(A) consider relevant standards and best 
practices developed by the private sector, agen-
cies, and public-private partnerships; and 
(B) ensure that such guidelines are con-
sistent with the considerations published in the 
report described under section 3. 
(b) PROMULGATION OF STANDARDS.— 
(1) STANDARDS.—Not later than 180 days after 
the date on which the Director of the Institute com-
pletes the development of the guidelines required 
under subsection (a), the Director of OMB, in con-
sultation with the Director of the Cybersecurity and 
Infrastructure Security Agency of the Department of 
Homeland Security, shall— 
(A) promulgate standards on the basis of 
the guidelines submitted under subsection (a) 
pertaining to covered devices owned or controlled 
by agencies, except those considered national se-
curity systems as defined by section 3552(b)(6) 
of title 44, United States Code; and 
(B) ensure such standards are consistent 
with the information security requirements 
under subchapter II of chapter 35 of title 44, 
United States Code. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(2) QUINQUENNIAL REVIEW AND REVISION.—Not 
later than 5 years after the date on which the Direc-
tor of OMB promulgates the standards under para-
graph (1), and not less frequently than once every 5 
years thereafter, the Director of OMB, in consultation 
with and the Director of the Institute and the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security, 
shall— 
(A) review such standards; and 
(B) revise such standards as appropriate. 
(c) REVISION
OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be revised 
to implement any standard promulgated under subsection 
(b). 
SEC. 5. PETITION TO EXCLUDE CERTAIN DEVICES. 
(a) PETITION.—The Director of OMB shall establish 
a process by which an interested party may petition the 
Director of OMB for a device described in section 2(2) to 
not be considered a covered device for the purpose of stand-
ards promulgated under section 4(b). 
(b) GRANTS OF PETITION.—The Director of OMB shall 
grant a petition under subsection (a)— 
(1) on a limited basis; 
(2) in a timely manner; and 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(3) only if the interested party demonstrates 
that— 
(A) the procurement of such a covered device 
with limited data processing and software 
functionality would be unfeasible; or 
(B) the procurement of a covered device that 
does not meet the standards promulgated by the 
Director of OMB under this Act is necessary for 
national security or for research purposes. 
(c) REPORT.— 
(1) IN GENERAL.—Not later than one year after 
the date of the enactment of this Act, and annually 
thereafter for each of the following four years, the Di-
rector of OMB shall submit to the appropriate con-
gressional committees a report on the process estab-
lished by the Director of OMB for granting or deny-
ing waivers under this section. 
(2) ASSESSMENT OF IMPLEMENTATION.—The re-
ports required under paragraph (1) shall include, at 
a minimum, the following: 
(A) An assessment of the waiver evaluation 
process. 
(B) A description of the methods established 
to carry out such assessment. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(C) A classified appendix listing the types 
and number of devices for each agency granted 
a waiver and the reasons for such waiver. 
(3) APPROPRIATE CONGRESSIONAL COMMITTEES 
DEFINED.—In this subsection, the term ‘‘appropriate 
congressional committees’’ means the Committees on 
Oversight and Reform and Homeland Security of the 
House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the 
Senate. 
SEC. 
6. 
COORDINATED 
DISCLOSURE 
OF 
SECURITY 
VULNERABILITIES RELATING TO COVERED 
DEVICES. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Director of the Insti-
tute, in consultation with the Director of Cybersecurity and 
Infrastructure Security Agency of the Department of Home-
land Security, shall develop under section 20 of the Na-
tional Institute of Standards and Technology Act (15 
U.S.C. 278g-3) and submit to the Director of OMB, guide-
lines— 
(1) for the reporting, coordinating, publishing, 
and receiving of information about— 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(A) a security vulnerability relating to a 
covered device owned or controlled by an agency; 
and 
(B) the resolution of such security vulner-
ability; 
(2) for contractors providing a covered device to 
the Federal Government, and any subcontractor there-
of at any tier providing such device to such contrac-
tors on— 
(A) receiving information about a potential 
security vulnerability relating to the covered de-
vice; and 
(B) disseminating information about the 
resolution of a security vulnerability relating to 
the covered device; and 
(3) on the type of information about security 
vulnerabilities that should be reported to the Federal 
Government, including examples thereof. 
(b) DEVELOPMENT OF GUIDELINES.—In developing 
the guidelines under subsection (a), the Director of the Insti-
tute shall— 
(1) consult with such cybersecurity researchers 
and private sector industry experts as the Director 
considers appropriate; 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(2) to the maximum extent practicable, align 
such guidelines with Standards 29147 and 30111 of 
the International Standards Organization, or any 
successor standards thereof; and 
(3) ensure such guidelines are consistent with the 
policies and procedures developed under section 
2209(m) of the Homeland Security Act of 2002 (6 
U.S.C. 659(m)). 
(c) PROMULGATION OF STANDARDS.— 
(1) IN GENERAL.—Not later than 180 days after 
the date on which the guidelines under subsection (a) 
are submitted, the Director of OMB, in consultation 
with the Administrator of General Services and the 
Secretary of Homeland Security, shall promulgate 
standards on the basis of such guidelines. 
(2) 
CONTRACT
REQUIREMENT
FOR
SUB-
CONTRACTS.—The 
standards 
promulgated 
under 
paragraph (1) shall include a requirement for any 
contract related to a covered device to include a clause 
that requires each contractor that provides a covered 
device under the contract to an agency to ensure that 
any covered device obtained through a subcontract, at 
any tier, complies with the standards and regulations 
promulgated under this section with respect to such 
covered device. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(3) CONSISTENCY
WITH
THE
STRENGTHENING 
AND ENHANCING CYBER-CAPABILITIES BY UTILIZING 
RISK EXPOSURE TECHNOLOGY ACT.—The Director of 
OMB shall ensure that the standards promulgated 
under paragraph (1) are consistent with section 101 
of the Strengthening and Enhancing Cyber-capabili-
ties by Utilizing Risk Exposure Technology Act (6 
U.S.C. 663 note; Public Law 115–390). 
(d) REVISION
OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be revised 
to implement the standards promulgated under subsection 
(c). 
SEC. 7. CONTRACTOR COMPLIANCE WITH STANDARDS AND 
REGULATIONS. 
(a) IN GENERAL.— 
(1) DETERMINATION.— 
(A) 
COMPLIANCE
REQUIRED.—Before 
awarding a contract to an offeror for the pro-
curement of a covered device, or renewing a con-
tract to procure or obtain a covered device from 
a contractor, the agency Chief Information Offi-
cer shall determine if such offeror or contractor 
has complied with each standard promulgated 
under section 6(c) with respect to such covered 
device. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(B) 
SIMPLIFIED
ACQUISITION
THRESH-
OLD.—Notwithstanding section 1905 of title 41, 
United States Code, the requirements under sub-
paragraph (A) shall apply to a contract or sub-
contract in amounts not greater than the sim-
plified acquisition threshold. 
(2) PROHIBITION ON USE OR PROCUREMENT.— 
The head of an agency may not procure or obtain, or 
renew a contract to procure or obtain, a covered de-
vice if the agency Chief Information Officer deter-
mines under paragraph (1)(A) that such offeror or 
contractor has not complied with a standard promul-
gated under section 6(c) with respect to such covered 
device. 
(b) WAIVER.—The head of an agency may waive the 
prohibition under subsection (a)(2) if the procurement of 
such covered device is necessary for national security or for 
research purposes. 
(c) EFFECTIVE DATE.—The prohibition under sub-
section (a) shall take effect one year after the date of the 
enactment of this Act. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
SEC. 8. INSTITUTE REPORT ON CYBERSECURITY CONSIDER-
ATIONS STEMMING FROM THE CONVERGENCE 
OF INFORMATION TECHNOLOGY, INTERNET 
OF THINGS, AND OPERATIONAL TECHNOLOGY 
DEVICES, NETWORKS AND SYSTEMS. 
Not later than 1 year after the date of the enactment 
of this Act, the Director of the Institute shall publish a re-
port on the increasing convergence, including consider-
ations for managing potential security vulnerabilities asso-
ciated with such convergence, of traditional information 
technology devices, networks, and systems with— 
(1) covered devices, networks and systems; and 
(2) operational technology devices, networks and 
systems. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
Union Calendar No. 402 
116TH CONGRESS 
2D SESSION 
H. R. 1668 
[Report No. 116–501, Part I] 
A BILL 
To leverage Federal Government procurement 
power to encourage increased cybersecurity for 
Internet of Things devices, and for other pur-
poses. 
SEPTEMBER 14, 2020 
Reported from the Committee on Oversight and Reform 
with an amendment 
SEPTEMBER 14, 2020 
Committee on Science, Space, and Technology dis-
charged; committed to the Committee of the Whole 
House on the State of the Union and ordered to be 
printed 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6651
Sfmt 6651
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS