I 
113TH CONGRESS 
1ST SESSION H. R. 3635 
To ensure the functionality and security of new Federal websites that collect 
personally identifiable information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 3, 2013 
Mr. BENTIVOLIO introduced the following bill; which was referred to the 
Committee on Oversight and Government Reform 
A BILL 
To ensure the functionality and security of new Federal 
websites that collect personally identifiable information, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Safe and Secure Fed-
eral Websites Act of 2013’’. 
SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 
FEDERAL WEBSITES THAT COLLECT PERSON-
ALLY IDENTIFIABLE INFORMATION. 
(a) CERTIFICATION REQUIREMENT.— 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
(1) IN
GENERAL.—Except as otherwise pro-
vided under this subsection, an agency may not de-
ploy or make available to the public a new Federal 
PII website until the date on which a certification 
under subsection (b)(2) is submitted to Congress 
that the website is fully functional and secure. 
(2) TRANSITION.—In the case of a new Federal 
PII website that is operational on the date of the en-
actment of this Act, paragraph (1) shall not apply 
until the end of the 30-day period beginning on such 
date of enactment. If the certification under sub-
section (b)(2) for such website has not been sub-
mitted to Congress before the end of such period, 
the head of the responsible agency shall render the 
website inaccessible to the public until such certifi-
cation is submitted to Congress. 
(3) EXCEPTION FOR BETA WEBSITE WITH EX-
PLICIT PERMISSION.—Paragraph (1) shall not apply 
to a website (or portion thereof) that is designed for 
testing and development purposes, if the following 
conditions are met: 
(A) A member of the public may access 
PII-related portions of the website only after 
executing an agreement that acknowledges the 
risks involved. 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
(B) No agency compelled, enjoined, or oth-
erwise provided incentives for such a member to 
access the website for such purposes. 
(4) CONSTRUCTION.—Nothing in this section 
shall be construed as applying to a website that is 
operated entirely by an entity (such as a State or lo-
cality) that is independent of the Federal Govern-
ment, regardless of the receipt of funding in support 
of such website from the Federal Government. 
(b) PROCESS FOR STUDY AND CERTIFICATION OF 
FUNCTIONALITY AND SECURITY OF NEW FEDERAL PII 
WEBSITES.— 
(1) GAO STUDY AND REPORT.— 
(A) STUDY.— 
(i) CURRENT
WEBSITES.—Not later 
than 30 days after the date of the enact-
ment of this Act, the Comptroller General 
of the United States shall conduct a study 
of each new Federal PII website that is 
operational as of such date of enactment to 
determine whether such website is fully 
functional and secure. 
(ii) FUTURE
WEBSITES.—Not later 
than 30 days after the date on which an 
advance notification is received under 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
paragraph (3) for a new Federal PII 
website that is not operational as of such 
date of enactment, the Comptroller Gen-
eral shall conduct a study of such website 
to determine whether such website is fully 
functional and secure. 
(B) REPORT TO APPROPRIATE CONGRES-
SIONAL COMMITTEES.—Upon the completion of 
a study of a website under subparagraph (A) or 
(C), the Comptroller General shall submit to 
the appropriate committees of Congress and the 
Chief Information Officer for the responsible 
agency a report on the results of the study. 
Such report shall include a determination of 
whether the website is fully functional and se-
cure. 
(C) FOLLOWUP STUDIES AND REPORT.— 
If, based on the results of the most recent study 
under subparagraph (A) or this subparagraph, 
the Comptroller General determines that the 
website is not fully functional or not secure, the 
Comptroller General shall conduct an additional 
study (and submit a report described in sub-
paragraph (B) on the results of such study) 
until the Comptroller General determines that 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
the website is determined to be fully functional 
and secure. 
(2) CERTIFICATION BY CIO OF RESPONSIBLE 
AGENCY.—Upon the submission of a report under 
paragraph (1) that determines that a website oper-
ated by a responsible agency is fully functional and 
secure, the Chief Information Officer for such agen-
cy shall submit to Congress a certification of the re-
sults of such report and a certification as to whether 
the website is fully functional and secure. 
(3) ADVANCE
NOTIFICATION
FOR
OPERATION 
OF FUTURE WEBSITES.—Each agency that intends 
to operate a new Federal PII website on or after the 
date of the enactment of this Act shall notify the 
Comptroller General of such intention and provide to 
the Comptroller General, in advance of the website 
becoming operational, such information as the 
Comptroller General may require to conduct a study 
and perform an evaluation under this subsection. 
(c) DEFINITIONS.—In this section: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given that term under section 551 of title 
5, United States Code. 
(2) FULLY
FUNCTIONAL.—The term ‘‘fully 
functional’’ means, with respect to a new Federal 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
PII website, that the website can fully support the 
activities for which it is designed or intended with 
regard to the eliciting, collection, or storage of per-
sonally identifiable information, including handling a 
volume of queries relating to such information com-
mensurate with the purpose for which the website is 
designed. 
(3) NEW
FEDERAL
PII
WEBSITE.—The term 
‘‘new Federal PII website’’ means a website that— 
(A) is operated by (or under a contract 
with) an agency; 
(B) elicits, collects, or stores personally 
identifiable information of individuals and is ac-
cessible to the public; and 
(C) is first made accessible to the public 
and collects or stores personally identifiable in-
formation of individuals, on or after July 1, 
2013. 
(4) OPERATIONAL.—The term ‘‘operational’’ 
means, with respect to a website, that such website 
elicits, collects, or stores personally identifiable in-
formation of members of the public and is accessible 
to the public. 
(5) PERSONALLY IDENTIFIABLE INFORMATION 
(PII).—The terms ‘‘personally identifiable informa-
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
tion’’ and ‘‘PII’’ mean any information that can be 
associated with one individual through a social secu-
rity account number, taxpayer identification number, 
state identification number or other identifer, but 
does not include information (such as name, mailing 
or email address, telephone number, or similar con-
tact information) necessary to contact an individual. 
(6) RESPONSIBLE AGENCY.—The term ‘‘respon-
sible agency’’ means, with respect to a new Federal 
PII website, the agency that is responsible for the 
operation (whether directly or through contracts 
with other entities) of the website. 
(7) SECURE.—The term ‘‘secure’’ means, with 
respect to a new Federal PII website, that the fol-
lowing requirements are met: 
(A) The website has security features that 
meet a standard acceptable for banking pur-
poses and the responsible agency has a named 
overall security leader with a comprehensive, 
top-down view of the security posture for the 
website who has supervised a complete end-to- 
end security test. 
(B) The website ensures that personally 
identifiable information elicited, collected, or 
stored in connection with the website is cap-
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
tured at the latest possible step in a user input 
sequence. 
(C) The responsible agency for the website 
has taken reasonable efforts to minimize do-
main name confusion, including through addi-
tional domain registrations and a program to 
educate consumers how to spot fraudulent 
websites. 
(D) The responsible agency requires all 
personnel who have access to personally identi-
fiable information in connection with the 
website to have completed a Standard Form 
85P and signed a non-disclosure agreement 
with respect to personally identifiable informa-
tion, and the agency takes proper precautions 
to ensure only trustworthy persons may access 
such information. 
(E) The responsible agency maintains (ei-
ther directly or through contract) ample per-
sonnel to respond in a timely manner to issues 
relating to the proper functioning and security 
of the website, and to monitor on an ongoing 
basis existing and emerging security threats to 
the website. 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS
(8) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each territory or possession of the United States, 
and each federally recognized Indian tribe. 
Æ 
VerDate Mar 15 2010 
01:51 Dec 04, 2013
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H3635.IH
H3635
smartinez on DSK6TPTVN1PROD with BILLS