redesignated, the following: (1) The term additional cybersecurity procedure ; (C) by inserting after paragraph (6), as so redesignated, the following: (7) The term high value asset (8) The term major incident ; (D) by inserting after paragraph (9), as so redesignated, the following: (10) The term penetration test (A) is conducted on an information system or a component of an information system; and (B) emulates an attack or other exploitation capability of a potential adversary, typically under specific constraints, in order to identify any vulnerabilities of an information system or a component of an information system that could be exploited. ; and (E) by inserting after paragraph (11), as so redesignated, the following: (12) The term shared service (13) The term verification specification . (2) Conforming amendments (A) Homeland Security Act of 2002 Section 1001(c)(1)(A) of the Homeland Security Act of 2002 ( 6 U.S.C. 511(1)(A) section 3552(b)(5) section 3552(b) (B) Title 10 (i) Section 2222 Section 2222(i)(8) of title 10, United States Code, is amended by striking section 3552(b)(6)(A) section 3552(b)(9)(A) (ii) Section 2223 Section 2223(c)(3) of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (iii) Section 2315 Section 2315 of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (iv) Section 2339a Section 2339a(e)(5) of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (C) High-Performance Computing Act of 1991 Section 207(a) of the High-Performance Computing Act of 1991 ( 15 U.S.C. 5527(a) section 3552(b)(6)(A)(i) section 3552(b)(9)(A)(i) (D) Internet of Things Cybersecurity Improvement Act of 2020 Section 3(5) of the Internet of Things Cybersecurity Improvement Act of 2020 ( 15 U.S.C. 278g–3a section 3552(b)(6) section 3552(b) (E) National Defense Authorization Act for Fiscal Year 2013 Section 933(e)(1)(B) of the National Defense Authorization Act for Fiscal Year 2013 ( 10 U.S.C. 2224 section 3542(b)(2) section 3552(b) (F) Ike Skelton National Defense Authorization Act for Fiscal Year 2011 The Ike Skelton National Defense Authorization Act for Fiscal Year 2011 ( Public Law 111–383 (i) in section 806(e)(5) ( 10 U.S.C. 2304 section 3542(b) section 3552(b) (ii) in section 931(b)(3) ( 10 U.S.C. 2223 section 3542(b)(2) section 3552(b) (iii) in section 932(b)(2) ( 10 U.S.C. 2224 section 3542(b)(2) section 3552(b) (G) E-Government Act of 2002 Section 301(c)(1)(A) of the E-Government Act of 2002 ( 44 U.S.C. 3501 section 3542(b)(2) section 3552(b) (H) National Institute of Standards and Technology Act Section 20 of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3 (i) in subsection (a)(2), by striking section 3552(b)(5) section 3552(b) (ii) in subsection (f)— (I) in paragraph (3), by striking section 3532(1) section 3552(b) (II) in paragraph (5), by striking section 3532(b)(2) section 3552(b) (c) Subchapter II amendments Subchapter II of chapter 35 (1) in section 3551— (A) by redesignating paragraphs (3), (4), (5), and (6) as paragraphs (4), (5), (6), and (7), respectively; (B) by inserting after paragraph (2) the following: (3) recognize the role of the Cybersecurity and Infrastructure Security Agency as the lead cybersecurity entity for operational coordination across the Federal Government; ; (C) in paragraph (5), as so redesignated, by striking diagnose and improve integrate, deliver, diagnose, and improve (D) in paragraph (6), as so redesignated, by striking and (E) by adding at the end the following: (8) recognize that each agency has specific mission requirements and, at times, unique cybersecurity requirements to meet the mission of the agency; (9) recognize that each agency does not have the same resources to secure agency systems, and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone; and (10) recognize that— (A) a holistic Federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies; and (B) in accounting for the differences described in subparagraph (A) and ensuring overall Federal cybersecurity— (i) the Office of Management and Budget is the leader for policy development and oversight of Federal cybersecurity; (ii) the Cybersecurity and Infrastructure Security Agency is the leader for implementing operations at agencies; and (iii) the National Cyber Director is responsible for developing the overall cybersecurity strategy of the United States and advising the President on matters relating to cybersecurity. ; (2) in section 3553, as amended by section 1705 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 ( Public Law 116–283 (A) in subsection (a)— (i) in paragraph (1)— (I) by striking developing and in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, (II) by inserting and associated verification specifications promulgated (ii) in paragraph (5), by inserting , in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, agency compliance (B) in subsection (b)— (i) by striking the subsection heading and inserting Cybersecurity and Infrastructure Security Agency (ii) in the matter preceding paragraph (1), by striking the Secretary the Director of the Cybersecurity and Infrastructure Security Agency (iii) in paragraph (2)— (I) in subparagraph (A), by inserting and reporting requirements under subchapter IV of this title section 3556 (II) in subparagraph (D), by striking the Director or Secretary the Director of the Cybersecurity and Infrastructure Security Agency (iv) in paragraph (5), by striking coordinating leading the coordination of (v) in paragraph (6)— (I) in the matter preceding subparagraph (A), by inserting and verifications specifications promulgated under (II) in subparagraph (C), by striking and (III) in subparagraph (D), by adding and (IV) by adding at the end the following: (E) taking any other action that the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director— (i) may determine necessary; and (ii) is authorized to perform; ; (vi) in paragraph (8), by striking the Secretary's discretion the Director of the Cybersecurity and Infrastructure Security Agency's discretion (vii) in paragraph (9), by striking as the Director or the Secretary, in consultation with the Director, as the Director of the Cybersecurity and Infrastructure Security Agency (C) in subsection (c)— (i) in paragraph (4), by striking and (ii) by redesignating paragraph (5) as paragraph (7); and (iii) by inserting after paragraph (4) the following: (5) an assessment of agency use of automated verification of standards for the standards promulgated under section 11331 of title 40 using verification specifications; (6) a summary of each assessment of Federal risk posture performed under subsection (i); and ; (D) in subsection (f)(2)(B), by striking conflict with reduce the security posture of agencies established under (E) by redesignating subsections (i), (j), (k), and (l) as subsections (j), (k), (l), and (m) respectively; (F) by inserting after subsection (h) the following: (i) Federal risk assessments The Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall perform, on an ongoing and continuous basis, assessments of Federal risk posture using any available information on the cybersecurity posture of agencies, including— (1) the status of agency cybersecurity remedial actions described in section 3554(b)(7); (2) any vulnerability information relating to the systems of an agency that is known by the agency; (3) analysis of incident information under section 3597; (4) evaluation of penetration testing performed under section 3559A; (5) evaluation of vulnerability disclosure program information under section 3559B; (6) evaluation of agency threat hunting results; (7) evaluation of Federal and non-Federal threat intelligence; (8) data on compliance with standards issued under section 11331 of title 40 that, when appropriate, uses verification specifications; (9) agency system risk assessments performed under section 3554(a)(1)(A); and (10) any other information the Secretary determines relevant. ; and (G) in subsection (j), as so redesignated— (i) by striking regarding the specific (1) the specific ; (ii) in paragraph (1), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (2) the trends identified in the Federal risk assessment performed under subsection (i). ; (3) in section 3554— (A) in subsection (a)— (i) in paragraph (1)— (I) by redesignating subparagraphs (A), (B), and (C) as subparagraphs (B), (C), and (D), respectively; (II) by inserting before subparagraph (B), as so redesignated, the following: (A) performing, not less frequently than once every 2 years or based on a significant change to system architecture or security posture, an agency system risk assessment that— (i) identifies and documents the high value assets of the agency using guidance from the Director; (ii) evaluates the data assets inventoried under section 3511 of title 44 for sensitivity to compromises in confidentiality, integrity, and availability; (iii) identifies agency systems that have access to or hold the data assets inventoried under section 3511 of title 44; (iv) evaluates the threats facing agency systems and data, including high value assets, based on Federal and non-Federal cyber threat intelligence products, where available; (v) evaluates the vulnerability of agency systems and data, including high value assets, based on— (I) the results of penetration testing performed by the Department of Homeland Security under section 3553(b)(9); (II) the results of penetration testing performed under section 3559A; (III) information provided to the agency through the vulnerability disclosure program of the agency under section 3559B; (IV) incidents; and (V) any other vulnerability information relating to agency systems that is known to the agency; (vi) assesses the impacts of potential agency incidents to agency systems, data, and operations based on the evaluations described in clauses (ii) and (iv) and the agency systems identified under clause (iii); and (vii) assesses the consequences of potential incidents occurring on agency systems that would impact systems at other agencies, including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system; ; (III) in subparagraph (B), as so redesignated— (aa) in the matter preceding clause (i), by striking providing information using information from the assessment conducted under subparagraph (A), providing, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, information (bb) in clause (i), by striking and (cc) in clause (ii), by adding and (dd) by adding at the end the following: (iii) in consultation with the Director and the Director of the Cybersecurity and Infrastructure Security Agency, information or information systems used by agencies through shared services, memoranda of understanding, or other agreements; ; (IV) in subparagraph (C), as so redesignated— (aa) in clause (ii) by inserting binding operational (bb) in clause (vi), by striking and (V) by adding at the end the following: (E) not later than 30 days after the date on which an agency system risk assessment is performed under subparagraph (A), providing the assessment to— (i) the Director; (ii) the Director of the Cybersecurity and Infrastructure Security Agency; and (iii) the National Cyber Director; (F) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and not less frequently than annually, performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of, or under the supervision of, the agency, which shall— (i) be completed considering the agency system risk assessment performed under subparagraph (A); and (ii) include a specific evaluation for high value assets; and (G) not later than 30 days after completing the evaluation performed under subparagraph (F), providing the evaluation and an implementation plan for using additional cybersecurity procedures determined to be appropriate to— (i) the Director of the Cybersecurity and Infrastructure Security Agency; (ii) the Director; and (iii) the National Cyber Director. ; (ii) in paragraph (2)— (I) in subparagraph (A), by inserting in accordance with the agency system risk assessment performed under paragraph (1)(A) information systems (II) in subparagraph (B)— (aa) by striking in accordance with standards (i) standards ; and (bb) by adding at the end the following: (ii) the evaluation performed under paragraph (1)(F); and (iii) the implementation plan described in paragraph (1)(G); ; and (III) in subparagraph (D), by inserting , through the use of penetration testing, the vulnerability disclosure program established under section 3559B, and other means, periodically (iii) in paragraph (3)— (I) in subparagraph (B), by inserting , in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, maintaining (II) in subparagraph (D), by striking and (III) in subparagraph (E), by adding and (IV) by adding at the end the following: (F) implementing mechanisms for using verification specifications, or alternate verification specifications validated by the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director of the National Institute of Standards and Technology, to automatically verify the implementation of standards of agency systems promulgated under section 11331 of title 40 or any additional cybersecurity procedures, as applicable; ; and (iv) in paragraph (5), by inserting and the Director of the Cybersecurity and Infrastructure Security Agency on the effectiveness (B) in subsection (b)— (i) by striking paragraph (1) and inserting the following: (1) pursuant to subsection (a)(1)(A), performing an agency system risk assessment, which shall include using automated tools consistent with standards, verification specifications, and guidelines promulgated under section 11331 of title 40, as applicable; ; (ii) in paragraph (2)(D)— (I) by redesignating clauses (iii) and (iv) as clauses (iv) and (v), respectively; (II) by inserting after clause (ii) the following: (iii) binding operational directives and emergency directives promulgated by the Director of the Cybersecurity and Infrastructure Security Agency under section 3553 of title 44; ; and (III) in clause (iv), as so redesignated, by striking as determined by the agency; and (I) in coordination with the Director of the Cybersecurity and Infrastructure Security Agency; and (II) in consideration of— (aa) the agency risk assessment performed under subsection (a)(1)(A); and (bb) the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section 11331(c)(1) of title 40; and ; (iii) in paragraph (5)— (I) in subparagraph (A), by inserting , including penetration testing, as appropriate, shall include testing (II) in subparagraph (C), by inserting , verification specifications, with standards (iv) in paragraph (6), by striking planning, implementing, evaluating, and documenting planning and implementing and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, evaluating and documenting (v) by redesignating paragraphs (7) and (8) as paragraphs (9) and (10), respectively; (vi) by inserting after paragraph (6) the following: (7) a process for providing the status of every remedial action and known system vulnerability to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable; (8) a process for providing the verification of the implementation of standards promulgated under section 11331 of title 40 using verification specifications, automation, and machine-readable data, to the Director and the Director of the Cybersecurity and Infrastructure Security Agency; ; and (vii) in paragraph (9)(C), as so redesignated— (I) by striking clause (ii) and inserting the following: (ii) notifying and consulting with the Federal information security incident center established under section 3556 pursuant to the requirements of section 3594; ; (II) by redesignating clause (iii) as clause (iv); (III) by inserting after clause (ii) the following: (iii) performing the notifications and other activities required under subchapter IV of this title; and ; and (IV) in clause (iv), as so redesignated— (aa) in subclause (I), by striking and relevant Offices of Inspector General (bb) in subclause (II), by adding and (cc) by striking subclause (III); and (dd) by redesignating subclause (IV) as subclause (III); (C) in subsection (c)— (i) in paragraph (1)— (I) in subparagraph (A)— (aa) in the matter preceding clause (i), by striking on the adequacy and effectiveness of information security policies, procedures, and practices, including that includes (bb) in clause (ii), by inserting unless the Director issues a waiver to the agency under subparagraph (B)(iii), the total number (II) by striking subparagraph (B) and inserting the following: (B) Incident reporting waiver (i) Certification of agency information sharing If the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, determines that an agency shares any information relating to any incident pursuant to section 3594(a), the Director shall certify that the agency is in compliance with that section. (ii) Certification of issuing report If the Director determines that the Director of the Cybersecurity and Infrastructure Security Agency uses the information described in clause (i) with respect to a particular agency to submit to Congress an annex required under section 3597(c)(3) for that agency, the Director shall certify that the Cybersecurity and Infrastructure Security Agency is in compliance with that section with respect to that agency. (iii) Waiver The Director may waive the reporting requirement with respect to the information required to be included in the report under subparagraph (A)(ii) for a particular agency if— (I) the Director has issued a certification for the agency under clause (i); and (II) the Director has issued a certification with respect to the annex of the agency under clause (ii). (iv) Revocation of waiver or certifications (I) Waiver If, at any time, the Director determines that the Director of the Cybersecurity and Infrastructure Security Agency cannot submit to Congress an annex for a particular agency under section 3597(c)(3)— (aa) any waiver previously issued under clause (iii) with respect to that agency shall be considered void; and (bb) the Director shall revoke the certification for the annex of that agency under clause (ii). (II) Certifications If, at any time, the Director determines that an agency has not provided to the Director of the Cybersecurity and Infrastructure Security Agency the totality of incident information required under section 3594(a)— (aa) any waiver previously issued under clause (iii) with respect to that agency shall be considered void; and (bb) the Director shall revoke the certification for that agency under clause (i). (III) Reissuance If the Director revokes a waiver under this clause, the Director may issue a subsequent waiver if the Director issues new certifications under clauses (i) and (ii). ; (ii) by redesignating paragraphs (2) through (5) as paragraphs (4) through (7), respectively; and (iii) by inserting after paragraph (1) the following: (2) Biannual report Not later than 180 days after the date on which an agency completes an agency system risk assessment under subsection (a)(1)(A) and not less frequently than every 2 years, each agency shall submit to the Director, the Secretary, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Reform of the House of Representatives, the Committee on Homeland Security of the House of Representatives, the appropriate authorization and appropriations committees of Congress, the National Cyber Director, and the Comptroller General of the United States a report that— (A) summarizes the agency system risk assessment performed under subsection (a)(1)(A); (B) evaluates the adequacy and effectiveness of information security policies, procedures, and practices of the agency to address the risks identified in the system risk assessment performed under subsection (a)(1)(A); and (C) summarizes the evaluations and implementation plans described in subparagraphs (F) and (G) of subsection (a)(1) and whether those evaluations and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency. (3) Unclassified reports Each report submitted under paragraphs (1) and (2)— (A) shall be, to the greatest extent practicable, in an unclassified and otherwise uncontrolled form; and (B) may include a classified annex. ; and (D) in subsection (d)(1), in the matter preceding subparagraph (A), by inserting and the Director of the Cybersecurity and Infrastructure Security Agency the Director (4) in section 3555— (A) in subsection (a)(2)(A), by inserting , including by penetration testing and analyzing the vulnerability disclosure program of the agency information systems (B) by striking subsection (f) and inserting the following: (f) Protection of information (1) Agencies and evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. (2) The protections required under paragraph (1) shall be commensurate with the risk and comply with all applicable laws and regulations. (3) With respect to information that is not related to national security systems, agencies and evaluators shall make a summary of the information unclassified and publicly available, including information that does not identify— (A) specific information system incidents; or (B) specific information system vulnerabilities. ; (C) in subsection (g)(2)— (i) by striking this subsection shall (A) shall ; (ii) in subparagraph (A), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (B) identify any entity that performs an independent audit under subsection (b). ; and (D) in subsection (j), by striking the Secretary the Director of the Cyber Security and Infrastructure Security Agency (5) in section 3556(a)— (A) in the matter preceding paragraph (1), by inserting within the Cybersecurity and Infrastructure Security Agency incident center (B) in paragraph (4), by striking 3554(b) 3554(a)(1)(A) (d) Federal system incident response (1) In general Chapter 35 IV Federal System Incident Response 3591. Definitions (a) In general Except as provided in subsection (b), the definitions under sections 3502 and 3552 shall apply to this subchapter. (b) Additional definitions As used in this subchapter: (1) Appropriate notification entities The term appropriate notification entities (A) the Committee on Homeland Security and Governmental Affairs of the Senate; (B) the Committee on Oversight and Reform of the House of Representatives; (C) the Committee on Homeland Security of the House of Representatives; (D) the appropriate authorization and appropriations committees of Congress; (E) the Director; (F) the Director of the Cybersecurity and Infrastructure Security Agency; (G) the National Cyber Director; and (H) the Comptroller General of the United States. (2) Contractor The term contractor (A) means any person or business that collects or maintains information that includes personally identifiable information or sensitive personal information on behalf of an agency; and (B) includes any subcontractor of a person or business described in subparagraph (A). (3) Intelligence community The term intelligence community 50 U.S.C. 3003 (4) Nationwide consumer reporting agency The term nationwide consumer reporting agency 15 U.S.C. 1681a(p) (5) Vulnerability disclosure The term vulnerability disclosure 3592. Notification of high risk exposure after major incident (a) Notification As expeditiously as practicable and without unreasonable delay, and in any case not later than 30 days after an agency has a reasonable basis to conclude that a major incident has occurred due to a high risk exposure of personal identifiable information, as described in section 3598(c)(2), the head of the agency shall provide notice of the major incident in accordance with subsection (b) in writing to the last known home mailing address of each individual whom the major incident may have impacted. (b) Contents of notice Each notice to an individual required under subsection (a) shall include— (1) a description of the rationale for the determination that the major incident resulted in a high risk of exposure of the personal information of the individual; (2) an assessment of the type of risk the individual may face as a result of an exposure; (3) contact information for the Federal Bureau of Investigation or other appropriate entity; (4) the contact information of each nationwide consumer reporting agency; (5) the contact information for questions to the agency, including a telephone number, e-mail address, and website; (6) information on any remedy being offered by the agency; (7) consolidated Federal Government recommendations on what to do in the event of a major incident; and (8) any other appropriate information as determined by the head of the agency. (c) Delay of notification (1) In general The Attorney General, the Director of National Intelligence, or the Secretary of Homeland Security may impose a delay of a notification required under subsection (a) if the notification would disrupt a law enforcement investigation, endanger national security, or hamper security remediation actions. (2) Documentation (A) In general Any delay under paragraph (1) shall be reported in writing to the head of the agency, the Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the Office of Inspector General of the agency that experienced the major incident. (B) Contents A statement required under subparagraph (A) shall include a written statement from the entity that delayed the notification explaining the need for the delay. (C) Form The statement required under subparagraph (A) shall be unclassified, but may include a classified annex. (3) Renewal A delay under paragraph (1) shall be for a period of 2 months and may be renewed. (d) Update notification If an agency determines there is a change in the reasonable basis to conclude that a major incident occurred, or that there is a change in the details of the information provided to impacted individuals as described in subsection (b), the agency shall as expeditiously as practicable and without unreasonable delay, and in any case not later than 30 days after such a determination, notify all such individuals who received a notification pursuant to subsection (a) of those changes. (e) Rule of construction Nothing in this section shall be construed to limit— (1) the Director from issuing guidance regarding notifications or the head of an agency from sending notifications to individuals impacted by incidents not determined to be major incidents; or (2) the Director from issuing guidance regarding notifications of major incidents or the head of an agency from issuing notifications to individuals impacted by major incidents that contain more information than described in subsection (b). 3593. Congressional notifications and reports (a) Initial report (1) In general Not later than 5 days after the date on which an agency has a reasonable basis to conclude that a major incident occurred, the head of the agency shall submit a written notification and, to the extent practicable, provide a briefing, to the appropriate notification entities, taking into account— (A) the information known at the time of the notification; (B) the sensitivity of the details associated with the major incident; and (C) the classification level of the information contained in the notification. (2) Contents A notification required under paragraph (1) shall include— (A) a summary of the information available about the major incident, including how the major incident occurred, based on information available to agency officials as of the date on which the agency submits the report; (B) if applicable, an estimate of the number of individuals impacted by the major incident, including an assessment of the risk level to impacted individuals based on the guidance promulgated under section 3598(c)(1) and any information available to agency officials on the date on which the agency submits the report; (C) if applicable, a description and any associated documentation of any circumstances necessitating a delay in or exemption to notification granted under subsection (c) or (d) of section 3592; and (D) if applicable, an assessment of the impacts to the agency, the Federal Government, or the security of the United States, based on information available to agency officials on the date on which the agency submits the report. (b) Supplemental report Within a reasonable amount of time, but not later than 45 days after the date on which additional information relating to a major incident for which an agency submitted a written notification under subsection (a) is discovered by the agency, the head of the agency shall submit to the appropriate notification entities updates to the written notification that include summaries of— (1) the threats and threat actors, vulnerabilities, means by which the major incident occurred, and impacts to the agency relating to the major incident; (2) any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred; (3) the status of compliance of the affected information system with applicable security requirements at the time of the major incident; (4) an estimate of the number of individuals affected by the major incident based on information available to agency officials as of the date on which the agency submits the update; (5) an update to the assessment of the risk of harm to impacted individuals affected by the major incident based on information available to agency officials as of the date on which the agency submits the update; (6) an update to the assessment of the risk to agency operations, or to impacts on other agency or non-Federal entity operations, affected by the major incident based on information available to agency officials as of the date on which the agency submits the update; and (7) the detection, response, and remediation actions of the agency, including any support provided by the Cybersecurity and Infrastructure Security Agency under section 3594(d) and status updates on the notification process described in section 3592(a), including any delay or exemption described in subsection (c) or (d), respectively, of section 3592, if applicable. (c) Update Report If the agency determines that there is any significant change in the understanding of the agency of the scope, scale, or consequence of a major incident for which an agency submitted a written notification under subsection (a), the agency shall provide an updated report to the appropriate notification entities that includes information relating to the change in understanding. (d) Annual report Each agency shall submit as part of the annual report required under section 3554(c)(1) of this title a description of each major incident that occurred during the 1-year period preceding the date on which the report is submitted. (e) Delay and exemption report The Director shall submit to the appropriate notification entities an annual report on all notification delays and exemptions granted pursuant to subsections (c) and (d) of section 3592. (f) Report delivery Any written notification or report required to be submitted under this section may be submitted in a paper or electronic format. (g) Rule of construction Nothing in this section shall be construed to limit— (1) the ability of an agency to provide additional reports or briefings to Congress; or (2) Congress from requesting additional information from agencies through reports, briefings, or other means. (h) Binding operational directive If the Director of the Cybersecurity and Infrastructure Security Agency issues a binding operational directive or an emergency directive under section 3553, not later than 2 days after the date on which the binding operational directive requires an agency to take an action, each agency shall provide to the appropriate notification entities the status of the implementation of the binding operational directive at the agency. 3594. Government information sharing and incident response (a) In general (1) Incident reporting The head of each agency shall provide any information relating to any incident, whether the information is obtained by the Federal Government directly or indirectly, to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget. (2) Contents A provision of information relating to an incident made by the head of an agency under paragraph (1) shall— (A) include detailed information about the safeguards that were in place when the incident occurred; (B) whether the agency implemented the safeguards described in subparagraph (A) correctly; and (C) in order to protect against a similar incident, identify— (i) how the safeguards described in subparagraph (A) should be implemented differently; and (ii) additional necessary safeguards. (b) Compliance The information provided under subsection (a) shall— (1) take into account the level of classification of the information and any information sharing limitations relating to law enforcement; and (2) be in compliance with the requirements limiting the release of information under section 552a of title 5 (commonly known as the Privacy Act of 1974 (c) Responding to information requests from agencies experiencing incidents An agency that receives a request from another agency or Federal entity for information specifically intended to assist in the remediation or notification requirements due to an incident shall provide that information to the greatest extent possible, in accordance with guidance issued by the Director and taking into account classification, law enforcement, national security, and compliance with section 552a of title 5 (commonly known as the Privacy Act of 1974 (d) Incident response Each agency that has a reasonable basis to conclude that a major incident occurred, regardless of delays from notification granted for a major incident, shall consult with the Cybersecurity and Infrastructure Security Agency regarding— (1) incident response and recovery; and (2) recommendations for mitigating future incidents. 3595. Responsibilities of contractors and grant recipients (a) Notification (1) In general Subject to paragraph (3), any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that an incident involving Federal information has occurred shall immediately notify the agency. (2) Procedures (A) Major incident Following notification of a major incident by a contractor or recipient of a grant under paragraph (1), an agency, in consultation with the contractor or grant recipient, as applicable, shall carry out the requirements under sections 3592, 3593, and 3594 with respect to the major incident. (B) Incident Following notification of an incident by a contractor or recipient of a grant under paragraph (1), an agency, in consultation with the contractor or grant recipient, as applicable, shall carry out the requirements under section 3594 with respect to the incident. (3) Applicability This subsection shall apply to a contractor of an agency or a recipient of a grant from an agency that— (A) receives information from the agency that the contractor or recipient, as applicable, is not contractually authorized to receive; (B) experiences an incident relating to Federal information on an information system of the contractor or recipient, as applicable; or (C) identifies an incident involving a Federal information system. (b) Incident response Any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that a major incident occurred shall, in coordination with the agency, consult with the Cybersecurity and Infrastructure Security Agency regarding— (1) incident response assistance; and (2) recommendations for mitigating future incidents at the agency. (c) Effective date This section shall apply on and after the date that is 1 year after the date of enactment of the Federal Information Security Modernization Act of 2021 3596. Training (a) In general Each agency shall develop training for individuals at the agency with access to Federal information or information systems on how to identify and respond to an incident, including— (1) the internal process at the agency for reporting an incident; and (2) the obligation of the individual to report to the agency a confirmed major incident and any suspected incident, involving information in any medium or form, including paper, oral, and electronic. (b) Applicability The training developed under subsection (a) shall— (1) be required for an individual before the individual may access Federal information or information systems; and (2) apply to individuals with temporary access to Federal information or information systems, such as detailees, contractors, subcontractors, grantees, volunteers, and interns. (c) Inclusion in annual training The training developed under subsection (a) may be included as part of an annual privacy or security awareness training of the agency, as applicable. 3597. Analysis and report on Federal incidents (a) Definition of compromise In this section, the term compromise (1) an incident; (2) a result of a penetration test in which the tester successfully gains access to a system within the standards under section 3559A; (3) a vulnerability disclosure; or (4) any other event that the Director of the Cybersecurity and Infrastructure Security Agency determines identifies an exploitable vulnerability in an agency system. (b) Analysis of Federal incidents (1) In general The Director of the Cybersecurity and Infrastructure Security Agency shall perform continuous monitoring of compromises of agencies. (2) Quantitative and Qualitative analyses The Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, shall develop and perform continuous monitoring and quantitative and qualitative analyses of compromises of agencies, including— (A) the causes of successful compromises, including— (i) attacker tactics, techniques, and procedures; and (ii) system vulnerabilities, including zero days, unpatched systems, and information system misconfigurations; (B) the scope and scale of compromises of agencies; (C) cross Federal Government root causes of compromises of agencies; (D) agency response, recovery, and remediation actions and effectiveness of incidents, as applicable; and (E) lessons learned and recommendations in responding, recovering, remediating, and mitigating future incidents. (3) Automated analysis The analyses developed under paragraph (2) shall, to the greatest extent practicable, use machine readable data, automation, and machine learning processes. (4) Sharing of data and analysis (A) In general The Director shall share on an ongoing basis the analyses required under this subsection with agencies to— (i) improve the understanding of agencies with respect to risk; and (ii) support the cybersecurity improvement efforts of agencies. (B) Format In carrying out subparagraph (A), the Director shall share the analyses— (i) in human-readable written products; and (ii) to the greatest extent practicable, in machine-readable formats in order to enable automated intake and use by agencies. (c) Annual report on Federal compromises Not later than 2 years after the date of enactment of this section, and not less frequently than annually thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, shall submit to the appropriate notification entities a report that includes— (1) a summary of causes of compromises from across the Federal Government that categorizes those compromises by the items described in paragraphs (1) through (4) of subsection (a); (2) the quantitative and qualitative analyses of compromises developed under subsection (b)(2) on an agency-by-agency basis and comprehensively; and (3) an annex for each agency that includes the total number of compromises of the agency and categorizes those compromises by the items described in paragraphs (1) through (4) of subsection (a). (d) Publication A version of each report submitted under subsection (c) shall be made publicly available on the website of the Cybersecurity and Infrastructure Security Agency during the year in which the report is submitted. (e) Information provided by agencies The analysis required under subsection (b) and each report submitted under subsection (c) shall utilize information provided by agencies pursuant to section 3594(d). (f) Requirement To Anonymize Information In publishing the public report required under subsection (d), the Director of the Cybersecurity and Infrastructure Security Agency shall sufficiently anonymize and compile information such that no specific incidents of an agency can be identified, except with the concurrence of the Director of the Office of Management and Budget and in consultation with the impacted agency. 3598. Major incident guidance (a) In general Not later than 90 days after the date of enactment of the Federal Information Security Management Act of 2021, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop and promulgate guidance on the definition of the term major incident (b) Requirements With respect to the guidance issued under subsection (a), the definition of the term major incident (1) include, with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency— (A) any incident the head of the agency determines is likely to have an impact on the national security, homeland security, or economic security of the United States; (B) any incident the head of the agency determines is likely to have an impact on the operations of the agency, a component of the agency, or the Federal Government, including an impact on the efficiency or effectiveness of agency information systems; (C) any incident that the head of an agency, in consultation with the Chief Privacy Officer of the agency, determines involves a high risk incident in accordance with the guidance issued under subsection (c)(1); (D) any incident that involves the unauthorized disclosure of personally identifiable information of not less than 500 individuals, regardless of the risk level determined under the guidance issued under subsection (c)(1); (E) any incident the head of the agency determines involves a high value asset owned or operated by the agency; and (F) any other type of incident determined appropriate by the Director; (2) stipulate that every agency shall be considered to have experienced a major incident if the Director of the Cybersecurity and Infrastructure Security Agency determines that an incident that occurs at not less than 2 agencies— (A) is enabled by a common technical root cause, such as a supply chain compromise, a common software or hardware vulnerability; or (B) is enabled by the related activities of a common actor; and (3) stipulate that, in determining whether an incident constitutes a major incident because that incident— (A) is any incident described in paragraph (1), the head of an agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency; (B) is an incident described in paragraph (1)(A), the head of the agency shall consult with the National Cyber Director; and (C) is an incident described in subparagraph (C) or (D) of paragraph (1), the head of the agency shall consult with— (i) the Privacy and Civil Liberties Oversight Board; and (ii) the Executive Director of the Federal Trade Commission. (c) Guidance on risk to individuals (1) In general Not later than 90 days after the date of enactment of the Federal Information Security Modernization Act of 2021 (2) Risk levels and considerations The risk-based framework included in the guidance issued under paragraph (1) shall— (A) include a range of risk levels, including a high risk level; and (B) consider— (i) any personally identifiable information that was exposed as a result of an incident; (ii) the circumstances under which the exposure of personally identifiable information of an individual occurred; and (iii) whether an independent evaluation of the information affected by an incident determines that the information is unreadable, including, as appropriate, instances in which the information is— (I) encrypted; and (II) determined by the Director of the Cybersecurity and Infrastructure Security Agency to be of sufficiently low risk of exposure. (3) Approval (A) In general The guidance issued under paragraph (1) shall include a process by which the Director, jointly with the Director of the Cybersecurity and Infrastructure Security Agency and the Attorney General, may approve the designation of an incident that would be considered high risk as lower risk if information exposed by the incident is unreadable, as described in paragraph (2)(B)(iii). (B) Documentation The Director shall report any approval of an incident granted by the Director under subparagraph (A) to— (i) the head of the agency that experienced the incident; (ii) the inspector general of the agency that experienced the incident; and (iii) the Director of the Cybersecurity and Infrastructure Security Agency. (d) Evaluation and updates Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2021 (1) an update, if necessary, to the guidance issued under subsections (a) and (c); (2) the definition of the term major incident (3) an explanation of, and the analysis that led to, the definition described in paragraph (2); and (4) an assessment of any additional datasets or risk evaluation criteria that should be included in the risk-based framework included in the guidance issued under subsection (c)(1). . (2) Clerical amendment The table of sections for chapter 35 SUBCHAPTER IV—Federal System Incident Response 3591. Definitions. 3592. Notification of high risk exposure after major incident. 3593. Congressional notifications and reports. 3594. Government information sharing and incident response. 3595. Responsibilities of contractors and grant recipients. 3596. Training. 3597. Analysis and report on Federal incidents. 3598. Major incident guidance. . 102. Amendments to subtitle III of title 40 (a) Information Technology Modernization Centers of Excellence Program Act Section 2(c)(4)(A)(ii) of the Information Technology Modernization Centers of Excellence Program Act ( 40 U.S.C. 11301 , which shall be provided in coordination with the Director of the Cybersecurity and Infrastructure Security Agency. (b) Modernizing Government Technology Subtitle G of title X of Division A of the National Defense Authorization Act for Fiscal Year 2018 ( 40 U.S.C. 11301 (1) in section 1077(b)— (A) in paragraph (5)(A), by inserting improving the cybersecurity of systems and cost savings activities (B) in paragraph (7)— (i) in the paragraph heading, by striking cio CIO (ii) by striking In evaluating projects (A) Consideration of guidance In evaluating projects ; (iii) in subparagraph (A), as so designated, by striking under section 1094(b)(1) guidance issued by the Director (iv) by adding at the end the following: (B) Consultation In using funds under paragraph (3)(A), the Chief Information Officer of the covered agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency. ; and (2) in section 1078— (A) by striking subsection (a) and inserting the following: (a) Definitions In this section: (1) Agency The term agency (2) High value asset The term high value asset ; (B) in subsection (b), by adding at the end the following: (8) Proposal evaluation The Director shall— (A) give consideration for the use of amounts in the Fund to improve the security of high value assets; and (B) require that any proposal for the use of amounts in the Fund includes a cybersecurity plan, including a chain risk management plan, to be reviewed by the member of the Technology Modernization Board described in subsection (c)(5)(C). ; and (C) in subsection (c)— (i) in paragraph (2)(A)(i), by inserting , including a consideration of the impact on high value assets operational risks (ii) in paragraph (5)— (I) in subparagraph (A), by striking and (II) in subparagraph (B), by striking the period at the end and inserting and (III) by adding at the end the following: (C) a senior official from the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, appointed by the Director. ; and (iii) in paragraph (6)(A), by striking shall be— 4 employees shall be 4 employees (c) Subchapter I Subchapter I of subtitle III of title 40, United States Code, is amended— (1) in section 11302— (A) in subsection (b), by striking use, security, and disposal of use, and disposal, and, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, promote and improve the security, of (B) in subsection (c)— (i) in paragraph (2), by inserting in consultation with the Director of the Cybersecurity and Infrastructure Security Agency , and results of (ii) in paragraph (3)— (I) in subparagraph (A), by striking , and performance security, and performance (II) in subparagraph (C)— (aa) by striking For each major (i) In general For each major ; and (bb) by adding at the end the following: (ii) Cybersecurity In categorizing an investment according to risk under clause (i), the Chief Information Officer of the covered agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency on the cybersecurity or supply chain risk. (iii) Security risk guidance The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance for the categorization of an investment under clause (i) according to the cybersecurity or supply chain risk. ; and (iii) in paragraph (4)— (I) in subparagraph (A)— (aa) in clause (ii), by striking and (bb) in clause (iii), by striking the period at the end and inserting ; and (cc) by adding at the end the following: (iv) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the cybersecurity risks of the investment. ; and (II) in subparagraph (B), in the matter preceding clause (i), by inserting not later than 30 days after the date on which the review under subparagraph (A) is completed, the Administrator (C) in subsection (f)— (i) by striking heads of executive agencies to develop (1) develop ; (ii) in paragraph (1), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (2) consult with the Director of the Cybersecurity and Infrastructure Security Agency for the development and use of supply chain security best practices. ; and (D) in subsection (h), by inserting , including cybersecurity performances, the performances (2) in section 11303(b)(2)(B)— (A) in clause (i), by striking or (B) in clause (ii), by adding or (C) by adding at the end the following: (iii) whether the function should be performed by a shared service offered by another executive agency; . (d) Subchapter II Subchapter II of subtitle III of title 40, United States Code, is amended— (1) in section 11312(a), by inserting , including security risks managing the risks (2) in section 11313(1), by striking efficiency and effectiveness efficiency, security, and effectiveness (3) in section 11317, by inserting security, or schedule (4) in section 11319(b)(1), in the paragraph heading, by striking cios Chief Information Officers (e) Subchapter III Section 11331 of title 40, United States Code, is amended— (1) in subsection (a), by striking section 3532(b)(1) section 3552(b) (2) in subsection (b)(1)(A)— (A) by striking in consultation in coordination (B) by striking the Secretary of Homeland Security the Director of the Cybersecurity and Infrastructure Security Agency (C) by inserting and associated verification specifications developed under subsection (g) pertaining to Federal (3) by striking subsection (c) and inserting the following: (c) Application of more stringent standards (1) In general The head of an agency shall— (A) evaluate the need to employ standards for cost-effective, risk-based information security for all systems, operations, and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the Director under this section, if such standards contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Director; and (B) to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph (A) are necessary, employ those standards. (2) Evaluation of more stringent standards In evaluating the need to employ more stringent standards under paragraph (1), the head of an agency shall consider available risk information, including— (A) the status of cybersecurity remedial actions of the agency; (B) any vulnerability information relating to agency systems that is known to the agency; (C) incident information of the agency; (D) information from— (i) penetration testing performed under section 3559A of title 44; and (ii) information from the verification disclosure program established under section 3559B of title 44; (E) agency threat hunting results under section 207 of the Federal Information Security Modernization Act of 2021 (F) Federal and non-Federal threat intelligence; (G) data on compliance with standards issued under this section, using the verification specifications developed under subsection (f) when appropriate; (H) agency system risk assessments of the agency performed under section 3554(a)(1)(A) of title 44; and (I) any other information determined relevant by the head of the agency. ; (4) in subsection (d)(2)— (A) by striking the paragraph heading and inserting Consultation, notice, and comment (B) by inserting promulgate, significantly modify (C) by striking shall be made after the public is given an opportunity to comment on the Director's proposed decision. (A) for a decision to significantly modify or not promulgate such a proposed standard, after the public is given an opportunity to comment on the Director's proposed decision; (B) in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency; (C) considering the Federal risk assessments performed under section 3553(i) of title 44; and (D) considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard. ; and (5) by adding at the end the following: (e) Review of promulgated standards (1) In general Not less frequently than once every 2 years, the Director of the Office of Management and Budget, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency shall review the efficacy of the standards in effect promulgated under this section in reducing cybersecurity risks and determine whether any changes to those standards are appropriate based on— (A) the Federal risk assessment developed under section 3553(i) of title 44; (B) public comment; and (C) an assessment of the extent to which the proposed standards reduce risk relative to the cost of implementation of the standards. (2) Updated guidance Not later than 90 days after the date of the completion of the review under paragraph (1), the Director of the Office of Management and Budget shall issue guidance to agencies to make any necessary updates to the standards in effect promulgated under this section based on the results of the review. (3) Congressional report Not later than 30 days after the date on which a review is completed under paragraph (1), the Director shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives (A) the review of the standards in effect promulgated under this section conducted under paragraph (1); (B) the risk mitigation offered by each standard described in subparagraph (A); and (C) a summary of— (i) the standards to which changes were determined appropriate during the review; and (ii) anticipated changes to the standards under this section in guidance issued under paragraph (2). (f) Verification specifications Not later than 1 year after the date on which the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(a) . 103. Actions to enhance Federal incident response (a) Responsibilities of the Cybersecurity and Infrastructure Security Agency (1) Recommendations Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Chair of the Federal Trade Commission, the Chair of the Securities and Exchange Commission, the Secretary of the Treasury, the Director of the Federal Bureau of Investigation, the Director of the National Institute of Standards and Technology, and the head of any other appropriate Federal or non-Federal entity, shall consolidate, maintain, and make publicly available recommendations for individuals whose personal information, as defined in section 3591 of title 44, United States Code, as added by this Act, is inappropriately exposed as a result of a high risk incident described in section 3598(c)(2) of title 44, United States Code. (2) Plan for analysis of, and report on, Federal incidents (A) In general Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— (i) develop a plan for the development of the analysis required under section 3597(b) of title 44, United States Code, as added by this Act, and the report required under subsection (c) of that section that includes— (I) a description of any challenges the Director anticipates encountering; and (II) the use of automation and machine-readable formats for collecting, compiling, monitoring, and analyzing data; and (ii) provide to the appropriate congressional committees a briefing on the plan developed under clause (i). (B) Briefing Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the appropriate congressional committees a briefing on— (i) the execution of the plan required under subparagraph (A); and (ii) the development of the report required under section 3597(c) of title 44, United States Code, as added by this Act. (b) Responsibilities of the Director of the Office of Management and Budget (1) FISMA Section 2 of the Federal Information Security Modernization Act of 2014 ( 44 U.S.C. 3554 (A) by striking subsection (b); and (B) by redesignating subsections (c) through (f) as subsections (b) through (e), respectively. (2) Incident data sharing (A) In general The Director shall develop guidance, to be updated not less frequently than once every 2 years, on the content, timeliness, and format of the information provided by agencies under section 3594(a) of title 44, United States Code, as added by this Act. (B) Requirements The guidance developed under subparagraph (A) shall— (i) prioritize the availability of data necessary to understand and analyze— (I) the causes of incidents; (II) the scope and scale of incidents within the agency networks and systems; (III) cross Federal Government root causes of incidents; (IV) agency response, recovery, and remediation actions; and (V) the effectiveness of incidents; (ii) enable the efficient development of— (I) lessons learned and recommendations in responding to, recovering from, remediating, and mitigating future incidents; and (II) the report on Federal compromises required under section 3597(c) of title 44, United States Code, as added by this Act; (iii) include requirements for the timeliness of data production; and (iv) include requirements for using automation and machine-readable data for data sharing and availability. (3) Guidance on responding to information requests Not later than 1 year after the date of enactment of this Act, the Director shall develop guidance for agencies to implement the requirement under section 3594(c) of title 44, United States Code, as added by this Act, to provide information to other agencies experiencing incidents. (4) Standard guidance and templates Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop guidance and templates, to be reviewed and, if necessary, updated not less frequently than once every 2 years, for use by Federal agencies in the activities required under sections 3592, 3593, and 3596 of title 44, United States Code, as added by this Act. (5) Contractor and grantee guidance (A) In general Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Secretary of Homeland Security, the Secretary of Defense, the Administrator of General Services, and the heads of other agencies determined appropriate by the Director, shall issue guidance to Federal agencies on how to deconflict existing regulations, policies, and procedures relating to the responsibilities of contractors and grant recipients established under section 3595 of title 44, United States Code, as added by this Act. (B) Existing processes To the greatest extent practicable, the guidance issued under subparagraph (A) shall allow contractors and grantees to use existing processes for notifying Federal agencies of incidents involving information of the Federal Government. (6) Updated briefings Not less frequently than once every 2 years, the Director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs (2) through (4). (c) Update to the Privacy Act of 1974 Section 552a(b) of title 5, United States Code (commonly known as the Privacy Act of 1974 (1) in paragraph (11), by striking or (2) in paragraph (12), by striking the period at the end and inserting ; and (3) by adding at the end the following: (13) to another agency in furtherance of a response to an incident (as defined in section 3552 of title 44) and pursuant to the information sharing requirements in section 3594 of title 44 if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought. . 104. Additional guidance to agencies on FISMA updates Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance for agencies on— (1) completing the agency system risk assessment required under section 3554(a)(1)(A) of title 44, United States Code, as amended by this Act; (2) implementing additional cybersecurity procedures, which shall include resources for shared services; (3) establishing a process for providing the status of each remedial action under section 3554(b)(7) of title 44, United States Code, as amended by this Act, to the Director and the Cybersecurity and Infrastructure Security Agency using automation and machine-readable data, as practicable, which shall include— (A) specific standards for the automation and machine-readable data; and (B) templates for providing the status of the remedial action; (4) interpreting the definition of high value asset (5) implementing standards in agency authorization processes to encourage the tailoring of processes to agency and system risk that are proportionate to the sensitivity of systems, which shall include— (A) a clarification of— (i) the acceptable use and development of customization of standards promulgated under section 11331 of title 40, United States Code; and (ii) the acceptable use of risk-based authorization procedures authorized on the date of enactment of this Act; and (B) a requirement to coordinate with Inspectors Generals of agencies to ensure consistent understanding and application of agency policies for the purpose of Inspector General audits; and (6) requiring, as practicable and pursuant to section 203, an evaluation of agency cybersecurity using metrics that are— (A) based on outcomes; and (B) based on time. 105. Agency requirements to notify entities impacted by incidents Not later than 180 days after the date of enactment of this Act, the Director shall issue guidance that requires agencies to notify entities that are compelled to share sensitive information with the agency of an incident that impacts— (1) sensitive information shared with the agency by the entity; or (2) the systems used to the transmit sensitive information described in paragraph (1) to the agency. II Improving Federal cybersecurity 201. Evaluation of effectiveness of standards (a) In general As a component of the evaluation and report required under section 3555(h) of title 44, United States Code, and not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall perform a study that— (1) assesses the standards promulgated under section 11331(b) of title 40, United States Code to determine the degree to which agencies use the authority under section 11331(c)(1) of title 40, United States Code to customize the standards relative to the risks facing each agency and agency system; (2) assesses the effectiveness of the standards described in paragraph (1), including any standards customized by agencies under section 11331(c)(1) of title 40, United States Code, at improving agency cybersecurity; (3) examines the quantification of cybersecurity risk in the private sector for any applicability for use by the Federal Government; (4) examines cybersecurity metrics existing as of the date of enactment of this Act used by the Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the heads of other agencies to evaluate the effectiveness of information security policies and practices; and (5) with respect to the standards described in paragraph (1), provides recommendations for— (A) the addition or removal of standards; or (B) the customization of— (i) the standards by agencies under section 11331(c)(1) of title 40, United (ii) specific controls within the standards. (b) Incorporation of study The Director shall incorporate the results of the study performed under subsection (a) into the review of standards required under section 11331(e) of title 40, United States Code. (c) Briefing Not later than 30 days after the date on which the study performed under subsection (a) is completed, the Comptroller General of the United States shall provide to the appropriate congressional committees a briefing on the study. 202. Mobile security standards (a) In general Not later than 1 year after the date of enactment of this Act, the Director shall— (1) evaluate mobile application security standards promulgated under section 11331(b) of title 44, United States Code; and (2) issue guidance to implement mobile security standards in effect on the date of enactment of this Act promulgated under section 11331(b) of title 40, United States Code, including for mobile applications, for every agency. (b) Contents The guidance issued under subsection (a)(2) shall include— (1) a requirement, pursuant to section 3506(b)(4) of title 44, United States Code, for every agency to maintain a continuous inventory of every— (A) mobile device operated by or on behalf of the agency; (B) mobile application installed on a mobile device described in subparagraph (A); and (C) vulnerability identified by the agency associated with a mobile device or mobile application described in subparagraphs (A) and (B); and (2) a requirement for every agency to perform continuous evaluation of the vulnerabilities described in paragraph (1)(C) and other risks. (c) Information sharing The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance to agencies for sharing the inventory of the agency required under subsection (b)(1) with the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable. (d) Briefing Not later than 60 days after the date on which the Director issues guidance under subsection (a)(2), the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall provide to the appropriate congressional committees a briefing on the guidance. 203. Quantitative cybersecurity metrics (a) Establishing time-Based metrics (1) In general Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— (A) update the metrics used to measure security under section 3554 of title 44, United States Code, including any metrics developed pursuant to section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) (B) evaluate the metrics described in subparagraph (A). (2) Qualities With respect to the updated metrics required under paragraph (1)— (A) not less than 2 of the metrics shall be time-based; and (B) the metrics may include other measurable outcomes. (3) Evaluation The evaluation required under paragraph (1)(B) shall evaluate— (A) the amount of time it takes for an agency to detect an incident; and (B) the amount of time that passes between— (i) the detection and remediation of an incident; and (ii) the remediation of an incident and the recovery from the incident. (b) Implementation (1) In general The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall promulgate guidance that requires the use of the updated metrics developed under subsection (a)(1)(A) by every agency over a 4-year period beginning on the date on which the metrics are developed to track trends in the incident response capabilities of agencies. (2) Penetration tests On not less than 2 occasions during the 2-year period following the date on which guidance is promulgated under paragraph (1), not less than 3 agencies shall be subjected to substantially similar penetration tests in order to validate the utility of the metrics developed under subsection (a)(1)(A). (3) Database The Director of the Cybersecurity and Infrastructure Security Agency shall develop and use a database that— (A) stores agency metrics information; and (B) allows for the performance of cross-agency comparison of agency incident response capability trends. (c) Updated metrics (1) In general The Director may issue guidance that updates the metrics developed under subsection (a)(1)(A) if the updated metrics— (A) have the qualities described in subsection (a)(2); and (B) can be evaluated under subsection (a)(3). (2) Data sharing The guidance issued under paragraph (1) shall require agencies to share with the Director of the Cybersecurity and Infrastructure Security Agency data demonstrating the performance of the agency with the updated metrics included in that guidance against the metrics developed under subsection (a)(1)(A). (d) Congressional reports (1) Updated metrics Not later than 30 days after the date on which the Director of the Cybersecurity and Infrastructure Security completes the evaluation required under subsection (a)(1)(B), the Director of the Cybersecurity and Infrastructure Security Agency shall submit to the appropriate congressional committees a report on the updated metrics developed under subsection (a)(1)(A). (2) Program Not later than 180 days after the date on which guidance is promulgated under subsection (b)(1), the Director shall submit to the appropriate congressional committees a report on the results of the use of the updated metrics developed under subsection (a)(1)(A) by agencies. 204. Data and logging retention for incident response (a) Recommendations Not later than 60 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General and the National Cyber Director, shall submit to the Director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency. (b) Contents The recommendations provided under subsection (a) shall include— (1) the types of logs to be maintained; (2) the time periods to retain the logs and other relevant data; (3) the time periods for agencies to enable recommended logging and security requirements; (4) how to ensure the confidentiality, integrity, and availability of logs; (5) requirements to ensure that, upon request, agencies provide logs to— (A) the Director of the Cybersecurity and Infrastructure Security Agency for a cybersecurity purpose; and (B) the Federal Bureau of Investigation to investigate potential criminal activity; and (6) ensuring the highest level security operations center of each agency has visibility into all agency logs. (c) Guidance Not later than 90 days after receiving the recommendations submitted under subsection (a), the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Attorney General, shall promulgate guidance to agencies to establish requirements for logging, log retention, log management, and sharing of log data with other appropriate agencies. (d) Periodic review Not later than 2 years after the date on which the Director of the Cybersecurity and Infrastructure Security Agency submits the recommendations required under subsection (a), and not less frequently than every 2 years thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General, shall evaluate the recommendations and provide an update on the recommendations to the Director as necessary. 205. CISA agency advisors (a) In general Not later than 120 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall assign not less than 1 cybersecurity professional employed by the Cybersecurity and Infrastructure Security Agency to be the Cybersecurity and Infrastructure Security Agency advisor to the Chief Information Officer of each agency. (b) Qualifications Each advisor assigned under subsection (a) shall have knowledge of— (1) cybersecurity threats facing agencies, including any specific threats to the assigned agency; (2) performing risk assessments of agency systems; and (3) other Federal cybersecurity initiatives. (c) Duties The duties of each advisor assigned under subsection (a) shall include— (1) providing ongoing assistance and advice, as requested, to the agency Chief Information Officer; (2) serving as an incident response point of contact between the assigned agency and the Cybersecurity and Infrastructure Security Agency; and (3) familiarizing themselves with agency systems, processes, and procedures to better facilitate support to the agency in responding to incidents. (d) Limitation An advisor assigned under subsection (a) shall not be a contractor. (e) Multiple assignments One individual advisor made be assigned to multiple agency Chief Information Officers under subsection (a). 206. Federal penetration testing policy (a) In general Subchapter II of chapter 35 3559A. Federal penetration testing (a) Definitions In this section: (1) Agency operational plan The term agency operational plan (2) Rules of engagement The term rules of engagement (b) Guidance (1) In general Not later than 180 days after the date of enactment of this Act, the Director shall issue guidance that— (A) requires agencies to use, when and where appropriate, penetration testing on agency systems; and (B) requires agencies to develop an agency operational plan and rules of engagement that meet the requirements under subsection (c). (2) Penetration testing guidance The guidance issued under this section shall— (A) permit an agency to use, for the purpose of performing penetration testing— (i) a shared service of the agency or another agency; or (ii) an external entity, such as a vendor; (B) include templates and frameworks for reporting the results of penetration testing, without regard to the status of the entity that performs the penetration testing; and (C) require agencies to provide the rules of engagement and results of penetration testing to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, without regard to the status of the entity that performs the penetration testing. (c) Agency plans and rules of engagement The agency operational plan and rules of engagement of an agency shall— (1) require the agency to perform penetration testing on the high value assets of the agency; (2) establish guidelines for avoiding, as a result of penetration testing— (A) adverse impacts to the operations of the agency; (B) adverse impacts to operational networks and systems of the agency; and (C) inappropriate access to data; (3) require the results of penetration testing to include feedback to improve the cybersecurity of the agency; and (4) include mechanisms for providing consistently formatted, and, if applicable, automated and machine-readable, data to the Director and the Director of the Cybersecurity and Infrastructure Security Agency. (d) Responsibilities of CISA The Director of the Cybersecurity and Infrastructure Security Agency shall— (1) establish a certification process for the performance of penetration testing by both Federal and non-Federal entities that establishes minimum quality controls for penetration testing; (2) develop operational guidance for instituting penetration testing programs at agencies; (3) develop and maintain a centralized capability to offer penetration testing as a service to Federal and non-Federal entities; and (4) provide guidance to agencies on the best use of penetration testing resources. (e) Responsibilities of OMB The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall— (1) not less frequently than annually, inventory all Federal penetration testing assets; and (2) develop and maintain a Federal strategy for the use of penetration testing. (f) Prioritization of penetration testing resources (1) In general The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop a framework for prioritizing Federal penetration testing resources among agencies. (2) Considerations In developing the framework under this subsection, the Director shall consider— (A) agency system risk assessments performed under section 3554(a)(1)(A); (B) the Federal risk assessment performed under section 3553(i); (C) the analysis of Federal incident data performed under section 3597; and (D) any other information determined appropriate by the Director or the Director of the Cybersecurity and Infrastructure Security Agency. . (b) Clerical amendment The table of sections for chapter 35 3559A. Federal penetration testing. . (c) Penetration testing by the Secretary of Homeland Security Section 3553(b) of title 44, United States Code, as amended by section 1705 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 ( Public Law 116–283 (1) in paragraph (8)(B), by striking and (2) by redesignating paragraph (9) as paragraph (10); and (3) by inserting after paragraph (8) the following: (9) performing penetration testing with or without advance notice to, or authorization from, agencies, to identify vulnerabilities within Federal information systems; and . 207. Ongoing threat hunting program (a) Threat hunting program (1) In general Not later than 540 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall establish a program to provide ongoing, hypothesis-driven threat-hunting services on the network of each agency. (2) Plan Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall develop a plan to establish the program required under paragraph (1) that describes how the Director of the Cybersecurity and Infrastructure Security Agency plans to— (A) determine the method for collecting, storing, accessing, and analyzing appropriate agency data; (B) provide on-premises support to agencies; (C) staff threat hunting services; (D) allocate available human and financial resources to implement the plan; and (E) provide input to the heads of agencies on the use of— (i) more stringent standards under section 11331(c)(1) of title 40, United States Code; and (ii) additional cybersecurity procedures under section 3554 of title 44, United States Code. (b) Reports The Director of the Cybersecurity and Infrastructure Security Agency shall submit to the appropriate congressional committees— (1) not later than 30 days after the date on which the Director of the Cybersecurity and Infrastructure Security Agency completes the plan required under subsection (a)(2), a report on the plan to provide threat hunting services to agencies; (2) not less than 30 days before the date on which the Director of the Cybersecurity and Infrastructure Security Agency begins providing threat hunting services under the program, a report providing any updates to the plan developed under subsection (a)(2); and (3) not later than 1 year after the date on which the Director of the Cybersecurity and Infrastructure Security Agency begins providing threat hunting services to agencies other than the Cybersecurity and Infrastructure Security Agency, a report describing lessons learned from providing those services. 208. Codifying vulnerability disclosure programs (a) In general Chapter 35 3559B. Federal vulnerability disclosure programs (a) Definitions In this section: (1) Report The term report (2) Reporter The term reporter (b) Responsibilities of OMB (1) Limitation on legal action The Director, in consultation with the Attorney General, shall issue guidance to agencies to not recommend or pursue legal action against a reporter or an individual that conducts a security research activity that the head of the agency determines— (A) represents a good faith effort to follow the vulnerability disclosure policy developed under subsection (d)(2) of the agency; and (B) is authorized under the vulnerability disclosure policy developed under subsection (d)(2) of the agency. (2) Sharing information with CISA The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance to agencies on sharing relevant information in a consistent, automated, and machine readable manner with the Cybersecurity and Infrastructure Security Agency, including— (A) any valid or credible reports of newly discovered or not publicly known vulnerabilities (including misconfigurations) on an agency information system that uses commercial software or services; (B) information relating to vulnerability disclosure, coordination, or remediation activities of an agency, particularly as those activities relate to outside organizations— (i) with which the head of the agency believes the Director of the Cybersecurity and Infrastructure Security can assist; or (ii) about which the head of the agency believes the Director of the Cybersecurity and Infrastructure Security should know; and (C) any other information with respect to which the head of the agency determines helpful or necessary to involve the Cybersecurity and Infrastructure Security Agency. (3) Agency vulnerability disclosure policies (A) In general The Director shall issue guidance to agencies on the required minimum scope of agency systems covered by the vulnerability disclosure policy of an agency required under subsection (d)(2). (B) Deadline Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2021 (c) Responsibilities of CISA The Director of the Cybersecurity and Infrastructure Security Agency shall— (1) provide support to agencies with respect to the implementation of the requirements of this section; (2) develop tools, processes, and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section; and (3) upon a request by an agency, assist the agency in the disclosure to vendors of newly identified vulnerabilities in vendor products and services. (d) Responsibilities of agencies (1) Public information The head of each agency shall make publicly available, with respect to each internet domain under the control of the agency that is not a national security system— (A) an appropriate security contact; and (B) the component of the agency that is responsible for the internet accessible services offered at the domain. (2) Vulnerability disclosure policy The head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency, which shall— (A) describe— (i) the scope of the systems of the agency included in the vulnerability disclosure policy; (ii) the type of information system testing that is authorized by the agency; (iii) the type of information system testing that is not authorized by the agency; and (iv) the disclosure policy of the agency for sensitive information; (B) include a provision that authorizes the anonymous submission of a vulnerability by a reporter; (C) with respect to a report to an agency, describe— (i) how the reporter should submit the report; and (ii) if the report is not anonymous under subparagraph (B), when the reporter should anticipate an acknowledgment of receipt of the report by the agency; and (D) include any other relevant information. (3) Identified vulnerabilities The head of each agency shall incorporate any vulnerabilities reported under paragraph (2) into the vulnerability management process of the agency in order to track and remediate the vulnerability. (e) Paperwork Reduction Act exemption The requirements of subchapter I (commonly known as the Paperwork Reduction Act (f) Congressional reporting Not later than 90 days after the date of enactment of the Federal Information Security Modernization Act of 2021 Committee on Homeland Security and Governmental Affairs of the Senate Committee on Oversight and Reform of the House of Representatives . (b) Clerical amendment The table of sections for chapter 35 3559B. Federal vulnerability disclosure programs. . 209. Implementing presumption of compromise and zero trust architectures (a) Recommendations Not later than 60 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director of the National Institute of Standards and Technology, shall develop recommendations to increase the internal defenses of agency systems to— (1) limit the ability of entities that cause incidents to move laterally through or between agency systems; (2) identify incidents more quickly; (3) isolate and remove unauthorized entities from agency systems more quickly; (4) implement zero trust architecture; and (5) otherwise increase the resource costs for entities that cause incidents; and (b) OMB Guidance Not later than 180 days after the date on which the recommendations under subsection (a) are completed, the Director shall issue guidance to agencies that requires the implementation of the recommendations. (c) Agency implementation plans Not later than 60 days after the date on which the Director issues guidance under subsection (b), the head of each agency shall submit to the Director a plan to implement zero trust architecture that includes— (1) a description of any steps the agency has completed; (2) an identification of activities that will have the most immediate security impact; and (3) a schedule to implement the plan. (d) Report and briefing Not later than 90 days after the date on which the Director issues guidance required under subsection (b), the Director shall provide a briefing to the appropriate congressional committees on the guidance and the agency implementation plans submitted under subsection (c). 210. Automation reports (a) OMB Report Not later than 180 days after the date of enactment of this Act, the Director shall submit to the appropriate congressional committees a report on the use of automation under paragraphs (1), (5)(C) and (7)(B) of section 3554(b) of title 44, United States Code. (b) GAO Report Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall perform a study on the use of automation and machine readable data across the Federal Government for cybersecurity purposes, including the automated updating of cybersecurity tools, sensors, or processes by agencies. 211. Extension of Federal Acquisition Security Council Section 1328 of title 41, United States Code, is amended by striking the date December 31, 2026. III Pilot programs to enhance Federal cybersecurity 301. Continuous independent FISMA evaluation pilot (a) In general Not later than 2 years after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall establish a pilot program to perform continual agency auditing of the standards promulgated under section 11331 of title 40, United States Code. (b) Purpose (1) In general The purpose of the pilot program established under subsection (a) shall be to develop the capability to continuously audit agency cybersecurity postures, rather than performing an annual audit. (2) Use of information It is the sense of Congress that information relating to agency cybersecurity postures should be used, on an ongoing basis, to increase agency understanding of cybersecurity risk and improve agency cybersecurity. (c) Participating agencies (1) In general The Director, in coordination with the Council of the Inspectors General on Integrity and Efficiency and in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, shall identify not less than 1 agency and the Inspector General of each identified agency to participate in the pilot program established under subsection (a). (2) Capabilities of agency An agency selected under paragraph (1) shall have advanced cybersecurity capabilities, including the capability to implement verification specifications and other automated and machine-readable means of sharing information. (3) Capabilities of Inspector General The Inspector General of an agency selected under paragraph (1) shall have advanced cybersecurity capabilities, including the ability— (A) to perform real-time or almost real-time and continuous analysis of the use of verification specifications by the agency to assess compliance with standards promulgated under section 11331 of title 40, United States Code; and (B) to assess the impact and deployment of additional cybersecurity procedures. (d) Duties The Director, in coordination with the Council of the Inspectors General on Integrity and Efficiency, the Director of the Cybersecurity and Infrastructure Security Agency, and the head of each agency participating in the pilot program under subsection (c), shall develop processes and procedures to perform a continuous independent evaluation of— (1) the compliance of the agency with— (A) the standards promulgated under section 11331 of title 40, United States Code, using verification specifications to the greatest extent practicable; and (B) any additional cybersecurity procedures implemented by the agency as a result of the evaluation performed under section 3554(a)(1)(F) of title 44, United States Code; and (2) the overall cybersecurity posture of the agency, which may include an evaluation of— (A) the status of cybersecurity remedial actions of the agency; (B) any vulnerability information relating to agency systems that is known to the agency; (C) incident information of the agency; (D) penetration testing performed by an external entity under section 3559A of title 44, United States Code; (E) information from the vulnerability disclosure program information established under section 3559B of title 44, United States Code; (F) agency threat hunting results; and (G) any other information determined relevant by the Director. (e) Independent evaluation waiver With respect to an agency that participates in the pilot program under subsection (a) during any year other than the first year during which the pilot program is conducted, the Director, with the concurrence of the Director of the Cybersecurity and Infrastructure Security Agency, may waive any requirement of the agency with respect to the annual independent evaluation under section 3555 of title 44, United States Code. (f) Duration The pilot program established under this section— (1) shall be performed over a period of not less than 2 years at each agency that participates in the pilot program under subsection (c), unless the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Council of the Inspectors General on Integrity and Efficiency, determines that continuing the pilot program would reduce the cybersecurity of the agency; and (2) may be extended by the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Council of the Inspectors General on Integrity and Efficiency, if the Director makes the determination described in paragraph (1). (g) Reports (1) Pilot program plan Before identifying any agencies to participate in the pilot program under subsection (c), the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Council of the Inspectors General on Integrity and Efficiency, shall submit to the appropriate congressional committees a plan for the pilot program that outlines selection criteria and preliminary plans to implement the pilot program. (2) Briefing Before commencing a continuous independent evaluation of any agency under the pilot program established under subsection (a), the Director shall provide to the appropriate congressional committees a briefing on— (A) the selection of agencies to participate in the pilot program; and (B) processes and procedures to perform a continuous independent evaluation of agencies. (3) Pilot results Not later than 60 days after the final day of each year during which an agency participates in the pilot program established under subsection (a), the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Council of the Inspectors General on Integrity and Efficiency, shall submit to the appropriate congressional committees a report on the results of the pilot program for each agency that participates in the pilot program during that year. 302. Active cyber defensive pilot (a) Definition In this section, the term active defense technique (1) means an action taken on the systems of an entity to increase the security of information on the network of an agency by misleading an adversary; and (2) includes a honeypot, deception, or purposefully feeding false or misleading data to an adversary when the adversary is on the systems of the entity. (b) Study Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall perform a study on the use of active defense techniques to enhance the security of agencies, which shall include— (1) a review of legal restrictions on the use of different active cyber defense techniques on Federal networks; (2) an evaluation of— (A) the efficacy of a selection of active defense techniques determined by the Director of the Cybersecurity and Infrastructure Security Agency; and (B) factors that impact the efficacy of the active defense techniques evaluated under subparagraph (A); and (3) the development of a framework for the use of different active defense techniques by agencies. (c) Pilot program Not later than 180 days after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall establish a pilot program at not less than 2 agencies to implement, and assess the effectiveness of, not less than 1 active cyber defense technique. (d) Purpose The purpose of the pilot program established under subsection (c) shall be to— (1) identify any statutory or policy limitations on using active defense techniques; (2) understand the efficacy of using active defense techniques; and (3) implement the use of effective techniques to improve agency systems. (e) Plan Not later than 360 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall develop a plan to offer any active defense technique determined to be successful during the pilot program established under subsection (c) as a shared service to other agencies. (f) Reports Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— (1) provide to the appropriate congressional committees a briefing on— (A) the results of the study performed under subsection (b); and (B) the agencies selected to participate in the pilot program established under subsection (c); (2) submit to the appropriate congressional committees a report on the results of the pilot program established under subsection (c), including any recommendations developed from the results of the pilot program; and (3) submit to the appropriate congressional committees a copy of the plan developed under subsection (e). (g) Sunset (1) In general The requirements of this section shall terminate on the date that is 3 years after the date of enactment of this Act. (2) Authority to continue use of techniques Notwithstanding paragraph (1), after the date described in paragraph (1), the Director of the Cybersecurity and Infrastructure Security Agency may continue to offer any active defense technique determined to be successful during the pilot program established under subsection (c) as a shared service to agencies. 303. Security operations center as a service pilot (a) Purpose The purpose of this section is for the Cybersecurity and Infrastructure Security Agency to run a security operation center on behalf of another agency, alleviating the need to duplicate this function at every agency, and empowering a greater centralized cybersecurity capability. (b) Plan Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall develop a plan to establish a centralized Federal security operations center shared service offering within the Cybersecurity and Infrastructure Security Agency. (c) Contents The plan required under subsection (b) shall include considerations for— (1) collecting, organizing, and analyzing agency information system data in real time; (2) staffing and resources; and (3) appropriate interagency agreements, concepts of operations, and governance plans. (d) Pilot program (1) In general Not later than 180 days after the date on which the plan required under subsection (b) is developed, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, shall enter into a 1-year agreement with not less than 2 agencies to offer a security operations center as a shared service. (2) Additional agreements After the date on which the briefing required under subsection (e)(1) is provided, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, may enter into additional 1-year agreements described in paragraph (1) with agencies. (e) Briefing and report (1) Briefing Not later than 260 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives a briefing on the parameters of any 1-year agreements entered into under subsection (d)(1). (2) Report Not later than 90 days after the date on which the first 1-year agreement entered into under subsection (d) expires, the Director of the Cybersecurity and Infrastructure Security Agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives a report on— (A) the agreement; and (B) any additional agreements entered into with agencies under subsection (d). 1. Short title This Act may be cited as the Federal Information Security Modernization Act of 2021 2. Table of contents The table of contents for this Act is as follows: Sec. 1. Short title. Sec. 2. Table of contents. Sec. 3. Definitions. TITLE I—Updates to FISMA Sec. 101. Title 44 amendments. Sec. 102. Amendments to subtitle III of title 40. Sec. 103. Actions to enhance Federal incident response. Sec. 104. Additional guidance to agencies on FISMA updates. Sec. 105. Agency requirements to notify private sector entities impacted by incidents. TITLE II—Improving Federal cybersecurity Sec. 201. Mobile security standards. Sec. 202. Data and logging retention for incident response. Sec. 203. CISA agency advisors. Sec. 204. Federal penetration testing policy. Sec. 205. Ongoing threat hunting program. Sec. 206. Codifying vulnerability disclosure programs. Sec. 207. Implementing presumption of compromise and least privilege principles. Sec. 208. Automation reports. Sec. 209. Extension of Federal acquisition security council. Sec. 210. Council of the Inspectors General on Integrity and Efficiency dashboard. TITLE III—Risk-based budget model Sec. 301. Definitions. Sec. 302. Establishment of risk-based budget model. TITLE IV—Pilot programs to enhance Federal cybersecurity Sec. 401. Active cyber defensive study. Sec. 402. Security operations center as a service pilot. 3. Definitions In this Act, unless otherwise specified: (1) Additional cybersecurity procedure The term additional cybersecurity procedure (2) Agency The term agency (3) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Homeland Security and Governmental Affairs of the Senate (B) the Committee on Oversight and Reform of the House of Representatives (C) the Committee on Homeland Security of the House of Representatives. (4) Director The term Director (5) Incident The term incident (6) National security system The term national security system (7) Penetration test The term penetration test (8) Threat hunting The term threat hunting I Updates to FISMA 101. Title 44 amendments (a) Subchapter I amendments Subchapter I of chapter 35 (1) in section 3504— (A) in subsection (a)(1)(B)— (i) by striking clause (v) and inserting the following: (v) confidentiality, disclosure, and sharing of information; ; (ii) by redesignating clause (vi) as clause (vii); and (iii) by inserting after clause (v) the following: (vi) in consultation with the National Cyber Director and the Director of the Cybersecurity and Infrastructure Security Agency, security of information; and ; (B) in subsection (g), by striking paragraph (1) and inserting the following: (1) with respect to information collected or maintained by or for agencies— (A) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, disclosure, and sharing of the information; and (B) in consultation with the National Cyber Director and the Director of the Cybersecurity and Infrastructure Security Agency, develop and oversee policies, principles, standards, and guidelines on security of the information; and ; and (C) in subsection (h)(1)— (i) in the matter preceding subparagraph (A)— (I) by inserting the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, the Director (II) by inserting a comma before and the Administrator (ii) in subparagraph (A), by inserting security and information technology (2) in section 3505— (A) in paragraph (3) of the first subsection designated as subsection (c)— (i) in subparagraph (B)— (I) by inserting the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, and the Comptroller General (II) by striking and (ii) in subparagraph (C)(v), by striking the period at the end and inserting ; and (iii) by adding at the end the following: (D) maintained on a continual basis through the use of automation, machine-readable data, and scanning. ; and (B) by striking the second subsection designated as subsection (c); (3) in section 3506— (A) in subsection (b)(1)(C), by inserting , availability integrity (B) in subsection (h)(3), by inserting security, efficiency, (4) in section 3513— (A) by redesignating subsection (c) as subsection (d); and (B) by inserting after subsection (b) the following: (c) Each agency providing a written plan under subsection (b) shall provide any portion of the written plan addressing information security or cybersecurity to the Director of the Cybersecurity and Infrastructure Security Agency. . (b) Subchapter II definitions (1) In general Section 3552(b) of title 44, United States Code, is amended— (A) by redesignating paragraphs (1), (2), (3), (4), (5), (6), and (7) as paragraphs (2), (3), (4), (5), (6), (9), and (11), respectively; (B) by inserting before paragraph (2), as so redesignated, the following: (1) The term additional cybersecurity procedure ; (C) by inserting after paragraph (6), as so redesignated, the following: (7) The term high value asset (8) The term major incident ; (D) by inserting after paragraph (9), as so redesignated, the following: (10) The term penetration test (A) is conducted on an information system or a component of an information system; and (B) emulates an attack or other exploitation capability of a potential adversary, typically under specific constraints, in order to identify any vulnerabilities of an information system or a component of an information system that could be exploited. ; and (E) by inserting after paragraph (11), as so redesignated, the following: (12) The term shared service . (2) Conforming amendments (A) Homeland Security Act of 2002 Section 1001(c)(1)(A) of the Homeland Security Act of 2002 ( 6 U.S.C. 511(1)(A) section 3552(b)(5) section 3552(b) (B) Title 10 (i) Section 2222 Section 2222(i)(8) of title 10, United States Code, is amended by striking section 3552(b)(6)(A) section 3552(b)(9)(A) (ii) Section 2223 Section 2223(c)(3) of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (iii) Section 2315 Section 2315 of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (iv) Section 2339a Section 2339a(e)(5) of title 10, United States Code, is amended by striking section 3552(b)(6) section 3552(b) (C) High-Performance Computing Act of 1991 Section 207(a) of the High-Performance Computing Act of 1991 ( 15 U.S.C. 5527(a) section 3552(b)(6)(A)(i) section 3552(b)(9)(A)(i) (D) Internet of Things Cybersecurity Improvement Act of 2020 Section 3(5) of the Internet of Things Cybersecurity Improvement Act of 2020 ( 15 U.S.C. 278g–3a section 3552(b)(6) section 3552(b) (E) National Defense Authorization Act for Fiscal Year 2013 Section 933(e)(1)(B) of the National Defense Authorization Act for Fiscal Year 2013 ( 10 U.S.C. 2224 section 3542(b)(2) section 3552(b) (F) Ike Skelton National Defense Authorization Act for Fiscal Year 2011 The Ike Skelton National Defense Authorization Act for Fiscal Year 2011 ( Public Law 111–383 (i) in section 806(e)(5) ( 10 U.S.C. 2304 section 3542(b) section 3552(b) (ii) in section 931(b)(3) ( 10 U.S.C. 2223 section 3542(b)(2) section 3552(b) (iii) in section 932(b)(2) ( 10 U.S.C. 2224 section 3542(b)(2) section 3552(b) (G) E-Government Act of 2002 Section 301(c)(1)(A) of the E-Government Act of 2002 ( 44 U.S.C. 3501 section 3542(b)(2) section 3552(b) (H) National Institute of Standards and Technology Act Section 20 of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3 (i) in subsection (a)(2), by striking section 3552(b)(5) section 3552(b) (ii) in subsection (f)— (I) in paragraph (3), by striking section 3532(1) section 3552(b) (II) in paragraph (5), by striking section 3532(b)(2) section 3552(b) (c) Subchapter II amendments Subchapter II of chapter 35 (1) in section 3551— (A) by redesignating paragraphs (3), (4), (5), and (6) as paragraphs (4), (5), (6), and (7), respectively; (B) by inserting after paragraph (2) the following: (3) recognize the role of the Cybersecurity and Infrastructure Security Agency as the lead entity for operational cybersecurity coordination across the Federal Government; ; (C) in paragraph (5), as so redesignated, by striking diagnose and improve integrate, deliver, diagnose, and improve (D) in paragraph (6), as so redesignated, by striking and (E) in paragraph (7), as so redesignated, by striking the period at the end and inserting a semi colon; and (F) by adding at the end the following: (8) recognize that each agency has specific mission requirements and, at times, unique cybersecurity requirements to meet the mission of the agency; (9) recognize that each agency does not have the same resources to secure agency systems, and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone; and (10) recognize that— (A) a holistic Federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies; and (B) in accounting for the differences described in subparagraph (A) and ensuring overall Federal cybersecurity— (i) the Office of Management and Budget is the leader for policy development and oversight of Federal cybersecurity; (ii) the Cybersecurity and Infrastructure Security Agency is the leader for implementing operations at agencies; and (iii) the National Cyber Director is responsible for developing the overall cybersecurity strategy of the United States and advising the President on matters relating to cybersecurity. ; (2) in section 3553— (A) by striking the section heading and inserting Authority and functions of the Director and the Director of the Cybersecurity and Infrastructure Security Agency (B) in subsection (a)— (i) in paragraph (1), by inserting in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, developing and overseeing (ii) in paragraph (5)— (I) by inserting , in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, agency compliance (II) by striking and (iii) by adding at the end the following: (8) promoting, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology— (A) the use of automation to improve Federal cybersecurity and visibility with respect to the implementation of Federal cybersecurity; and (B) the use of presumption of compromise and least privilege principles to improve resiliency and timely response actions to incidents on Federal systems. ; (C) in subsection (b)— (i) by striking the subsection heading and inserting Cybersecurity and Infrastructure Security Agency (ii) in the matter preceding paragraph (1), by striking The Secretary, in consultation with the Director The Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director and the National Cyber Director (iii) in paragraph (2)— (I) in subparagraph (A), by inserting and reporting requirements under subchapter IV of this title section 3556 (II) in subparagraph (D), by striking the Director or Secretary the Director of the Cybersecurity and Infrastructure Security Agency (iv) in paragraph (5), by striking coordinating leading the coordination of (v) in paragraph (8), by striking the Secretary's discretion the Director of the Cybersecurity and Infrastructure Security Agency's discretion (vi) in paragraph (9), by striking as the Director or the Secretary, in consultation with the Director, as the Director of the Cybersecurity and Infrastructure Security Agency (D) in subsection (c)— (i) in the matter preceding paragraph (1), by striking each year each year during which agencies are required to submit reports under section 3554(c) (ii) by striking paragraph (1); (iii) by redesignating paragraphs (2), (3), and (4) as paragraphs (1), (2), and (3), respectively; (iv) in paragraph (3), as so redesignated, by striking and (v) by inserting after paragraph (3), as so redesignated the following: (4) a summary of each assessment of Federal risk posture performed under subsection (i); ; and (vi) in paragraph (5), by striking the period at the end and inserting ; and (E) by redesignating subsections (i), (j), (k), and (l) as subsections (j), (k), (l), and (m) respectively; (F) by inserting after subsection (h) the following: (i) Federal risk assessments On an ongoing and continuous basis, the Director of the Cybersecurity and Infrastructure Security Agency shall perform assessments of Federal risk posture using any available information on the cybersecurity posture of agencies, and brief the Director and National Cyber Director on the findings of those assessments including— (1) the status of agency cybersecurity remedial actions described in section 3554(b)(7); (2) any vulnerability information relating to the systems of an agency that is known by the agency; (3) analysis of incident information under section 3597; (4) evaluation of penetration testing performed under section 3559A; (5) evaluation of vulnerability disclosure program information under section 3559B; (6) evaluation of agency threat hunting results; (7) evaluation of Federal and non-Federal threat intelligence; (8) data on agency compliance with standards issued under section 11331 of title 40; (9) agency system risk assessments performed under section 3554(a)(1)(A); and (10) any other information the Director of the Cybersecurity and Infrastructure Security Agency determines relevant. ; and (G) in subsection (j), as so redesignated— (i) by striking regarding the specific (1) the specific ; (ii) in paragraph (1), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (2) the trends identified in the Federal risk assessment performed under subsection (i). ; and (H) by adding at the end the following: (n) Binding operational directives If the Director of the Cybersecurity and Infrastructure Security Agency issues a binding operational directive or an emergency directive under this section, not later than 2 days after the date on which the binding operational directive requires an agency to take an action, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the appropriate reporting entities the status of the implementation of the binding operational directive at the agency. ; (3) in section 3554— (A) in subsection (a)— (i) in paragraph (1)— (I) by redesignating subparagraphs (A), (B), and (C) as subparagraphs (B), (C), and (D), respectively; (II) by inserting before subparagraph (B), as so redesignated, the following: (A) on an ongoing and continuous basis, performing agency system risk assessments that— (i) identify and document the high value assets of the agency using guidance from the Director; (ii) evaluate the data assets inventoried under section 3511 for sensitivity to compromises in confidentiality, integrity, and availability; (iii) identify agency systems that have access to or hold the data assets inventoried under section 3511; (iv) evaluate the threats facing agency systems and data, including high value assets, based on Federal and non-Federal cyber threat intelligence products, where available; (v) evaluate the vulnerability of agency systems and data, including high value assets, including by analyzing— (I) the results of penetration testing performed by the Department of Homeland Security under section 3553(b)(9); (II) the results of penetration testing performed under section 3559A; (III) information provided to the agency through the vulnerability disclosure program of the agency under section 3559B; (IV) incidents; and (V) any other vulnerability information relating to agency systems that is known to the agency; (vi) assess the impacts of potential agency incidents to agency systems, data, and operations based on the evaluations described in clauses (ii) and (iv) and the agency systems identified under clause (iii); and (vii) assess the consequences of potential incidents occurring on agency systems that would impact systems at other agencies, including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system; ; (III) in subparagraph (B), as so redesignated, in the matter preceding clause (i), by striking providing information using information from the assessment conducted under subparagraph (A), providing, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, information (IV) in subparagraph (C), as so redesignated— (aa) in clause (ii) by inserting binding operational (bb) in clause (vi), by striking and (V) by adding at the end the following: (E) providing an update on the ongoing and continuous assessment performed under subparagraph (A)— (i) upon request, to the inspector general of the agency or the Comptroller General of the United States; and (ii) on a periodic basis, as determined by guidance issued by the Director but not less frequently than annually, to— (I) the Director; (II) the Director of the Cybersecurity and Infrastructure Security Agency; and (III) the National Cyber Director; (F) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and not less frequently than once every 3 years, performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of, or under the supervision of, the agency, which shall— (i) be completed considering the agency system risk assessment performed under subparagraph (A); and (ii) include a specific evaluation for high value assets; (G) not later than 30 days after completing the evaluation performed under subparagraph (F), providing the evaluation and an implementation plan, if applicable, for using additional cybersecurity procedures determined to be appropriate to— (i) the Director of the Cybersecurity and Infrastructure Security Agency; (ii) the Director; and (iii) the National Cyber Director; and (H) if the head of the agency determines there is need for additional cybersecurity procedures, ensuring that those additional cybersecurity procedures are reflected in the budget request of the agency in accordance with the risk-based cyber budget model developed pursuant to section 3553(a)(7); ; (ii) in paragraph (2)— (I) in subparagraph (A), by inserting in accordance with the agency system risk assessment performed under paragraph (1)(A) information systems (II) in subparagraph (B)— (aa) by striking in accordance with standards (i) standards ; and (bb) by adding at the end the following: (ii) the evaluation performed under paragraph (1)(F); and (iii) the implementation plan described in paragraph (1)(G); ; and (III) in subparagraph (D), by inserting , through the use of penetration testing, the vulnerability disclosure program established under section 3559B, and other means, periodically (iii) in paragraph (3)— (I) in subparagraph (A)— (aa) in clause (iii), by striking and (bb) in clause (iv), by adding and (cc) by adding at the end the following: (v) ensure that— (I) senior agency information security officers of component agencies carry out responsibilities under this subchapter, as directed by the senior agency information security officer of the agency or an equivalent official; and (II) senior agency information security officers of component agencies report to— (aa) the senior information security officer of the agency or an equivalent official; and (bb) the Chief Information Officer of the component agency or an equivalent official; ; and (iv) in paragraph (5), by inserting and the Director of the Cybersecurity and Infrastructure Security Agency on the effectiveness (B) in subsection (b)— (i) by striking paragraph (1) and inserting the following: (1) pursuant to subsection (a)(1)(A), performing ongoing and continuous agency system risk assessments, which may include using guidelines and automated tools consistent with standards and guidelines promulgated under section 11331 of title 40, as applicable; ; (ii) in paragraph (2)— (I) by striking subparagraph (B) and inserting the following: (B) comply with the risk-based cyber budget model developed pursuant to section 3553(a)(7); ; and (II) in subparagraph (D)— (aa) by redesignating clauses (iii) and (iv) as clauses (iv) and (v), respectively; (bb) by inserting after clause (ii) the following: (iii) binding operational directives and emergency directives promulgated by the Director of the Cybersecurity and Infrastructure Security Agency under section 3553; ; and (cc) in clause (iv), as so redesignated, by striking as determined by the agency; and (I) the agency risk assessment performed under subsection (a)(1)(A); and (II) the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section 11331(c)(1) of title 40; and ; (iii) in paragraph (5)(A), by inserting , including penetration testing, as appropriate, shall include testing (iv) in paragraph (6), by striking planning, implementing, evaluating, and documenting planning and implementing and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, evaluating and documenting (v) by redesignating paragraphs (7) and (8) as paragraphs (8) and (9), respectively; (vi) by inserting after paragraph (6) the following: (7) a process for providing the status of every remedial action and known system vulnerability to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable; ; and (vii) in paragraph (8)(C), as so redesignated— (I) by striking clause (ii) and inserting the following: (ii) notifying and consulting with the Federal information security incident center established under section 3556 pursuant to the requirements of section 3594; ; (II) by redesignating clause (iii) as clause (iv); (III) by inserting after clause (ii) the following: (iii) performing the notifications and other activities required under subchapter IV of this title; and ; and (IV) in clause (iv), as so redesignated— (aa) in subclause (I), by striking and relevant offices of inspectors general (bb) in subclause (II), by adding and (cc) by striking subclause (III); and (dd) by redesignating subclause (IV) as subclause (III); (C) in subsection (c)— (i) by redesignating paragraph (2) as paragraph (5); (ii) by striking paragraph (1) and inserting the following: (1) Biannual report Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2021 (A) summarizes the agency system risk assessment performed under subsection (a)(1)(A); (B) evaluates the adequacy and effectiveness of information security policies, procedures, and practices of the agency to address the risks identified in the agency system risk assessment performed under subsection (a)(1)(A); (C) summarizes the evaluation and implementation plans described in subparagraphs (F) and (G) of subsection (a)(1) and whether those evaluation and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency; and (D) summarizes the status of remedial actions identified by inspector general of the agency, the Comptroller General of the United States, and any other source determined appropriate by the head of the agency. (2) Unclassified reports Each report submitted under paragraph (1)— (A) shall be, to the greatest extent practicable, in an unclassified and otherwise uncontrolled form; and (B) may include a classified annex. (3) Access to information The head of an agency shall ensure that, to the greatest extent practicable, information is included in the unclassified form of the report submitted by the agency under paragraph (2)(A). (4) Briefings During each year during which a report is not required to be submitted under paragraph (1), the Director shall provide to the congressional committees described in paragraph (1) a briefing summarizing current agency and Federal risk postures. ; and (iii) in paragraph (5), as so redesignated, by inserting including the reporting procedures established under section 11315(d) of title 40 and subsection (a)(3)(A)(v) of this section (D) in subsection (d)(1), in the matter preceding subparagraph (A), by inserting and the Director of the Cybersecurity and Infrastructure Security Agency the Director (4) in section 3555— (A) in the section heading, by striking Annual independent Independent (B) in subsection (a)— (i) in paragraph (1), by inserting during which a report is required to be submitted under section 3553(c), Each year (ii) in paragraph (2)(A), by inserting , including by penetration testing and analyzing the vulnerability disclosure program of the agency information systems (iii) by adding at the end the following: (3) An evaluation under this section may include recommendations for improving the cybersecurity posture of the agency. ; (C) in subsection (b)(1), by striking annual (D) in subsection (e)(1), by inserting during which a report is required to be submitted under section 3553(c) Each year (E) by striking subsection (f) and inserting the following: (f) Protection of information (1) Agencies, evaluators, and other recipients of information that, if disclosed, may cause grave harm to the efforts of Federal information security officers, including the appropriate congressional committees, shall take appropriate steps to ensure the protection of that information, including safeguarding the information from public disclosure. (2) The protections required under paragraph (1) shall be commensurate with the risk and comply with all applicable laws and regulations. (3) With respect to information that is not related to national security systems, agencies and evaluators shall make a summary of the information unclassified and publicly available, including information that does not identify— (A) specific information system incidents; or (B) specific information system vulnerabilities. ; (F) in subsection (g)(2)— (i) by striking this subsection shall (A) shall ; (ii) in subparagraph (A), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (B) identify any entity that performs an independent evaluation under subsection (b). ; and (G) by striking subsection (j) and inserting the following: (j) Guidance (1) In general The Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the Chief Information Officers Council, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices (2) Priorities The guidance developed under paragraph (1) shall prioritize the identification of— (A) the most common threat patterns experienced by each agency; (B) the security controls that address the threat patterns described in subparagraph (A); and (C) any other security risks unique to the networks of each agency. ; and (5) in section 3556(a)— (A) in the matter preceding paragraph (1), by inserting within the Cybersecurity and Infrastructure Security Agency incident center (B) in paragraph (4), by striking 3554(b) 3554(a)(1)(A) (d) Conforming amendments (1) Table of sections The table of sections for chapter 35 (A) by striking the item relating to section 3553 and inserting the following: 3553. Authority and functions of the Director and the Director of the Cybersecurity and Infrastructure Security Agency. ; and (B) by striking the item relating to section 3555 and inserting the following: 3555. Independent evaluation. . (2) OMB reports Section 226(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1524(c) (A) in paragraph (1)(B), in the matter preceding clause (i), by striking annually thereafter thereafter during the years during which a report is required to be submitted under section 3553(c) of title 44, United States Code (B) in paragraph (2)(B), in the matter preceding clause (i)— (i) by striking annually thereafter thereafter during the years during which a report is required to be submitted under section 3553(c) of title 44, United States Code (ii) by striking the report required under section 3553(c) of title 44, United States Code that report (3) NIST responsibilities Section 20(d)(3)(B) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(d)(3)(B) annual (e) Federal system incident response (1) In general Chapter 35 IV Federal System Incident Response 3591. Definitions (a) In general Except as provided in subsection (b), the definitions under sections 3502 and 3552 shall apply to this subchapter. (b) Additional definitions As used in this subchapter: (1) Appropriate reporting entities The term appropriate reporting entities (A) the majority and minority leaders of the Senate; (B) the Speaker and minority leader of the House of Representatives; (C) the Committee on Homeland Security and Governmental Affairs of the Senate; (D) the Committee on Oversight and Reform of the House of Representatives; (E) the Committee on Homeland Security of the House of Representatives; (F) the appropriate authorization and appropriations committees of Congress; (G) the Director; (H) the Director of the Cybersecurity and Infrastructure Security Agency; (I) the National Cyber Director; (J) the Comptroller General of the United States; and (K) the inspector general of any impacted agency. (2) Awardee The term awardee (A) means a person, business, or other entity that receives a grant from, or is a party to a cooperative agreement with, an agency; and (B) includes any subgrantee of a person, business, or other entity described in subparagraph (A). (3) Breach The term breach (A) a compromise of the security, confidentiality, or integrity of data in electronic form that results in unauthorized access to, or an acquisition of, personal information; or (B) a loss of data in electronic form that results in unauthorized access to, or an acquisition of, personal information. (4) Contractor The term contractor (A) a prime contractor of an agency or a subcontractor of a prime contractor of an agency; and (B) any person or business that collects or maintains information, including personally identifiable information, on behalf of an agency. (5) Federal information The term Federal information (6) Federal information system The term Federal information system (7) Intelligence community The term intelligence community 50 U.S.C. 3003 (8) Nationwide consumer reporting agency The term nationwide consumer reporting agency 15 U.S.C. 1681a(p) (9) Vulnerability disclosure The term vulnerability disclosure 3592. Notification of breach (a) Notification As expeditiously as practicable and without unreasonable delay, and in any case not later than 45 days after an agency has a reasonable basis to conclude that a breach has occurred, the head of the agency, in consultation with a senior privacy officer of the agency, shall— (1) determine whether notice to any individual potentially affected by the breach is appropriate based on an assessment of the risk of harm to the individual that considers— (A) the nature and sensitivity of the personally identifiable information affected by the breach; (B) the likelihood of access to and use of the personally identifiable information affected by the breach; (C) the type of breach; and (D) any other factors determined by the Director; and (2) as appropriate, provide written notice in accordance with subsection (b) to each individual potentially affected by the breach— (A) to the last known mailing address of the individual; or (B) through an appropriate alternative method of notification that the head of the agency or a designated senior-level individual of the agency selects based on factors determined by the Director. (b) Contents of notice Each notice of a breach provided to an individual under subsection (a)(2) shall include— (1) a brief description of the rationale for the determination that notice should be provided under subsection (a); (2) if possible, a description of the types of personally identifiable information affected by the breach; (3) contact information of the agency that may be used to ask questions of the agency, which— (A) shall include an e-mail address or another digital contact mechanism; and (B) may include a telephone number or a website; (4) information on any remedy being offered by the agency; (5) any applicable educational materials relating to what individuals can do in response to a breach that potentially affects their personally identifiable information, including relevant information to contact Federal law enforcement agencies and each nationwide consumer reporting agency; and (6) any other appropriate information, as determined by the head of the agency or established in guidance by the Director. (c) Delay of notification (1) In general The Attorney General, the Director of National Intelligence, or the Secretary of Homeland Security may delay a notification required under subsection (a) if the notification would— (A) impede a criminal investigation or a national security activity; (B) reveal sensitive sources and methods; (C) cause damage to national security; or (D) hamper security remediation actions. (2) Documentation (A) In general Any delay under paragraph (1) shall be reported in writing to the Director, the Attorney General, the Director of National Intelligence, the Secretary of Homeland Security, the Director of the Cybersecurity and Infrastructure Security Agency, and the head of the agency and the inspector general of the agency that experienced the breach. (B) Contents A report required under subparagraph (A) shall include a written statement from the entity that delayed the notification explaining the need for the delay. (C) Form The report required under subparagraph (A) shall be unclassified but may include a classified annex. (3) Renewal A delay under paragraph (1) shall be for a period of 60 days and may be renewed. (d) Update notification If an agency determines there is a significant change in the reasonable basis to conclude that a breach occurred, a significant change to the determination made under subsection (a)(1), or that it is necessary to update the details of the information provided to impacted individuals as described in subsection (b), the agency shall as expeditiously as practicable and without unreasonable delay, and in any case not later than 30 days after such a determination, notify each individual who received a notification pursuant to subsection (a) of those changes. (e) Exemption from notification (1) In general The head of an agency, in consultation with the inspector general of the agency, may request an exemption from the Director from complying with the notification requirements under subsection (a) if the information affected by the breach is determined by an independent evaluation to be unreadable, including, as appropriate, instances in which the information is— (A) encrypted; and (B) determined by the Director of the Cybersecurity and Infrastructure Security Agency to be of sufficiently low risk of exposure. (2) Approval The Director shall determine whether to grant an exemption requested under paragraph (1) in consultation with— (A) the Director of the Cybersecurity and Infrastructure Security Agency; and (B) the Attorney General. (3) Documentation Any exemption granted by the Director under paragraph (1) shall be reported in writing to the head of the agency and the inspector general of the agency that experienced the breach and the Director of the Cybersecurity and Infrastructure Security Agency. (f) Rule of construction Nothing in this section shall be construed to limit— (1) the Director from issuing guidance relating to notifications or the head of an agency from notifying individuals potentially affected by breaches that are not determined to be major incidents; or (2) the Director from issuing guidance relating to notifications of major incidents or the head of an agency from providing more information than described in subsection (b) when notifying individuals potentially affected by breaches. 3593. Congressional and Executive Branch reports (a) Initial report (1) In general Not later than 72 hours after an agency has a reasonable basis to conclude that a major incident occurred, the head of the agency impacted by the major incident shall submit to the appropriate reporting entities a written report and, to the extent practicable, provide a briefing to the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Reform of the House of Representatives, the Committee on Homeland Security of the House of Representatives, and the appropriate authorization and appropriations committees of Congress, taking into account— (A) the information known at the time of the report; (B) the sensitivity of the details associated with the major incident; and (C) the classification level of the information contained in the report. (2) Contents A report required under paragraph (1) shall include, in a manner that excludes or otherwise reasonably protects personally identifiable information and to the extent permitted by applicable law, including privacy and statistical laws— (A) a summary of the information available about the major incident, including how the major incident occurred, information indicating that the major incident may be a breach, and information relating to the major incident as a breach, based on information available to agency officials as of the date on which the agency submits the report; (B) if applicable, a description and any associated documentation of any circumstances necessitating a delay in or exemption to notification to individuals potentially affected by the major incident under subsection (c) or (e) of section 3592; and (C) if applicable, an assessment of the impacts to the agency, the Federal Government, or the security of the United States, based on information available to agency officials on the date on which the agency submits the report. (b) Supplemental report Within a reasonable amount of time, but not later than 30 days after the date on which an agency submits a written report under subsection (a), the head of the agency shall provide to the appropriate reporting entities written updates on the major incident and, to the extent practicable, provide a briefing to the congressional committees described in subsection (a)(1), including summaries of— (1) vulnerabilities, means by which the major incident occurred, and impacts to the agency relating to the major incident; (2) any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred; (3) the status of compliance of the affected information system with applicable security requirements at the time of the major incident; (4) an estimate of the number of individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update; (5) an assessment of the risk of harm to individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update; (6) an update to the assessment of the risk to agency operations, or to impacts on other agency or non-Federal entity operations, affected by the major incident based on information available to agency officials as of the date on which the agency provides the update; and (7) the detection, response, and remediation actions of the agency, including any support provided by the Cybersecurity and Infrastructure Security Agency under section 3594(d) and status updates on the notification process described in section 3592(a), including any delay or exemption described in subsection (c) or (e), respectively, of section 3592, if applicable. (c) Update report If the agency determines that there is any significant change in the understanding of the agency of the scope, scale, or consequence of a major incident for which an agency submitted a written report under subsection (a), the agency shall provide an updated report to the appropriate reporting entities that includes information relating to the change in understanding. (d) Annual report Each agency shall submit as part of the annual report required under section 3554(c)(1) of this title a description of each major incident that occurred during the 1-year period preceding the date on which the report is submitted. (e) Delay and exemption report (1) In general The Director shall submit to the appropriate notification entities an annual report on all notification delays and exemptions granted pursuant to subsections (c) and (d) of section 3592. (2) Component of other report The Director may submit the report required under paragraph (1) as a component of the annual report submitted under section 3597(b). (f) Report delivery Any written report required to be submitted under this section may be submitted in a paper or electronic format. (g) Threat briefing (1) In general Not later than 7 days after the date on which an agency has a reasonable basis to conclude that a major incident occurred, the head of the agency, jointly with the National Cyber Director and any other Federal entity determined appropriate by the National Cyber Director, shall provide a briefing to the congressional committees described in subsection (a)(1) on the threat causing the major incident. (2) Components The briefing required under paragraph (1)— (A) shall, to the greatest extent practicable, include an unclassified component; and (B) may include a classified component. (h) Rule of construction Nothing in this section shall be construed to limit— (1) the ability of an agency to provide additional reports or briefings to Congress; or (2) Congress from requesting additional information from agencies through reports, briefings, or other means. 3594. Government information sharing and incident response (a) In general (1) Incident reporting The head of each agency shall provide any information relating to any incident, whether the information is obtained by the Federal Government directly or indirectly, to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget. (2) Contents A provision of information relating to an incident made by the head of an agency under paragraph (1) shall— (A) include detailed information about the safeguards that were in place when the incident occurred; (B) whether the agency implemented the safeguards described in subparagraph (A) correctly; (C) in order to protect against a similar incident, identify— (i) how the safeguards described in subparagraph (A) should be implemented differently; and (ii) additional necessary safeguards; and (D) include information to aid in incident response, such as— (i) a description of the affected systems or networks; (ii) the estimated dates of when the incident occurred; and (iii) information that could reasonably help identify the party that conducted the incident. (3) Information sharing To the greatest extent practicable, the Director of the Cybersecurity and Infrastructure Security Agency shall share information relating to an incident with any agencies that may be impacted by the incident. (4) National security systems Each agency operating or exercising control of a national security system shall share information about incidents with the Director of the Cybersecurity and Infrastructure Security Agency to the extent consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the President. (b) Compliance The information provided under subsection (a) shall take into account the level of classification of the information and any information sharing limitations and protections, such as limitations and protections relating to law enforcement, national security, privacy, statistical confidentiality, or other factors determined by the Director (c) Incident response Each agency that has a reasonable basis to conclude that a major incident occurred involving Federal information in electronic medium or form, as defined by the Director and not involving a national security system, regardless of delays from notification granted for a major incident, shall coordinate with the Cybersecurity and Infrastructure Security Agency regarding— (1) incident response and recovery; and (2) recommendations for mitigating future incidents. 3595. Responsibilities of contractors and awardees (a) Notification (1) In general Unless otherwise specified in a contract, grant, or cooperative agreement, any contractor or awardee of an agency shall report to the agency within the same amount of time such agency is required to report an incident to the Cybersecurity and Infrastructure Security Agency, if the contractor or awardee has a reasonable basis to conclude that— (A) an incident or breach has occurred with respect to Federal information collected, used, or maintained by the contractor or awardee in connection with the contract, grant, or cooperative agreement of the contractor or awardee; (B) an incident or breach has occurred with respect to a Federal information system used or operated by the contractor or awardee in connection with the contract, grant, or cooperative agreement of the contractor or awardee; or (C) the contractor or awardee has received information from the agency that the contractor or awardee is not authorized to receive in connection with the contract, grant, or cooperative agreement of the contractor or awardee. (2) Procedures (A) Major incident Following a report of a breach or major incident by a contractor or awardee under paragraph (1), the agency, in consultation with the contractor or awardee, shall carry out the requirements under sections 3592, 3593, and 3594 with respect to the major incident. (B) Incident Following a report of an incident by a contractor or awardee under paragraph (1), an agency, in consultation with the contractor or awardee, shall carry out the requirements under section 3594 with respect to the incident. (b) Effective date This section shall apply on and after the date that is 1 year after the date of enactment of the Federal Information Security Modernization Act of 2021 3596. Training (a) Covered individual defined In this section, the term covered individual (b) Requirement The head of each agency shall develop training for covered individuals on how to identify and respond to an incident, including— (1) the internal process of the agency for reporting an incident; and (2) the obligation of a covered individual to report to the agency a confirmed major incident and any suspected incident involving information in any medium or form, including paper, oral, and electronic. (c) Inclusion in annual training The training developed under subsection (b) may be included as part of an annual privacy or security awareness training of an agency. 3597. Analysis and report on Federal incidents (a) Analysis of federal incidents (1) Quantitative and qualitative analyses The Director of the Cybersecurity and Infrastructure Security Agency shall develop, in consultation with the Director and the National Cyber Director, and perform continuous monitoring and quantitative and qualitative analyses of incidents at agencies, including major incidents, including— (A) the causes of incidents, including— (i) attacker tactics, techniques, and procedures; and (ii) system vulnerabilities, including zero days, unpatched systems, and information system misconfigurations; (B) the scope and scale of incidents at agencies; (C) cross Federal Government root causes of incidents at agencies; (D) agency incident response, recovery, and remediation actions and the effectiveness of those actions, as applicable; and (E) lessons learned and recommendations in responding to, recovering from, remediating, and mitigating future incidents. (2) Automated analysis The analyses developed under paragraph (1) shall, to the greatest extent practicable, use machine readable data, automation, and machine learning processes. (3) Sharing of data and analysis (A) In general The Director shall share on an ongoing basis the analyses required under this subsection with agencies and the National Cyber Director to— (i) improve the understanding of cybersecurity risk of agencies; and (ii) support the cybersecurity improvement efforts of agencies. (B) Format In carrying out subparagraph (A), the Director shall share the analyses— (i) in human-readable written products; and (ii) to the greatest extent practicable, in machine-readable formats in order to enable automated intake and use by agencies. (b) Annual report on Federal incidents Not later than 2 years after the date of enactment of this section, and not less frequently than annually thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director and other Federal agencies as appropriate, shall submit to the appropriate notification entities a report that includes— (1) a summary of causes of incidents from across the Federal Government that categorizes those incidents as incidents or major incidents; (2) the quantitative and qualitative analyses of incidents developed under subsection (a)(1), including specific analysis of breaches, on an agency-by-agency basis and comprehensively across the Federal Government; and (3) an annex for each agency that includes— (A) a description of each major incident; and (B) the total number of compromises of the agency. (c) Publication A version of each report submitted under subsection (b) shall be made publicly available on the website of the Cybersecurity and Infrastructure Security Agency during the year in which the report is submitted. (d) Information provided by agencies (1) In general The analysis required under subsection (a) and each report submitted under subsection (b) shall use information provided by agencies under section 3594(a). (2) Noncompliance reports (A) In general Subject to subparagraph (B), during any year during which the head of an agency does not provide data for an incident to the Cybersecurity and Infrastructure Security Agency in accordance with section 3594(a), the head of the agency, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Director, shall submit to the appropriate reporting entities a report that includes— (i) data for the incident; and (ii) the information described in subsection (b) with respect to the agency. (B) Exception for national security systems The head of an agency that owns or exercises control of a national security system shall not include data for an incident that occurs on a national security system in any report submitted under subparagraph (A). (3) National security system reports (A) In general Annually, the head of an agency that operates or exercises control of a national security system shall submit a report that includes the information described in subsection (b) with respect to the agency to the extent that the submission is consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the President to— (i) the the majority and minority leaders of the Senate, (ii) the Speaker and minority leader of the House of Representatives; (iii) the Committee on Homeland Security and Governmental Affairs of the Senate; (iv) the Select Committee on Intelligence of the Senate; (v) the Committee on Armed Services of the Senate; (vi) the Committee on Oversight and Reform of the House of Representatives; (vii) the Committee on Homeland Security of the House of Representatives; (viii) the Permanent Select Committee on Intelligence of the House of Representatives; and (ix) the Committee on Armed Services of the House of Representatives. (B) Classified form A report required under subparagraph (A) may be submitted in a classified form. (e) Requirement for compiling information In publishing the public report required under subsection (c), the Director of the Cybersecurity and Infrastructure Security Agency shall sufficiently compile information such that no specific incident of an agency can be identified, except with the concurrence of the Director of the Office of Management and Budget and in consultation with the impacted agency. 3598. Major incident definition (a) In general Not later than 180 days after the date of enactment of the Federal Information Security Modernization Act of 2021 major incident (b) Requirements With respect to the guidance issued under subsection (a), the definition of the term major incident (1) include, with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency— (A) any incident the head of the agency determines is likely to have an impact on— (i) the national security, homeland security, or economic security of the United States; or (ii) the civil liberties or public health and safety of the people of the United States; (B) any incident the head of the agency determines likely to result in an inability for the agency, a component of the agency, or the Federal Government, to provide 1 or more critical services; (C) any incident that the head of an agency, in consultation with a senior privacy officer of the agency, determines is likely to have a significant privacy impact on 1 or more individual; (D) any incident that the head of the agency, in consultation with a senior privacy official of the agency, determines is likely to have a substantial privacy impact on a significant number of individuals; (E) any incident the head of the agency determines impacts the operations of a high value asset owned or operated by the agency; (F) any incident involving the exposure of sensitive agency information to a foreign entity, such as the communications of the head of the agency, the head of a component of the agency, or the direct reports of the head of the agency or the head of a component of the agency; and (G) any other type of incident determined appropriate by the Director; (2) stipulate that the National Cyber Director shall declare a major incident at each agency impacted by an incident if the Director of the Cybersecurity and Infrastructure Security Agency determines that an incident— (A) occurs at not less than 2 agencies; and (B) is enabled by— (i) a common technical root cause, such as a supply chain compromise, a common software or hardware vulnerability; or (ii) the related activities of a common threat actor; and (3) stipulate that, in determining whether an incident constitutes a major incident because that incident— (A) is any incident described in paragraph (1), the head of an agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency; (B) is an incident described in paragraph (1)(A), the head of the agency shall consult with the National Cyber Director; and (C) is an incident described in subparagraph (C) or (D) of paragraph (1), the head of the agency shall consult with— (i) the Privacy and Civil Liberties Oversight Board; and (ii) the Executive Director of the Federal Trade Commission. (c) Significant number of individuals In determining what constitutes a significant number of individuals under subsection (b)(1)(D), the Director— (1) may determine a threshold for a minimum number of individuals that constitutes a significant amount; and (2) may not determine a threshold described in paragraph (1) that exceeds 5,000 individuals. (d) Evaluation and updates Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2021 (1) an update, if necessary, to the guidance issued under subsection (a); (2) the definition of the term major incident (3) an explanation of, and the analysis that led to, the definition described in paragraph (2). . (2) Clerical amendment The table of sections for chapter 35 SUBCHAPTER IV—Federal System Incident Response 3591. Definitions. 3592. Notification of breach. 3593. Congressional and Executive Branch reports. 3594. Government information sharing and incident response. 3595. Responsibilities of contractors and awardees. 3596. Training. 3597. Analysis and report on Federal incidents. 3598. Major incident definition. . 102. Amendments to subtitle III of title 40 (a) Information Technology Modernization Centers of Excellence Program Act Section 2(c)(4)(A)(ii) of the Information Technology Modernization Centers of Excellence Program Act ( 40 U.S.C. 11301 , which shall be provided in coordination with the Director of the Cybersecurity and Infrastructure Security Agency. (b) Modernizing Government Technology Subtitle G of title X of Division A of the National Defense Authorization Act for Fiscal Year 2018 ( 40 U.S.C. 11301 (1) in section 1077(b)— (A) in paragraph (5)(A), by inserting improving the cybersecurity of systems and cost savings activities (B) in paragraph (7)— (i) in the paragraph heading, by striking cio CIO (ii) by striking In evaluating projects (A) Consideration of guidance In evaluating projects ; (iii) in subparagraph (A), as so designated, by striking under section 1094(b)(1) by the Director (iv) by adding at the end the following: (B) Consultation In using funds under paragraph (3)(A), the Chief Information Officer of the covered agency shall consult with the necessary stakeholders to ensure the project appropriately addresses cybersecurity risks, including the Director of the Cybersecurity and Infrastructure Security Agency, as appropriate. ; and (2) in section 1078— (A) by striking subsection (a) and inserting the following: (a) Definitions In this section: (1) Agency The term agency (2) High value asset The term high value asset ; (B) in subsection (b), by adding at the end the following: (8) Proposal evaluation The Director shall— (A) give consideration for the use of amounts in the Fund to improve the security of high value assets; and (B) require that any proposal for the use of amounts in the Fund includes a cybersecurity plan, including a supply chain risk management plan, to be reviewed by the member of the Technology Modernization Board described in subsection (c)(5)(C). ; and (C) in subsection (c)— (i) in paragraph (2)(A)(i), by inserting , including a consideration of the impact on high value assets operational risks (ii) in paragraph (5)— (I) in subparagraph (A), by striking and (II) in subparagraph (B), by striking the period at the end and inserting and (III) by adding at the end the following: (C) a senior official from the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, appointed by the Director. ; and (iii) in paragraph (6)(A), by striking shall be— 4 employees shall be 4 employees (c) Subchapter I Subchapter I of subtitle III of title 40, United States Code, is amended— (1) in section 11302— (A) in subsection (b), by striking use, security, and disposal of use, and disposal of, and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, promote and improve the security of, (B) in subsection (c)— (i) in paragraph (3)— (I) in subparagraph (A)— (aa) by striking including data which shall— (i) include data ; (bb) in clause (i), as so designated, by striking , and performance security, and performance; and (cc) by adding at the end the following: (ii) specifically denote cybersecurity funding under the risk-based cyber budget model developed pursuant to section 3553(a)(7) of title 44. ; and (II) in subparagraph (B), adding at the end the following: (iii) The Director shall provide to the National Cyber Director any cybersecurity funding information described in subparagraph (A)(ii) that is provided to the Director under clause (ii) of this subparagraph. ; and (ii) in paragraph (4)(B), in the matter preceding clause (i), by inserting not later than 30 days after the date on which the review under subparagraph (A) is completed, the Administrator (C) in subsection (f)— (i) by striking heads of executive agencies to develop (1) develop ; (ii) in paragraph (1), as so designated, by striking the period at the end and inserting ; and (iii) by adding at the end the following: (2) consult with the Director of the Cybersecurity and Infrastructure Security Agency for the development and use of supply chain security best practices. ; and (D) in subsection (h), by inserting , including cybersecurity performances, the performances (2) in section 11303(b)— (A) in paragraph (2)(B)— (i) in clause (i), by striking or (ii) in clause (ii), by adding or (iii) by adding at the end the following: (iii) whether the function should be performed by a shared service offered by another executive agency; ; and (B) in paragraph (5)(B)(i), by inserting , while taking into account the risk-based cyber budget model developed pursuant to section 3553(a)(7) of title 44 title 31 (d) Subchapter II Subchapter II of subtitle III of title 40, United States Code, is amended— (1) in section 11312(a), by inserting , including security risks managing the risks (2) in section 11313(1), by striking efficiency and effectiveness efficiency, security, and effectiveness (3) in section 11315, by adding at the end the following: (d) Component agency chief information officers The Chief Information Officer or an equivalent official of a component agency shall report to— (1) the Chief Information Officer designated under section 3506(a)(2) of title 44 or an equivalent official of the agency of which the component agency is a component; and (2) the head of the component agency. ; (4) in section 11317, by inserting security, or schedule (5) in section 11319(b)(1), in the paragraph heading, by striking CIOS Chief Information Officers (e) Subchapter III Section 11331 of title 40, United States Code, is amended— (1) in subsection (a), by striking section 3532(b)(1) section 3552(b) (2) in subsection (b)(1)(A)— (A) by striking in consultation in coordination (B) by striking the Secretary of Homeland Security the Director of the Cybersecurity and Infrastructure Security Agency (3) by striking subsection (c) and inserting the following: (c) Application of more stringent standards (1) In general The head of an agency shall— (A) evaluate, in consultation with the senior agency information security officers, the need to employ standards for cost-effective, risk-based information security for all systems, operations, and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the Director under this section, if such standards contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Director; and (B) to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph (A) are necessary, employ those standards. (2) Evaluation of more stringent standards In evaluating the need to employ more stringent standards under paragraph (1), the head of an agency shall consider available risk information, such as— (A) the status of cybersecurity remedial actions of the agency; (B) any vulnerability information relating to agency systems that is known to the agency; (C) incident information of the agency; (D) information from— (i) penetration testing performed under section 3559A of title 44; and (ii) information from the vulnerability disclosure program established under section 3559B of title 44; (E) agency threat hunting results under section 205 of the Federal Information Security Modernization Act of 2021; (F) Federal and non-Federal threat intelligence; (G) data on compliance with standards issued under this section; (H) agency system risk assessments performed under section 3554(a)(1)(A) of title 44; and (I) any other information determined relevant by the head of the agency. ; (4) in subsection (d)(2)— (A) in the paragraph heading, by striking Notice and comment Consultation, notice, and comment (B) by inserting promulgate, significantly modify (C) by striking shall be made after the public is given an opportunity to comment on the Director’s proposed decision. (A) for a decision to significantly modify or not promulgate such a proposed standard, after the public is given an opportunity to comment on the Director’s proposed decision; (B) in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency; (C) considering the Federal risk assessments performed under section 3553(i) of title 44; and (D) considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard. ; and (5) by adding at the end the following: (e) Review of office of management and budget guidance and policy (1) Conduct of review (A) In general Not less frequently than once every 3 years, the Director of the Office of Management and Budget, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency shall review the efficacy of the guidance and policy promulgated by the Director in reducing cybersecurity risks, including an assessment of the requirements for agencies to report information to the Director, and determine whether any changes to that guidance or policy is appropriate. (B) Federal risk assessments In conducting the review described in subparagraph (A), the Director shall consider the Federal risk assessments performed under section 3553(i) of title 44. (2) Updated guidance Not later than 90 days after the date on which a review is completed under paragraph (1), the Director of the Office of Management and Budget shall issue updated guidance or policy to agencies determined appropriate by the Director, based on the results of the review. (3) Public report Not later than 30 days after the date on which a review is completed under paragraph (1), the Director of the Office of Management and Budget shall make publicly available a report that includes— (A) an overview of the guidance and policy promulgated under this section that is currently in effect; (B) the cybersecurity risk mitigation, or other cybersecurity benefit, offered by each guidance or policy document described in subparagraph (A); and (C) a summary of the guidance or policy to which changes were determined appropriate during the review and what the changes are anticipated to include. (4) Congressional briefing Not later than 30 days after the date on which a review is completed under paragraph (1), the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a briefing on the review. (f) Automated standard implementation verification When the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(a) . 103. Actions to enhance Federal incident response (a) Responsibilities of the cybersecurity and infrastructure security agency (1) In general Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall— (A) develop a plan for the development of the analysis required under section 3597(a) of title 44, United States Code, as added by this Act, and the report required under subsection (b) of that section that includes— (i) a description of any challenges the Director anticipates encountering; and (ii) the use of automation and machine-readable formats for collecting, compiling, monitoring, and analyzing data; and (B) provide to the appropriate congressional committees a briefing on the plan developed under subparagraph (A). (2) Briefing Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the appropriate congressional committees a briefing on— (A) the execution of the plan required under paragraph (1)(A); and (B) the development of the report required under section 3597(b) of title 44, United States Code, as added by this Act. (b) Responsibilities of the director of the office of management and budget (1) FISMA Section 2 of the Federal Information Security Modernization Act of 2014 ( 44 U.S.C. 3554 (A) by striking subsection (b); and (B) by redesignating subsections (c) through (f) as subsections (b) through (e), respectively. (2) Incident data sharing (A) In general The Director shall develop guidance, to be updated not less frequently than once every 2 years, on the content, timeliness, and format of the information provided by agencies under section 3594(a) of title 44, United States Code, as added by this Act. (B) Requirements The guidance developed under subparagraph (A) shall— (i) prioritize the availability of data necessary to understand and analyze— (I) the causes of incidents; (II) the scope and scale of incidents within the environments and systems of an agency; (III) a root cause analysis of incidents that— (aa) are common across the Federal Government; or (bb) have a Government-wide impact; (IV) agency response, recovery, and remediation actions and the effectiveness of those actions; and (V) the impact of incidents; (ii) enable the efficient development of— (I) lessons learned and recommendations in responding to, recovering from, remediating, and mitigating future incidents; and (II) the report on Federal incidents required under section 3597(b) of title 44, United States Code, as added by this Act; (iii) include requirements for the timeliness of data production; and (iv) include requirements for using automation and machine-readable data for data sharing and availability. (3) Guidance on responding to information requests Not later than 1 year after the date of enactment of this Act, the Director shall develop guidance for agencies to implement the requirement under section 3594(c) of title 44, United States Code, as added by this Act, to provide information to other agencies experiencing incidents. (4) Standard guidance and templates Not later than 1 year after the date of enactment of this Act, the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop guidance and templates, to be reviewed and, if necessary, updated not less frequently than once every 2 years, for use by Federal agencies in the activities required under sections 3592, 3593, and 3596 of title 44, United States Code, as added by this Act. (5) Contractor and awardee guidance (A) In general Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Secretary of Homeland Security, the Secretary of Defense, the Administrator of General Services, and the heads of other agencies determined appropriate by the Director, shall issue guidance to Federal agencies on how to deconflict, to the greatest extent practicable, existing regulations, policies, and procedures relating to the responsibilities of contractors and awardees established under section 3595 of title 44, United States Code, as added by this Act. (B) Existing processes To the greatest extent practicable, the guidance issued under subparagraph (A) shall allow contractors and awardees to use existing processes for notifying Federal agencies of incidents involving information of the Federal Government. (6) Updated briefings Not less frequently than once every 2 years, the Director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs (2) through (4). (c) Update to the privacy act of 1974 Section 552a(b) of title 5, United States Code (commonly known as the Privacy Act of 1974 (1) in paragraph (11), by striking or (2) in paragraph (12), by striking the period at the end and inserting ; or (3) by adding at the end the following: (13) to another agency in furtherance of a response to an incident (as defined in section 3552 of title 44) and pursuant to the information sharing requirements in section 3594 of title 44 if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought. . 104. Additional guidance to agencies on FISMA updates Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance for agencies on— (1) performing the ongoing and continuous agency system risk assessment required under section 3554(a)(1)(A) of title 44, United States Code, as amended by this Act; (2) implementing additional cybersecurity procedures, which shall include resources for shared services; (3) establishing a process for providing the status of each remedial action under section 3554(b)(7) of title 44, United States Code, as amended by this Act, to the Director and the Cybersecurity and Infrastructure Security Agency using automation and machine-readable data, as practicable, which shall include— (A) specific guidance for the use of automation and machine-readable data; and (B) templates for providing the status of the remedial action; (4) interpreting the definition of high value asset (5) a requirement to coordinate with inspectors general of agencies to ensure consistent understanding and application of agency policies for the purpose of evaluations by inspectors general. 105. Agency requirements to notify private sector entities impacted by incidents (a) Definitions In this section: (1) Reporting entity The term reporting entity (2) Sensitive information The term sensitive information (b) Guidance on notification of reporting entities Not later than 180 days after the date of enactment of this Act, the Director shall issue guidance requiring the head of each agency to notify a reporting entity of an incident that is likely to substantially affect— (1) the confidentiality or integrity of sensitive information submitted by the reporting entity to the agency pursuant to a statutory or regulatory requirement; or (2) the agency information system or systems used in the transmission or storage of the sensitive information described in paragraph (1). II Improving Federal cybersecurity 201. Mobile security standards (a) In general Not later than 1 year after the date of enactment of this Act, the Director shall— (1) evaluate mobile application security guidance promulgated by the Director; and (2) issue guidance to secure mobile devices, including for mobile applications, for every agency. (b) Contents The guidance issued under subsection (a)(2) shall include— (1) a requirement, pursuant to section 3506(b)(4) of title 44, United States Code, for every agency to maintain a continuous inventory of every— (A) mobile device operated by or on behalf of the agency; and (B) vulnerability identified by the agency associated with a mobile device; and (2) a requirement for every agency to perform continuous evaluation of the vulnerabilities described in paragraph (1)(B) and other risks associated with the use of applications on mobile devices. (c) Information sharing The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance to agencies for sharing the inventory of the agency required under subsection (b)(1) with the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable. (d) Briefing Not later than 60 days after the date on which the Director issues guidance under subsection (a)(2), the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall provide to the appropriate congressional committees a briefing on the guidance. 202. Data and logging retention for incident response (a) Recommendations Not later than 2 years after the date of enactment of this Act, and not less frequently than every 2 years thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Attorney General, shall submit to the Director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency. (b) Contents The recommendations provided under subsection (a) shall include— (1) the types of logs to be maintained; (2) the time periods to retain the logs and other relevant data; (3) the time periods for agencies to enable recommended logging and security requirements; (4) how to ensure the confidentiality, integrity, and availability of logs; (5) requirements to ensure that, upon request, in a manner that excludes or otherwise reasonably protects personally identifiable information, and to the extent permitted by applicable law (including privacy and statistical laws), agencies provide logs to— (A) the Director of the Cybersecurity and Infrastructure Security Agency for a cybersecurity purpose; and (B) the Federal Bureau of Investigation to investigate potential criminal activity; and (6) requirements to ensure that, subject to compliance with statistical laws and other relevant data protection requirements, the highest level security operations center of each agency has visibility into all agency logs. (c) Guidance Not later than 90 days after receiving the recommendations submitted under subsection (a), the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Attorney General, shall, as determined to be appropriate by the Director, update guidance to agencies regarding requirements for logging, log retention, log management, sharing of log data with other appropriate agencies, or any other logging activity determined to be appropriate by the Director. 203. CISA agency advisors (a) In general Not later than 120 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall assign not less than 1 cybersecurity professional employed by the Cybersecurity and Infrastructure Security Agency to be the Cybersecurity and Infrastructure Security Agency advisor to the senior agency information security officer of each agency. (b) Qualifications Each advisor assigned under subsection (a) shall have knowledge of— (1) cybersecurity threats facing agencies, including any specific threats to the assigned agency; (2) performing risk assessments of agency systems; and (3) other Federal cybersecurity initiatives. (c) Duties The duties of each advisor assigned under subsection (a) shall include— (1) providing ongoing assistance and advice, as requested, to the agency Chief Information Officer; (2) serving as an incident response point of contact between the assigned agency and the Cybersecurity and Infrastructure Security Agency; and (3) familiarizing themselves with agency systems, processes, and procedures to better facilitate support to the agency in responding to incidents. (d) Limitation An advisor assigned under subsection (a) shall not be a contractor. (e) Multiple assignments One individual advisor may be assigned to multiple agency Chief Information Officers under subsection (a). 204. Federal penetration testing policy (a) In general Subchapter II of chapter 35 3559A. Federal penetration testing (a) Definitions In this section: (1) Agency operational plan The term agency operational plan (2) Rules of engagement The term rules of engagement (b) Guidance (1) In general The Director shall issue guidance that— (A) requires agencies to use, when and where appropriate, penetration testing on agency systems; and (B) requires agencies to develop an agency operational plan and rules of engagement that meet the requirements under subsection (c). (2) Penetration testing guidance The guidance issued under this section shall— (A) permit an agency to use, for the purpose of performing penetration testing— (i) a shared service of the agency or another agency; or (ii) an external entity, such as a vendor; and (B) require agencies to provide the rules of engagement and results of penetration testing to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, without regard to the status of the entity that performs the penetration testing. (c) Agency plans and rules of engagement The agency operational plan and rules of engagement of an agency shall— (1) require the agency to— (A) perform penetration testing on the high value assets of the agency; or (B) coordinate with the Director of the Cybersecurity and Infrastructure Security Agency to ensure that penetration testing is being performed; (2) establish guidelines for avoiding, as a result of penetration testing— (A) adverse impacts to the operations of the agency; (B) adverse impacts to operational environments and systems of the agency; and (C) inappropriate access to data; (3) require the results of penetration testing to include feedback to improve the cybersecurity of the agency; and (4) include mechanisms for providing consistently formatted, and, if applicable, automated and machine-readable, data to the Director and the Director of the Cybersecurity and Infrastructure Security Agency. (d) Responsibilities of CISA The Director of the Cybersecurity and Infrastructure Security Agency shall— (1) establish a process to assess the performance of penetration testing by both Federal and non-Federal entities that establishes minimum quality controls for penetration testing; (2) develop operational guidance for instituting penetration testing programs at agencies; (3) develop and maintain a centralized capability to offer penetration testing as a service to Federal and non-Federal entities; and (4) provide guidance to agencies on the best use of penetration testing resources. (e) Responsibilities of OMB The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall— (1) not less frequently than annually, inventory all Federal penetration testing assets; and (2) develop and maintain a standardized process for the use of penetration testing. (f) Prioritization of penetration testing resources (1) In general The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop a framework for prioritizing Federal penetration testing resources among agencies. (2) Considerations In developing the framework under this subsection, the Director shall consider— (A) agency system risk assessments performed under section 3554(a)(1)(A); (B) the Federal risk assessment performed under section 3553(i); (C) the analysis of Federal incident data performed under section 3597; and (D) any other information determined appropriate by the Director or the Director of the Cybersecurity and Infrastructure Security Agency. (g) Exception for national security systems The guidance issued under subsection (b) shall not apply to national security systems. (h) Delegation of authority for certain systems The authorities of the Director described in subsection (b) shall be delegated— (1) to the Secretary of Defense in the case of systems described in section 3553(e)(2); and (2) to the Director of National Intelligence in the case of systems described in 3553(e)(3). . (b) Deadline for guidance Not later than 180 days after the date of enactment of this Act, the Director shall issue the guidance required under section 3559A(b) of title 44, United States Code, as added by subsection (a). (c) Clerical amendment The table of sections for chapter 35 3559A. Federal penetration testing. . (d) Penetration testing by the Secretary of Homeland Security Section 3553(b) of title 44, United States Code, as amended by section 101, is further amended— (1) in paragraph (8)(B), by striking and (2) by redesignating paragraph (9) as paragraph (10); and (3) by inserting after paragraph (8) the following: (9) performing penetration testing with or without advance notice to, or authorization from, agencies, to identify vulnerabilities within Federal information systems; and . 205. Ongoing threat hunting program (a) Threat hunting program (1) In general Not later than 540 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall establish a program to provide ongoing, hypothesis-driven threat-hunting services on the network of each agency. (2) Plan Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall develop a plan to establish the program required under paragraph (1) that describes how the Director of the Cybersecurity and Infrastructure Security Agency plans to— (A) determine the method for collecting, storing, accessing, and analyzing appropriate agency data; (B) provide on-premises support to agencies; (C) staff threat hunting services; (D) allocate available human and financial resources to implement the plan; and (E) provide input to the heads of agencies on the use of— (i) more stringent standards under section 11331(c)(1) of title 40, United States Code; and (ii) additional cybersecurity procedures under section 3554 of title 44, United States Code. (b) Reports The Director of the Cybersecurity and Infrastructure Security Agency shall submit to the appropriate congressional committees— (1) not later than 30 days after the date on which the Director of the Cybersecurity and Infrastructure Security Agency completes the plan required under subsection (a)(2), a report on the plan to provide threat hunting services to agencies; (2) not less than 30 days before the date on which the Director of the Cybersecurity and Infrastructure Security Agency begins providing threat hunting services under the program under subsection (a)(1), a report providing any updates to the plan developed under subsection (a)(2); and (3) not later than 1 year after the date on which the Director of the Cybersecurity and Infrastructure Security Agency begins providing threat hunting services to agencies other than the Cybersecurity and Infrastructure Security Agency, a report describing lessons learned from providing those services. 206. Codifying vulnerability disclosure programs (a) In general Chapter 35 section 3559A, 3559B. Federal vulnerability disclosure programs (a) Definitions In this section: (1) Report The term report (2) Reporter The term reporter (b) Responsibilities of OMB (1) Limitation on legal action The Director, in consultation with the Attorney General, shall issue guidance to agencies to not recommend or pursue legal action against a reporter or an individual that conducts a security research activity that the head of the agency determines— (A) represents a good faith effort to follow the vulnerability disclosure policy of the agency developed under subsection (d)(2); and (B) is authorized under the vulnerability disclosure policy of the agency developed under subsection (d)(2). (2) Sharing information with CISA The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, shall issue guidance to agencies on sharing relevant information in a consistent, automated, and machine readable manner with the Cybersecurity and Infrastructure Security Agency, including— (A) any valid or credible reports of newly discovered or not publicly known vulnerabilities (including misconfigurations) on Federal information systems that use commercial software or services; (B) information relating to vulnerability disclosure, coordination, or remediation activities of an agency, particularly as those activities relate to outside organizations— (i) with which the head of the agency believes the Director of the Cybersecurity and Infrastructure Security Agency can assist; or (ii) about which the head of the agency believes the Director of the Cybersecurity and Infrastructure Security Agency should know; and (C) any other information with respect to which the head of the agency determines helpful or necessary to involve the Cybersecurity and Infrastructure Security Agency. (3) Agency vulnerability disclosure policies The Director shall issue guidance to agencies on the required minimum scope of agency systems covered by the vulnerability disclosure policy of an agency required under subsection (d)(2). (c) Responsibilities of CISA The Director of the Cybersecurity and Infrastructure Security Agency shall— (1) provide support to agencies with respect to the implementation of the requirements of this section; (2) develop tools, processes, and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section; and (3) upon a request by an agency, assist the agency in the disclosure to vendors of newly identified vulnerabilities in vendor products and services. (d) Responsibilities of agencies (1) Public information The head of each agency shall make publicly available, with respect to each internet domain under the control of the agency that is not a national security system— (A) an appropriate security contact; and (B) the component of the agency that is responsible for the internet accessible services offered at the domain. (2) Vulnerability disclosure policy The head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency, which shall— (A) describe— (i) the scope of the systems of the agency included in the vulnerability disclosure policy; (ii) the type of information system testing that is authorized by the agency; (iii) the type of information system testing that is not authorized by the agency; and (iv) the disclosure policy of the agency for sensitive information; (B) with respect to a report to an agency, describe— (i) how the reporter should submit the report; and (ii) if the report is not anonymous, when the reporter should anticipate an acknowledgment of receipt of the report by the agency; (C) include any other relevant information; and (D) be mature in scope, to cover all Federal information systems used or operated by that agency or on behalf of that agency. (3) Identified vulnerabilities The head of each agency shall incorporate any vulnerabilities reported under paragraph (2) into the vulnerability management process of the agency in order to track and remediate the vulnerability. (e) Paperwork Reduction Act exemption The requirements of subchapter I (commonly known as the Paperwork Reduction Act (f) Congressional reporting Not later than 90 days after the date of enactment of the Federal Information Security Modernization Act of 2021 Committee on Homeland Security and Governmental Affairs of the Senate Committee on Oversight and Reform of the House of Representatives (g) Exemptions The authorities and functions of the Director and Director of the Cybersecurity and Infrastructure Security Agency under this section shall not apply to national security systems. (h) Delegation of authority for certain systems The authorities of the Director and the Director of the Cybersecurity and Infrastructure Security Agency described in this section shall be delegated— (1) to the Secretary of Defense in the case of systems described in section 3553(e)(2); and (2) to the Director of National Intelligence in the case of systems described in section 3553(e)(3). . (b) Clerical amendment The table of sections for chapter 35 3559B. Federal vulnerability disclosure programs. . 207. Implementing presumption of compromise and least privilege principles (a) Guidance Not later than 1 year after the date of enactment of this Act, the Director shall provide an update to the appropriate congressional committees on progress in increasing the internal defenses of agency systems, including— (1) shifting away from trusted networks (2) implementing principles of least privilege in administering information security programs; (3) limiting the ability of entities that cause incidents to move laterally through or between agency systems; (4) identifying incidents quickly; (5) isolating and removing unauthorized entities from agency systems quickly; (6) otherwise increasing the resource costs for entities that cause incidents to be successful; and (7) a summary of the agency progress reports required under subsection (b). (b) Agency progress reports Not later than 1 year after the date of enactment of this Act, the head of each agency shall submit to the Director a progress report on implementing an information security program based on the presumption of compromise and least privilege principles, which shall include— (1) a description of any steps the agency has completed, including progress toward achieving requirements issued by the Director; (2) an identification of activities that have not yet been completed and that would have the most immediate security impact; and (3) a schedule to implement any planned activities. 208. Automation reports (a) OMB report Not later than 180 days after the date of enactment of this Act, the Director shall submit to the appropriate congressional committees a report on the use of automation under paragraphs (1), (5)(C) and (8)(B) of section 3554(b) of title 44, United States Code. (b) GAO report Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall perform a study on the use of automation and machine readable data across the Federal Government for cybersecurity purposes, including the automated updating of cybersecurity tools, sensors, or processes by agencies. 209. Extension of Federal acquisition security council Section 1328 of title 41, United States Code, is amended by striking the date that December 31, 2026. 210. Council of the Inspectors General on Integrity and Efficiency dashboard (a) Dashboard required Section 11(e)(2) of the Inspector General Act of 1978 (5 U.S.C. App.) is amended— (1) in subparagraph (A), by striking and (2) by redesignating subparagraph (B) as subparagraph (C); and (3) by inserting after subparagraph (A) the following: (B) that shall include a dashboard of open information security recommendations identified in the independent evaluations required by section 3555(a) of title 44, United States Code; and . III Risk-based budget model 301. Definitions In this title: (1) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Homeland Security and Governmental Affairs and the Committee on Appropriations of the Senate; and (B) the Committee on Homeland Security and the Committee on Appropriations of the House of Representatives. (2) Covered agency The term covered agency executive agency (3) Director The term Director (4) Information technology The term information technology (A) has the meaning given the term in section 11101 of title 40, United States Code; and (B) includes the hardware and software systems of a Federal agency that monitor and control physical equipment and processes of the Federal agency. (5) Risk-based budget The term risk-based budget (A) developed by identifying and prioritizing cybersecurity risks and vulnerabilities, including impact on agency operations in the case of a cyber attack, through analysis of threat intelligence, incident data, and tactics, techniques, procedures, and capabilities of cyber threats; and (B) that allocates resources based on the risks identified and prioritized under subparagraph (A). 302. Establishment of risk-based budget model (a) In general (1) Model Not later than 1 year after the first publication of the budget submitted by the President under section 1105 of title 31, United States Code, following the date of enactment of this Act, the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director and in coordination with the Director of the National Institute of Standards and Technology, shall develop a standard model for creating a risk-based budget for cybersecurity spending. (2) Responsibility of director Section 3553(a) of title 44, United States Code, as amended by section 101, is further amended by inserting after paragraph (6) the following: (7) developing a standard risk-based budget model to inform Federal agency cybersecurity budget development; and . (3) Contents of model The model required to be developed under paragraph (1) shall— (A) consider Federal and non-Federal cyber threat intelligence products, where available, to identify threats, vulnerabilities, and risks; (B) consider the impact of agency operations of compromise of systems, including the interconnectivity to other agency systems and the operations of other agencies; (C) indicate where resources should be allocated to have the greatest impact on mitigating current and future threats and current and future cybersecurity capabilities; (D) be used to inform acquisition and sustainment of— (i) information technology and cybersecurity tools; (ii) information technology and cybersecurity architectures; (iii) information technology and cybersecurity personnel; and (iv) cybersecurity and information technology concepts of operations; and (E) be used to evaluate and inform Government-wide cybersecurity programs of the Department of Homeland Security. (4) Required updates Not less frequently than once every 3 years, the Director shall review, and update as necessary, the model required to be developed under this subsection. (5) Publication The Director shall publish the model required to be developed under this subsection, and any updates necessary under paragraph (4), on the public website of the Office of Management and Budget. (6) Reports Not later than 1 year after the date of enactment of this Act, and annually thereafter for each of the 2 following fiscal years or until the date on which the model required to be developed under this subsection is completed, whichever is sooner, the Director shall submit a report to Congress on the development of the model. (b) Required use of risk-based budget model (1) In general Not later than 2 years after the date on which the model developed under subsection (a) is published, the head of each covered agency shall use the model to develop the annual cybersecurity and information technology budget requests of the agency. (2) Agency performance plans Section 3554(d)(2) of title 44, United States Code, is amended by inserting and the risk-based budget model required under section 3553(a)(7) paragraph (1) (c) Verification (1) In general Section 1105(a)(35)(A)(i) of title 31, United States Code, is amended— (A) in the matter preceding subclause (I), by striking by agency, and by initiative area (as determined by the administration) and by agency (B) in subclause (III), by striking and (C) by adding at the end the following: (V) a validation that the budgets submitted were developed using a risk-based methodology; and (VI) a report on the progress of each agency on closing recommendations identified under the independent evaluation required by section 3555(a)(1) of title 44. . (2) Effective date The amendments made by paragraph (1) shall take effect on the date that is 2 years after the date on which the model developed under subsection (a) is published. (d) Reports (1) Independent evaluation Section 3555(a)(2) of title 44, United States Code, is amended— (A) in subparagraph (B), by striking and (B) in subparagraph (C), by striking the period at the end and inserting ; and (C) by adding at the end the following: (D) an assessment of how the agency implemented the risk-based budget model required under section 3553(a)(7) and an evaluation of whether the model mitigates agency cyber vulnerabilities. . (2) Assessment Section 3553(c) of title 44, United States Code, as amended by section 101, is further amended by inserting after paragraph (5) the following: (6) an assessment of— (A) Federal agency implementation of the model required under subsection (a)(7); (B) how cyber vulnerabilities of Federal agencies changed from the previous year; and (C) whether the model mitigates the cyber vulnerabilities of the Federal Government. . (e) GAO report Not later than 3 years after the date on which the first budget of the President is submitted to Congress containing the validation required under section 1105(a)(35)(A)(i)(V) of title 31, United States Code, as amended by subsection (c), the Comptroller General of the United States shall submit to the appropriate congressional committees a report that includes— (1) an evaluation of the success of covered agencies in developing risk-based budgets; (2) an evaluation of the success of covered agencies in implementing risk-based budgets; (3) an evaluation of whether the risk-based budgets developed by covered agencies mitigate cyber vulnerability, including the extent to which the risk-based budgets inform Federal Government-wide cybersecurity programs; and (4) any other information relating to risk-based budgets the Comptroller General determines appropriate. IV Pilot programs to enhance Federal cybersecurity 401. Active cyber defensive study (a) Definition In this section, the term active defense technique (1) means an action taken on the systems of an entity to increase the security of information on the network of an agency by misleading an adversary; and (2) includes a honeypot, deception, or purposefully feeding false or misleading data to an adversary when the adversary is on the systems of the entity. (b) Study Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall perform a study on the use of active defense techniques to enhance the security of agencies, which shall include— (1) a review of legal restrictions on the use of different active cyber defense techniques in Federal environments, in consultation with the Department of Justice; (2) an evaluation of— (A) the efficacy of a selection of active defense techniques determined by the Director of the Cybersecurity and Infrastructure Security Agency; and (B) factors that impact the efficacy of the active defense techniques evaluated under subparagraph (A); (3) recommendations on safeguards and procedures that shall be established to require that active defense techniques are adequately coordinated to ensure that active defense techniques do not impede threat response efforts, criminal investigations, and national security activities, including intelligence collection; and (4) the development of a framework for the use of different active defense techniques by agencies. 402. Security operations center as a service pilot (a) Purpose The purpose of this section is for the Cybersecurity and Infrastructure Security Agency to run a security operation center on behalf of another agency, alleviating the need to duplicate this function at every agency, and empowering a greater centralized cybersecurity capability. (b) Plan Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall develop a plan to establish a centralized Federal security operations center shared service offering within the Cybersecurity and Infrastructure Security Agency. (c) Contents The plan required under subsection (b) shall include considerations for— (1) collecting, organizing, and analyzing agency information system data in real time; (2) staffing and resources; and (3) appropriate interagency agreements, concepts of operations, and governance plans. (d) Pilot program (1) In general Not later than 180 days after the date on which the plan required under subsection (b) is developed, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, shall enter into a 1-year agreement with not less than 2 agencies to offer a security operations center as a shared service. (2) Additional agreements After the date on which the briefing required under subsection (e)(1) is provided, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, may enter into additional 1-year agreements described in paragraph (1) with agencies. (e) Briefing and report (1) Briefing Not later than 260 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives a briefing on the parameters of any 1-year agreements entered into under subsection (d)(1). (2) Report Not later than 90 days after the date on which the first 1-year agreement entered into under subsection (d) expires, the Director of the Cybersecurity and Infrastructure Security Agency shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives a report on— (A) the agreement; and (B) any additional agreements entered into with agencies under subsection (d). December 19, 2022 Reported with an amendment

Summary: Federal Information Security Modernization Act of 2021 This bill addresses federal information security management, notification and remediation of cybersecurity incidents. For example, the bill requires (1) the Cybersecurity and Infrastructure Security Agency to perform ongoing and continuous assessments of federal information security risk posture; and (2) federal agencies to take certain actions in response to information security breaches, such as notifying affected individuals.