I 
114TH CONGRESS 
2D SESSION 
H. R. 5069 
To amend the Sarbanes-Oxley Act of 2002 to protect investors by expanding 
the mandated internal controls reports and disclosures to include cyberse-
curity systems and risks of publicly traded companies. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 26, 2016 
Mr. MCDERMOTT introduced the following bill; which was referred to the 
Committee on Financial Services 
A BILL 
To amend the Sarbanes-Oxley Act of 2002 to protect inves-
tors by expanding the mandated internal controls reports 
and disclosures to include cybersecurity systems and 
risks of publicly traded companies. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Systems 
and Risks Reporting Act’’. 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
SEC. 2. CYBERSECURITY AND INFORMATION SYSTEM RE-
QUIREMENTS. 
(a) DEFINITIONS.—Section 2(a) of the Sarbanes- 
Oxley Act of 2002 (15 U.S.C. 7201(a)) is amended— 
(1) in paragraph (2), by inserting after ‘‘finan-
cial statements’’ the following: ‘‘and information sys-
tems’’; 
(2) in paragraph (3)(A), by striking ‘‘and fi-
nancial’’ and inserting ‘‘, financial, and cybersecurity 
systems’’; 
(3) in paragraph (10)(B), by inserting after 
‘‘quality control policies and procedures,’’ the fol-
lowing: ‘‘cybersecurity systems standards and prac-
tices,’’; and 
(4) by adding at the end the following: 
‘‘(18) INFORMATION SYSTEM.—The term ‘infor-
mation system’ means a set of activities, involving 
people, processes, data, or technology, which enable 
the issuer to obtain, generate, use, and communicate 
transactions and information to maintain account-
ability and measure and review the issuer’s perform-
ance or progress towards achievement of objectives. 
‘‘(19) CYBERSECURITY SYSTEM.—The term ‘cy-
bersecurity system’ means a set of activities or state, 
involving people, processes, data or technology, 
whereby the protection of an information system of 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
the issuer is secured from, or defended against, 
damage, unauthorized use or modification, misdirec-
tion, disruption or exploitation. 
‘‘(20) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ means a significant vulnerability to, or 
a significant deficiency in, the security and defense 
activities of a cybersecurity system.’’. 
(b) CORPORATE RESPONSIBILITY.—Section 302 of 
the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7241) is 
amended— 
(1) in the heading of such section, by inserting 
after ‘‘REPORTS’’ the following: ‘‘AND INFORMA-
TION SYSTEMS’’; and 
(2) in subsection (a)— 
(A) by striking ‘‘and the principal financial 
officer or officers,’’ and inserting ‘‘, the prin-
cipal financial officer or officers, and the prin-
cipal cybersecurity systems officer or officers’’; 
(B) in paragraph (4), by striking ‘‘internal 
controls’’ each place such term appears and in-
serting ‘‘internal controls and cybersecurity sys-
tems’’; 
(C) in paragraph (5)— 
(i) in subparagraph (A)— 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
(I) by inserting after ‘‘operation 
of internal controls’’ the following: 
‘‘and cybersecurity systems’’; and 
(II) by inserting before the semi-
colon the following: ‘‘and any signifi-
cant cybersecurity risks in issuer’s in-
formation systems’’; and 
(ii) in subparagraph (B), by inserting 
before the semicolon the following: ‘‘, cy-
bersecurity systems, or information sys-
tems’’; and 
(D) in paragraph (6)— 
(i) by striking ‘‘internal controls’’ 
each place such term appears and inserting 
‘‘internal controls, cybersecurity systems, 
or information systems’’; and 
(ii) by striking ‘‘significant defi-
ciencies’’ 
and 
inserting 
‘‘cybersecurity 
risks, significant deficiencies,’’. 
(c) MANAGEMENT ASSESSMENT.—Section 404 of the 
Sarbanes-Oxley Act of 2002 (15 U.S.C. 7262) is amend-
ed— 
(1) in the heading of such section, by inserting 
after ‘‘CONTROLS’’ the following: ‘‘AND INFORMA-
TION SYSTEMS’’; 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
(2) in subsection (a)— 
(A) by inserting after ‘‘contain an internal 
control’’ the following: ‘‘and information sys-
tems’’; 
(B) in paragraph (1), by striking ‘‘an ade-
quate internal control structure and procedures 
for financial reporting’’ and inserting ‘‘adequate 
internal control and cybersecurity systems 
structures and procedures for financial and in-
formation systems reporting’’; and 
(C) by amending paragraph (2) to read as 
follows: 
‘‘(2) contain assessments, as of the end of the 
most recent fiscal year of the issuer, of the effective-
ness of— 
‘‘(A) the internal control structure and 
procedures of the issuer for financial reporting; 
and 
‘‘(B) the cybersecurity systems structure of 
the issuer.’’; and 
(3) in subsection (b)— 
(A) in the heading of such subsection, by 
inserting after ‘‘INTERNAL CONTROL’’ the fol-
lowing; ‘‘AND CYBERSECURITY SYSTEMS’’; and 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
(B) by striking ‘‘internal control assess-
ment’’ and inserting ‘‘internal control and cy-
bersecurity system structure assessments’’. 
(d) DISCLOSURE OF EXPERT.—Section 407 of the 
Sarbanes-Oxley Act of 2002 (15 U.S.C. 7265) is amend-
ed— 
(1) in the heading of such section, by striking 
‘‘EXPERT’’ and inserting ‘‘AND CYBERSECURITY 
SYSTEMS EXPERTS’’; 
(2) in subsection (a)— 
(A) in the heading of such subsection, by 
striking ‘‘EXPERT’’ and inserting ‘‘AND CYBER-
SECURITY EXPERTS’’; and 
(B) by striking ‘‘, as such term is defined 
by the Commission’’ and inserting ‘‘and at least 
1 member who is a cybersecurity systems ex-
pert, as such terms are defined by the Commis-
sion in consultation with the Secretary of 
Homeland Security and the Secretary of Com-
merce’’; and 
(3) by striking subsection (c) and inserting the 
following: 
‘‘(c) CONSIDERATIONS WITH RESPECT TO CYBERSE-
CURITY EXPERTS.—In defining the term ‘cybersecurity 
expert’ for purposes of subsection (a), the Commission 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS
shall, in consultation with the Secretary of Homeland Se-
curity and the Secretary of Commerce, consider whether 
a person has, through education or experience as an infor-
mation technology officer or information systems security 
officer, or from a position involving the performance of 
similar functions— 
‘‘(1) an understanding of generally accepted 
principles, practices, and law relating to computer 
security, computer network security, and data secu-
rity and privacy; 
‘‘(2) experience in— 
‘‘(A) the preparation of information sys-
tems audits for cybersecurity risk discovery; 
and 
‘‘(B) the maintenance, implementation, 
and monitoring of information systems and 
their cybersecurity systems; 
‘‘(3) experience with information systems as-
pects of internal accounting controls; and 
‘‘(4) an understanding of audit committee func-
tions.’’. 
(e) ENHANCED REVIEW.—Section 408 of the Sar-
banes-Oxley Act of 2002 (15 U.S.C. 7265) is amended— 
VerDate Sep 11 2014 
04:17 May 03, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5069.IH
H5069
smartinez on DSK3GLQ082PROD with BILLS