(6) UPDATED BRIEFINGS.—Not less frequently 
than once every 2 years, the Director shall provide 
to the appropriate congressional committees an up-
date on the guidance and templates developed under 
paragraphs (2) through (4). 
(c) UPDATE TO THE PRIVACY ACT OF 1974.—Sec-
tion 552a(b) of title 5, United States Code (commonly 
known as the ‘‘Privacy Act of 1974’’) is amended— 
(1) in paragraph (11), by striking ‘‘or’’ at the 
end; 
(2) in paragraph (12), by striking the period at 
the end and inserting ‘‘; or’’; and 
(3) by adding at the end the following: 
‘‘(13) to another agency in furtherance of a re-
sponse to an incident (as defined in section 3552 of 
title 44) and pursuant to the information sharing re-
quirements in section 3594 of title 44, if the head 
of the requesting agency has made a written request 
to the agency that maintains the record specifying 
the particular portion desired and the activity for 
which the record is sought.’’. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
SEC. 104. ADDITIONAL GUIDANCE TO AGENCIES ON FISMA 
UPDATES. 
Not later than 1 year after the date of the enactment 
of this Act, the Director shall issue guidance for agencies 
on— 
(1) performing the ongoing and continuous 
agency system risk assessment required under sec-
tion 3554(a)(1)(A) of title 44, United States Code, 
as amended by this Act; 
(2) implementing additional cybersecurity pro-
cedures, which shall include resources for shared 
services; 
(3) establishing a process for providing the sta-
tus of each remedial action under section 3554(b)(7) 
of title 44, United States Code, as amended by this 
Act, to the Director and the Director of the Cyberse-
curity and Infrastructure Security Agency using au-
tomation and machine-readable data, as practicable, 
which shall include— 
(A) specific guidance for the use of auto-
mation and machine-readable data; and 
(B) templates for providing the status of 
the remedial action; 
(4) interpreting the definition of ‘‘high value 
asset’’ under section 3552 of title 44, United States 
Code, as amended by this Act; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(5) a requirement to coordinate with inspectors 
general of agencies to ensure consistent under-
standing and application of agency policies for the 
purpose of evaluations by inspectors general. 
SEC. 105. AGENCY REQUIREMENTS TO NOTIFY PRIVATE 
SECTOR ENTITIES IMPACTED BY INCIDENTS. 
(a) DEFINITIONS.—In this section: 
(1) REPORTING ENTITY.—The term ‘‘reporting 
entity’’ means private organization or governmental 
unit that is required by statute or regulation to sub-
mit sensitive information to an agency. 
(2) SENSITIVE INFORMATION.—The term ‘‘sen-
sitive information’’ has the meaning given the term 
by the Director in guidance issued under subsection 
(b). 
(b) GUIDANCE ON NOTIFICATION OF REPORTING EN-
TITIES.—Not later than 180 days after the date of the 
enactment of this Act, the Director shall issue guidance 
requiring the head of each agency to notify a reporting 
entity of an incident that is likely to substantially affect— 
(1) the confidentiality or integrity of sensitive 
information submitted by the reporting entity to the 
agency pursuant to a statutory or regulatory re-
quirement; or 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(2) the agency information system or systems 
used in the transmission or storage of the sensitive 
information described in paragraph (1). 
TITLE II—IMPROVING FEDERAL 
CYBERSECURITY 
SEC. 201. MOBILE SECURITY STANDARDS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Director shall— 
(1) evaluate mobile application security guid-
ance promulgated by the Director; and 
(2) issue guidance to secure mobile devices, in-
cluding for mobile applications, for every agency. 
(b) CONTENTS.—The guidance issued under sub-
section (a)(2) shall include— 
(1) 
a 
requirement, 
pursuant 
to 
section 
3506(b)(4) of title 44, United States Code, for every 
agency to maintain a continuous inventory of 
every— 
(A) mobile device operated by or on behalf 
of the agency; and 
(B) vulnerability identified by the agency 
associated with a mobile device; and 
(2) a requirement for every agency to perform 
continuous evaluation of the vulnerabilities described 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
in paragraph (1)(B) and other risks associated with 
the use of applications on mobile devices. 
(c) INFORMATION SHARING.—The Director, in co-
ordination with the Director of the Cybersecurity and In-
frastructure Security Agency, shall issue guidance to 
agencies for sharing the inventory of the agency required 
under subsection (b)(1) with the Director of the Cyberse-
curity and Infrastructure Security Agency, using automa-
tion and machine-readable data to the greatest extent 
practicable. 
(d) BRIEFING.—Not later than 60 days after the date 
on which the Director issues guidance under subsection 
(a)(2), the Director, in coordination with the Director of 
the Cybersecurity and Infrastructure Security Agency, 
shall provide to the appropriate congressional committees 
a briefing on the guidance. 
SEC. 202. DATA AND LOGGING RETENTION FOR INCIDENT 
RESPONSE. 
(a) RECOMMENDATIONS.—Not later than 2 years 
after the date of the enactment of this Act, and not less 
frequently than every 2 years thereafter, the Director of 
the Cybersecurity and Infrastructure Security Agency, in 
consultation with the Attorney General, shall submit to 
the Director recommendations on requirements for logging 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
events on agency systems and retaining other relevant 
data within the systems and networks of an agency. 
(b) CONTENTS.—The recommendations provided 
under subsection (a) shall include— 
(1) the types of logs to be maintained; 
(2) the duration that logs and other relevant 
data should be retained; 
(3) the time periods for agency implementation 
of recommended logging and security requirements; 
(4) how to ensure the confidentiality, integrity, 
and availability of logs; 
(5) requirements to ensure that, upon request, 
in a manner that excludes or otherwise reasonably 
protects personally identifiable information, and to 
the extent permitted by applicable law (including 
privacy and statistical laws), agencies provide logs 
to— 
(A) the Director of the Cybersecurity and 
Infrastructure Security Agency for a cybersecu-
rity purpose; and 
(B) the Director of the Federal Bureau of 
Investigation, or the appropriate Federal law 
enforcement agency, to investigate potential 
criminal activity; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(6) requirements to ensure that, subject to com-
pliance with statistical laws and other relevant data 
protection requirements, the highest level security 
operations center of each agency has visibility into 
all agency logs. 
(c) GUIDANCE.—Not later than 90 days after receiv-
ing the recommendations submitted under subsection (a), 
the Director, in consultation with the Director of the Cy-
bersecurity and Infrastructure Security Agency and the 
Attorney General, shall, as determined to be appropriate 
by the Director, update guidance to agencies regarding re-
quirements for logging, log retention, log management, 
sharing of log data with other appropriate agencies, or any 
other logging activity determined to be appropriate by the 
Director. 
(d) SUNSET.—This section will cease to be in effect 
on the date that is 10 years after the date of the enact-
ment of this Act. 
SEC. 203. FEDERAL PENETRATION TESTING POLICY. 
(a) IN GENERAL.—Subchapter II of chapter 35 of 
title 44, United States Code, is amended by adding at the 
end the following: 
‘‘§ 3559A. Federal penetration testing 
‘‘(a) GUIDANCE.— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—The Director shall, in con-
sultation with the Secretary of the Department of 
Homeland Security acting through the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy, issue guidance to agencies that— 
‘‘(A) requires agencies to use, when and 
where appropriate, penetration testing on agen-
cy systems by both Federal and non-Federal en-
tities, with a focus on high value assets; 
‘‘(B) provides policies governing agency de-
velopment of an operational plan, rules of en-
gagement for utilizing penetration testing, and 
procedures to utilize the results of penetration 
testing to improve the cybersecurity and risk 
management of the agency; and 
‘‘(C) establishes a program under the Cy-
bersecurity and Infrastructure Security Agency 
to ensure that penetration testing is being per-
formed appropriately by agencies and to provide 
operational support or a shared service. 
‘‘(b) RESPONSIBILITIES OF OMB.—The Director, in 
coordination with the Director of the Cybersecurity and 
Infrastructure Security Agency, shall— 
‘‘(1) not less frequently than annually, inven-
tory all Federal penetration testing assets; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) develop and maintain a standardized proc-
ess for the use of penetration testing. 
‘‘(c) EXCEPTION
FOR NATIONAL SECURITY SYS-
TEMS.—The guidance issued under subsection (a) shall 
not apply to national security systems. 
‘‘(d) DELEGATION
OF AUTHORITY
FOR CERTAIN 
SYSTEMS.—The authorities of the Director described in 
subsection (a) shall be delegated— 
‘‘(1) to the Secretary of Defense in the case of 
systems described in section 3553(e)(2); and 
‘‘(2) to the Director of National Intelligence in 
the case of systems described in 3553(e)(3).’’. 
(b) DEADLINE FOR GUIDANCE.—Not later than 180 
days after the date of the enactment of this Act, the Direc-
tor shall issue the guidance required under section 
3559A(a) of title 44, United States Code, as added by sub-
section (a). 
(c) SUNSET.—This section shall sunset on the date 
that is 10 years after the date of the enactment of this 
Act. 
(d) CLERICAL AMENDMENT.—The table of sections 
for chapter 35 of title 44, United States Code, is amended 
by adding after the item relating to section 3559 the fol-
lowing: 
‘‘3559A. Federal penetration testing.’’. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6211
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(e) PENETRATION TESTING BY THE SECRETARY OF 
HOMELAND SECURITY.—Section 3553(b) of title 44, 
United States Code, as amended by section 5121, is fur-
ther amended— 
(1) in paragraph (8)(B), by striking ‘‘and’’ at 
the end; 
(2) by redesignating paragraph (9) as para-
graph (10); and 
(3) by inserting after paragraph (8) the fol-
lowing: 
‘‘(9) performing penetration testing to identify 
vulnerabilities within Federal information systems; 
and’’. 
SEC. 204. ONGOING THREAT HUNTING PROGRAM. 
(a) THREAT HUNTING PROGRAM.— 
(1) IN
GENERAL.—Not later than 540 days 
after the date of the enactment of this Act, the Di-
rector of the Cybersecurity and Infrastructure Secu-
rity Agency shall, in accordance with the authorities 
granted the Secretary under sections 3553(b)(7)–(8) 
and 3553(m) of title 44, United States Code (as re-
designated by this Act), establish a program to pro-
vide ongoing, hypothesis-driven threat-hunting serv-
ices on the network of each agency. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(2) PLAN.—Not later than 180 days after the 
date of the enactment of this Act, the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy shall develop a plan to establish the program re-
quired under paragraph (1) that describes how the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency plans to— 
(A) determine the method for collecting, 
storing, accessing, analyzing, and safeguarding 
appropriate agency data; 
(B) provide on-premises support to agen-
cies; 
(C) staff threat hunting services; 
(D) allocate available human and financial 
resources to implement the plan; and 
(E) provide input to the heads of agencies 
on the use of— 
(i) more stringent standards under 
section 11331(c)(1) of title 40, United 
States Code; and 
(ii) additional cybersecurity proce-
dures under section 3554 of title 44, 
United States Code. 
(b) REPORTS.—The Director of the Cybersecurity 
and Infrastructure Security Agency, in consultation with 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
the Director, shall submit to the appropriate congressional 
committees— 
(1) not later than 30 days after the date on 
which the Director of the Cybersecurity and Infra-
structure Security Agency completes the plan re-
quired under subsection (a)(2), a report on the plan 
to provide threat hunting services to agencies; 
(2) not less than 30 days before the date on 
which the Director of the Cybersecurity and Infra-
structure Security Agency begins providing threat 
hunting services under the program under sub-
section (a)(1), a report providing any updates to the 
plan developed under subsection (a)(2); and 
(3) not later than 1 year after the date on 
which the Director of the Cybersecurity and Infra-
structure Security Agency begins providing threat 
hunting services to agencies other than the Cyberse-
curity and Infrastructure Security Agency, a report 
describing lessons learned from providing those serv-
ices. 
SEC. 205. CODIFYING VULNERABILITY DISCLOSURE PRO-
GRAMS. 
(a) IN GENERAL.—Subchapter II of Chapter 35 of 
title 44, United States Code, is amended by inserting after 
section 3559A, as added by section 204, the following: 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
rity and Infrastructure Security Agency and in con-
sultation with the National Cyber Director, shall 
issue guidance to agencies on sharing relevant infor-
mation in a consistent, automated, and machine 
readable manner with the Director of the Cybersecu-
rity and Infrastructure Security Agency, including— 
‘‘(A) any valid or credible reports of newly 
discovered or not publicly known vulnerabilities 
(including misconfigurations) on Federal infor-
mation systems that use commercial software or 
services; 
‘‘(B) information relating to vulnerability 
disclosure, coordination, or remediation activi-
ties of an agency, particularly as those activities 
relate to outside organizations— 
‘‘(i) with which the head of the agency 
believes the Director of the Cybersecurity 
and Infrastructure Security Agency can as-
sist; or 
‘‘(ii) about which the head of the 
agency believes the Director of the Cyber-
security and Infrastructure Security Agen-
cy should know; and 
‘‘(C) any other information with respect to 
which the head of the agency determines helpful 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
or necessary to involve the Director of the Cy-
bersecurity and Infrastructure Security Agency. 
‘‘(3) AGENCY
VULNERABILITY
DISCLOSURE 
POLICIES.—The Director shall issue guidance to 
agencies on the required minimum scope of agency 
systems covered by the vulnerability disclosure policy 
of an agency required under subsection (d)(2). 
‘‘(c) RESPONSIBILITIES OF CISA.—The Director of 
the Cybersecurity and Infrastructure Security Agency 
shall— 
‘‘(1) provide support to agencies with respect to 
the implementation of the requirements of this sec-
tion; 
‘‘(2) develop tools, processes, and other mecha-
nisms determined appropriate to offer agencies capa-
bilities to implement the requirements of this sec-
tion; and 
‘‘(3) upon a request by an agency, assist the 
agency in the disclosure to vendors of newly identi-
fied vulnerabilities in vendor products and services. 
‘‘(d) RESPONSIBILITIES OF AGENCIES.— 
‘‘(1) PUBLIC INFORMATION.—The head of each 
agency shall make publicly available, with respect to 
each internet domain under the control of the agen-
cy that is not a national security system— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) an appropriate security contact; and 
‘‘(B) the component of the agency that is 
responsible for the internet accessible services 
offered at the domain. 
‘‘(2) VULNERABILITY
DISCLOSURE
POLICY.— 
The head of each agency shall develop and make 
publicly available a vulnerability disclosure policy for 
the agency, which shall— 
‘‘(A) describe— 
‘‘(i) the scope of the systems of the 
agency included in the vulnerability disclo-
sure policy; 
‘‘(ii) the type of information system 
testing that is authorized by the agency; 
‘‘(iii) the type of information system 
testing that is not authorized by the agen-
cy; and 
‘‘(iv) the disclosure policy of the agen-
cy for sensitive information; 
‘‘(B) with respect to a report to an agency, 
describe— 
‘‘(i) how the reporter should submit 
the report; and 
‘‘(ii) if the report is not anonymous, 
when the reporter should anticipate an ac-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
knowledgment of receipt of the report by 
the agency; 
‘‘(C) include any other relevant informa-
tion; and 
‘‘(D) be mature in scope, covering all inter-
net accessible Federal information systems used 
or operated by that agency or on behalf of that 
agency. 
‘‘(3) IDENTIFIED VULNERABILITIES.—The head 
of each agency shall incorporate any vulnerabilities 
reported under paragraph (2) into the vulnerability 
management process of the agency in order to track 
and remediate the vulnerability. 
‘‘(e) CONGRESSIONAL REPORTING.—Not later than 
90 days after the date of the enactment of the Federal 
Information Security Modernization Act of 2022, and an-
nually thereafter for a 3-year period, the Director of the 
Cybersecurity and Infrastructure Security Agency, in con-
sultation with the Director, shall provide to the Committee 
on Homeland Security and Governmental Affairs of the 
Senate and the Committee on Oversight and Reform of 
the House of Representatives a briefing on the status of 
the use of vulnerability disclosure policies under this sec-
tion at agencies, including, with respect to the guidance 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
issued under subsection (b)(3), an identification of the 
agencies that are compliant and not compliant. 
‘‘(f) EXEMPTIONS.—The authorities and functions of 
the Director and Director of the Cybersecurity and Infra-
structure Security Agency under this section shall not 
apply to national security systems. 
‘‘(g) DELEGATION
OF AUTHORITY
FOR CERTAIN 
SYSTEMS.—The authorities of the Director and the Direc-
tor of the Cybersecurity and Infrastructure Security Agen-
cy described in this section shall be delegated— 
‘‘(1) to the Secretary of Defense in the case of 
systems described in section 3553(e)(2); and 
‘‘(2) to the Director of National Intelligence in 
the 
case 
of 
systems 
described 
in 
section 
3553(e)(3).’’. 
(b) SUNSET.—This section shall sunset on the date 
that is 10 years after the date of the enactment of this 
Act. 
(c) CLERICAL AMENDMENT.—The table of sections 
for chapter 35 of title 44, United States Code, is amended 
by adding after the item relating to section 3559A, as 
added by this Act, the following: 
‘‘3559B. Federal vulnerability disclosure programs.’’. 
SEC. 206. IMPLEMENTING ZERO TRUST ARCHITECTURE. 
(a) GUIDANCE.—The Director shall maintain guid-
ance on the adoption of zero trust architecture and not 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
later than 2 years after the date of the enactment of this 
Act, provide an update to the appropriate congressional 
committees on progress in increasing the internal defenses 
of agency systems through such adoption across the gov-
ernment, including— 
(1) shifting away from ‘‘trusted networks’’ to 
implement security controls based on a presumption 
of compromise; 
(2) implementing principles of least privilege in 
administering information security programs; 
(3) limiting the ability of entities that cause in-
cidents to move laterally through or between agency 
systems; 
(4) identifying incidents quickly; 
(5) isolating and removing unauthorized entities 
from agency systems as quickly as practicable, ac-
counting for intelligence or law enforcement pur-
poses; 
(6) otherwise increasing the resource costs for 
entities that cause incidents to be successful; and 
(7) a summary of the agency progress reports 
required under subsection (b). 
(b) AGENCY PROGRESS REPORTS.—Not later than 
270 days after the date of the enactment of this Act, the 
head of each agency shall submit to the Director a 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
progress report on implementing an information security 
program based on a zero trust architecture, which shall 
include— 
(1) a description of any steps the agency has 
completed, including progress toward achieving any 
requirements issued by the Director, including the 
adoption of any models or reference architecture; 
(2) an identification of activities that have not 
yet been completed and that would have the most 
immediate security impact; and 
(3) a schedule to implement any planned activi-
ties. 
SEC. 207. GAO AUTOMATION REPORT. 
Not later than 2 years after the date of the enact-
ment of this Act, the Comptroller General of the United 
States shall perform a study on the use of automation and 
machine-readable data across the Federal Government for 
cybersecurity purposes, including the automated updating 
of cybersecurity tools, sensors, or processes employed by 
agencies under paragraphs (1), (5)(C), and (8)(B) of sec-
tion 3554(b) of title 44, United States Code. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
SEC. 208. EXTENSION OF FEDERAL ACQUISITION SECURITY 
COUNCIL. 
(a) EXTENSION.—Section 1328 of title 41, United 
States Code, is amended by striking ‘‘the date that’’ and 
all that follows and inserting ‘‘December 31, 2026’’. 
(b) DESIGNATION.—Section 1322(c)(1) of title 41, 
United States Code, is amended by striking ‘‘Not later 
than’’ and all that follows through the end of the para-
graph and inserting the following: ‘‘The Director of OMB 
shall designate the Federal Chief Information Security Of-
ficer appointed by the President under section 3607 of 
title 44, or an equivalent senior-level official from the Of-
fice of Management and Budget if the position is vacant, 
to serve as the Chairperson of the Council.’’. 
(c) REQUIREMENT.—Subsection 1326(b) of title 41, 
United States Code, is amended— 
(1) in paragraph (5), by striking ‘‘; and’’ and 
inserting a semicolon; 
(2) by redesignating paragraph (6) as para-
graph (7); and 
(3) by inserting after paragraph (5) the fol-
lowing new paragraph: 
‘‘(6) maintaining an up-to-date and accurate in-
ventory of software in use by the agency and, when 
available, the components of such software, including 
any available Software Bills of Materials, as applica-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
ble, that can be communicated when requested to 
the Federal Acquisition Security Council, the Na-
tional Cybersecurity Director, or the Secretary of 
Homeland Security acting through the Director of 
Cybersecurity and Infrastructure Security Agency.’’. 
SEC. 209. FEDERAL CHIEF INFORMATION SECURITY OFFI-
CER. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by inserting at the end: 
‘‘§ 3607. Federal chief information security officer 
‘‘(a) ESTABLISHMENT.—There is established in the 
Office of the Federal Chief Information Officer of the Of-
fice of Management and Budget a Federal Chief Informa-
tion Security Officer, who shall be appointed by the Presi-
dent. 
‘‘(b) DUTIES.—The Federal Chief Information Secu-
rity Officer shall report to the Federal Chief Information 
Officer, and assist the Chief Information Officer in car-
rying out— 
‘‘(1) all functions under this chapter; 
‘‘(2) all functions assigned to the Director 
under title II of the E–Government Act of 2002; 
‘‘(3) other electronic government initiatives, 
consistent with other statutes; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(4) assisting the Director with carrying out 
budget formation duties under subtitle II of title 31 
as it pertains to the information technology, oper-
ations, and workforce resources of Federal agencies 
to fulfill cybersecurity responsibilities under section 
3554, and the duties of the Department of Home-
land Security duties designated under section 3553; 
and 
‘‘(5) other initiatives determined by the Chief 
Information Officer. 
‘‘(c) ADDITIONAL DUTIES.—The Federal Chief Infor-
mation Security Officer shall work with the Chief Informa-
tion Officer to oversee implementation of electronic Gov-
ernment under the E–Government Act of 2002, and other 
relevant statutes, in a manner consistent with law, relating 
to— 
‘‘(1) cybersecurity strategy, policy, and oper-
ations, including the performance of the duties of 
the Director under subchapter II of chapter 35; 
‘‘(2) the development of enterprise architec-
tures; 
‘‘(3) information security; 
‘‘(4) privacy; 
‘‘(5) access to, dissemination of, and preserva-
tion of Government information; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(6) other areas of electronic Government as 
determined by the Administrator. 
‘‘(d) ASSISTANCE.—The Federal Chief Information 
Security Officer shall assist the Administrator in the per-
formance of electronic Government functions as described 
in section 3602(f).’’. 
(b) DEPUTY NATIONAL CYBER DIRECTOR.—Section 
1752 of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (6 U.S.C. 
1500; 134 Stat. 4144) is amended by adding at the end 
the following new subsection: 
‘‘(d) DEPUTY DIRECTOR.—There shall be a Deputy 
National Cyber Director for Agency Strategy, Capabilities, 
and Budget, who shall be the Federal Chief Information 
Security Officer appointed by the President under section 
3607 of title 44, United States Code, and shall report to 
the Director and assist the office in carrying out the fol-
lowing duties as it applies to the protection of Federal in-
formation systems by the agencies— 
‘‘(1) the preparation and oversight over the im-
plementation of national cyber policy and strategy 
under subsection (c)(1)(C)(i); 
‘‘(2) the formation and issuance of rec-
ommendations to agencies on resource allocations 
and policies under subsection (c)(1)(C)(ii); 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) reviewing annual budget proposals and 
making related recommendations under subsection 
(c)(1)(C)(iii); 
‘‘(4) the functions, as determined necessary, of 
the National Cyber Director under subchapter II of 
chapter 35 of title 44, United States Code; and 
‘‘(5) other initiatives determined by the Direc-
tor, or to be necessary to coordinate with the Office 
by the Federal Chief Information Officer.’’. 
(c) CLERICAL AMENDMENT.—The table of sections 
for chapter 36 of title 44, United States Code, is amended 
by adding after the item relating to section 3606 the fol-
lowing: 
‘‘3607. Federal chief information security officer.’’. 
SEC. 210. EXTENSION OF CHIEF DATA OFFICER COUNCIL. 
Section 2520A(e)(2) of title 44, United States Code, 
is amended by striking ‘‘upon the expiration of the 2-year 
period that begins on the date the Comptroller General 
submits the report under paragraph (1) to Congress’’ and 
inserting ‘‘January 31, 2030’’. 
SEC. 211. COUNCIL OF THE INSPECTORS GENERAL ON IN-
TEGRITY AND EFFICIENCY DASHBOARD. 
Section 11(e)(2) of the Inspector General Act of 1978 
(5 U.S.C. App.) is amended— 
(1) in subparagraph (A), by striking ‘‘and’’ at 
the end; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(2) by redesignating subparagraph (B) as sub-
paragraph (C); and 
(3) by inserting after subparagraph (A) the fol-
lowing: 
‘‘(B) that shall include a dashboard of 
open information security recommendations 
identified in the independent evaluations re-
quired by section 3555(a) of title 44, United 
States Code; and’’. 
SEC. 212. QUANTITATIVE CYBERSECURITY METRICS. 
(a) DEFINITION OF COVERED METRICS.—In this sec-
tion, the term ‘‘covered metrics’’ means the metrics estab-
lished, reviewed, and updated under section 224(c) of the 
Cybersecurity Act of 2015 (6 U.S.C. 1522(c)). 
(b) UPDATING AND ESTABLISHING METRICS.—Not 
later than 1 year after the date of the enactment of this 
Act, the Director of the Cybersecurity and Infrastructure 
Security Agency, in coordination with the Director and 
consulting with the Director of the National Institute of 
Standards and Technology, shall— 
(1) evaluate any covered metrics established as 
of the date of the enactment of this Act; and 
(2) as appropriate and pursuant to section 
224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 
1522(c))— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(A) update the covered metrics; and 
(B) establish new covered metrics. 
(c) IMPLEMENTATION.— 
(1) IN
GENERAL.—Not later than 540 days 
after the date of the enactment of this Act, the Di-
rector, in coordination with the Director of the Cy-
bersecurity and Infrastructure Security Agency, 
shall promulgate guidance that requires each agency 
to use covered metrics to track trends in the cyber-
security and incident response capabilities of the 
agency. 
(2) 
PERFORMANCE
DEMONSTRATION.—The 
guidance issued under paragraph (1) and any subse-
quent guidance shall require agencies to share with 
the Director of the Cybersecurity and Infrastructure 
Security Agency data demonstrating the perform-
ance of the agency using the covered metrics in-
cluded in the guidance. 
(3) PENETRATION TESTS.—On not less than 2 
occasions during the 2-year period following the date 
on which guidance is promulgated under paragraph 
(1), the Director shall ensure that not less than 3 
agencies are subjected to substantially similar pene-
tration tests, as determined by the Director, in co-
ordination with the Director of the Cybersecurity 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
100 
and Infrastructure Security Agency, in order to vali-
date the utility of the covered metrics. 
(4) ANALYSIS CAPACITY.—The Director of the 
Cybersecurity and Infrastructure Security Agency 
shall develop a capability that allows for the analysis 
of the covered metrics, including cross-agency per-
formance of agency cybersecurity and incident re-
sponse capability trends. 
(d) CONGRESSIONAL REPORTS.— 
(1) UTILITY OF METRICS.—Not later than 1 
year after the date of the enactment of this Act, the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency, in coordination with the Director, 
shall submit to the appropriate congressional com-
mittees a report on the utility of the covered metrics. 
(2) USE OF METRICS.—Not later than 180 days 
after the date on which the Director promulgates 
guidance under subsection (c)(1), the Director shall 
submit to the appropriate congressional committees 
a report on the results of the use of the covered 
metrics by agencies. 
(e) FEDERAL CYBERSECURITY ENHANCEMENT ACT 
OF 2015 UPDATES.—The Federal Cybersecurity Enhance-
ment Act of 2015 (6 U.S.C. 1521 et seq.) is amended— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
101 
(1) in section 222(3)(B), by inserting ‘‘and the 
Committee on Oversight and Reform’’ before ‘‘of the 
House of Representatives’’; and 
(2) in section 224— 
(A) by amending subsection (c) to read as 
follows: 
‘‘(c) IMPROVED METRICS.—The Director of the Cy-
bersecurity and Infrastructure Security Agency, in coordi-
nation with the Director, shall establish, review, and up-
date metrics to measure the cybersecurity and incident re-
sponse capabilities of agencies in accordance with the re-
sponsibilities of agencies under section 3554 of title 44, 
United States Code.’’; 
(B) by striking subsection (e); and 
(C) by redesignating subsection (f) as sub-
section (e). 
TITLE III—PILOT PROGRAMS TO 
ENHANCE FEDERAL CYBER-
SECURITY 
SEC. 301. RISK-BASED BUDGET PILOT. 
(a) DEFINITIONS.—In this section: 
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
102 
(A) the Committee on Homeland Security 
and Governmental Affairs and the Committee 
on Appropriations of the Senate; and 
(B) the Committee on Homeland Security, 
the Committee on Oversight and Reform, and 
the Committee on Appropriations of the House 
of Representatives. 
(2) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’— 
(A) has the meaning given the term in sec-
tion 11101 of title 40, United States Code; and 
(B) includes the hardware and software 
systems of a Federal agency that monitor and 
control physical equipment and processes of the 
Federal agency. 
(3) RISK-BASED
BUDGET.—The term ‘‘risk- 
based budget’’ means a budget— 
(A) 
developed 
by 
identifying 
and 
prioritizing 
cybersecurity 
risks 
and 
vulnerabilities, including impact on agency oper-
ations in the case of a cyber attack, through 
analysis of cyber threat intelligence, incident 
data, and tactics, techniques, procedures, and 
capabilities of cyber threats; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
103 
(B) that allocates resources based on the 
risks identified and prioritized under subpara-
graph (A). 
(b) ESTABLISHMENT
OF
RISK-BASED
BUDGET 
PILOT.— 
(1) IN GENERAL.— 
(A) MODEL.—Not later than 1 year after 
the first publication of the budget submitted by 
the President under section 1105 of title 31, 
United States Code, following the date of the 
enactment of this Act, the Director, in consulta-
tion with the Director of the Cybersecurity and 
Infrastructure Security Agency and the Na-
tional Cyber Director and in coordination with 
the Director of the National Institute of Stand-
ards and Technology, shall conduct a pilot for 
creating a risk-based budget for cybersecurity 
spending. 
(B) CONTENTS OF PILOT.—The pilot re-
quired to be developed under this paragraph 
shall— 
(i) consider Federal and non-Federal 
cyber threat intelligence products, where 
available, 
to 
identify 
threats, 
vulnerabilities, and risks; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
104 
(ii) consider the impact on agency op-
erations 
of 
incidents, 
including 
the 
interconnectivity to other agency systems 
and the operations of other agencies; 
(iii) indicate where resources should 
be allocated to have the greatest impact on 
mitigating current and future threats and 
current and future cybersecurity capabili-
ties; 
(iv) be used to inform acquisition and 
sustainment of— 
(I) information technology and 
cybersecurity tools; 
(II) information technology and 
cybersecurity architectures; 
(III) information technology and 
cybersecurity personnel; and 
(IV) cybersecurity and informa-
tion technology concepts of operations; 
and 
(v) be used to evaluate and inform 
government-wide cybersecurity programs of 
the Department of Homeland Security. 
(2) REPORTS.—Not later than 2 years after the 
first publication of the budget submitted by the 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
105 
President under section 1105 of title 31, United 
States Code, following the date of the enactment of 
this Act, the Director shall submit a report to Con-
gress on the implementation of the pilot for risk- 
based budgeting for cybersecurity spending, an as-
sessment of agency implementation, and an evalua-
tion of whether the risk-based budget helps to miti-
gate cybersecurity vulnerabilities. 
(3) GAO REPORT.—Not later than 3 years 
after the date on which the first budget of the Presi-
dent is submitted to Congress containing the valida-
tion required under section 1105(a)(35)(A)(i)(V) of 
title 31, United States Code, as amended by sub-
section (c), the Comptroller General of the United 
States shall submit to the appropriate congressional 
committees a report that includes— 
(A) an evaluation of the success of pilot 
agencies in implementing risk-based budgets; 
(B) an evaluation of whether the risk- 
based budgets developed by pilot agencies are 
effective at informing Federal Government-wide 
cybersecurity programs; and 
(C) any other information relating to risk- 
based budgets the Comptroller General deter-
mines appropriate. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
106 
SEC. 302. ACTIVE CYBER DEFENSIVE STUDY. 
(a) DEFINITION.—In this section, the term ‘‘active 
defense technique’’ has the meaning given in guidance 
issued by the Director, in coordination with the Attorney 
General. 
(b) STUDY.—Not later than 180 days after the date 
of the enactment of this Act, the Director of the Cyberse-
curity and Infrastructure Security Agency, in coordination 
with the Director and the National Cyber Director, shall 
perform a study on the use of active defense techniques 
to enhance the security of agencies, which shall include— 
(1) a review of legal restrictions on the use of 
different active cyber defense techniques in Federal 
environments, in consultation with the Attorney 
General; 
(2) an evaluation of— 
(A) the efficacy of a selection of active de-
fense techniques determined by the Director of 
the Cybersecurity and Infrastructure Security 
Agency; and 
(B) factors that impact the efficacy of the 
active defense techniques evaluated under sub-
paragraph (A); 
(3) recommendations on safeguards and proce-
dures that shall be established to require that active 
defense techniques are adequately coordinated to en-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
107 
sure that active defense techniques do not impede 
agency operations and mission delivery, threat re-
sponse efforts, criminal investigations, and national 
security activities, including intelligence collection; 
and 
(4) the development of a framework for the use 
of different active defense techniques by agencies. 
SEC. 303. SECURITY OPERATIONS CENTER AS A SERVICE 
PILOT. 
(a) PURPOSE.—The purpose of this section is for the 
Director of the Cybersecurity and Infrastructure Security 
Agency to run a security operation center on behalf of the 
head of another agency, alleviating the need to duplicate 
this function at every agency, and empowering a greater 
centralized cybersecurity capability. 
(b) PLAN.—Not later than 1 year after the date of 
the enactment of this Act, the Director of the Cybersecu-
rity and Infrastructure Security Agency shall develop a 
plan to establish a centralized Federal security operations 
center shared service offering within the Cybersecurity 
and Infrastructure Security Agency. 
(c) CONTENTS.—The plan required under subsection 
(b) shall include considerations for— 
(1) collecting, organizing, and analyzing agency 
information system data in real time; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
108 
(2) staffing and resources; and 
(3) appropriate interagency agreements, con-
cepts of operations, and governance plans. 
(d) PILOT PROGRAM.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date on which the plan required under sub-
section (b) is developed, the Director of the Cyberse-
curity and Infrastructure Security Agency, in con-
sultation with the Director of the Office of Manage-
ment and Budget, shall enter into a 1-year agree-
ment with not less than 2 agencies to offer a secu-
rity operations center as a shared service. 
(2) ADDITIONAL AGREEMENTS.—After the date 
on which the briefing required under subsection 
(e)(1) is provided, the Director of the Cybersecurity 
and Infrastructure Security Agency, in consultation 
with the Director of the Office of Management and 
Budget, may enter into additional 1-year agreements 
described in paragraph (1) with agencies. 
(e) BRIEFING AND REPORT.— 
(1) BRIEFING.—Not later than 270 days after 
the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security 
Agency shall provide to appropriate congressional 
committees a briefing on the parameters of any 1- 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS