II 
116TH CONGRESS 
2D SESSION 
H. R. 1668 
IN THE SENATE OF THE UNITED STATES 
SEPTEMBER 15, 2020 
Received 
AN ACT 
To establish minimum security standards for Internet of 
Things devices owned or controlled by the Federal Gov-
ernment, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Things Cy-
bersecurity Improvement Act of 2020’’ or the ‘‘IoT Cyber-
security Improvement Act of 2020’’. 
SEC. 2. SENSE OF CONGRESS. 
It is the sense of Congress that— 
(1) ensuring the highest level of cybersecurity 
at agencies in the executive branch is the responsi-
bility of the President, followed by the Director of 
the Office of Management and Budget, the Sec-
retary of Homeland Security, and the head of each 
such agency; 
(2) this responsibility is to be carried out by 
working collaboratively within and among agencies 
in the executive branch, industry, and academia; 
(3) the strength of the cybersecurity of the 
Federal Government and the positive benefits of dig-
ital technology transformation depend on proactively 
addressing cybersecurity throughout the acquisition 
and operation of Internet of Things devices by the 
Federal Government; and 
(4) consistent with the second draft National 
Institute for Standards and Technology Interagency 
or Internal Report 8259 titled ‘‘Recommendations 
for IoT Device Manufacturers: Foundational Activi-
ties and Core Device Cybersecurity Capability Base-
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
line’’, published in January 2020, Internet of Things 
devices are devices that— 
(A) have at least one transducer (sensor or 
actuator) for interacting directly with the phys-
ical world, have at least one network interface, 
and are not conventional Information Tech-
nology devices, such as smartphones and 
laptops, for which the identification and imple-
mentation of cybersecurity features is already 
well understood; and 
(B) can function on their own and are not 
only able to function when acting as a compo-
nent of another device, such as a processor. 
SEC. 3. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given that term in section 3502 of title 44, 
United States Code. 
(2) DIRECTOR OF OMB.—The term ‘‘Director of 
OMB’’ means the Director of the Office of Manage-
ment and Budget. 
(3) DIRECTOR OF THE INSTITUTE.—The term 
‘‘Director of the Institute’’ means the Director of 
the National Institute of Standards and Technology. 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
(4) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given that term in 
section 3502 of title 44, United States Code. 
(5) NATIONAL SECURITY SYSTEM.—The term 
‘‘national security system’’ has the meaning given 
that term in section 3552(b)(6) of title 44, United 
States Code. 
(6) OPERATIONAL
TECHNOLOGY.—The term 
‘‘operational technology’’ means hardware and soft-
ware that detects or causes a change through the di-
rect monitoring or control of physical devices, proc-
esses, and events in the enterprise. 
(7) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
(8) SECURITY VULNERABILITY.—The term ‘‘se-
curity vulnerability’’ has the meaning given that 
term in section 102(17) of the Cybersecurity Infor-
mation Sharing Act of 2015 (6 U.S.C. 1501(17)). 
SEC. 4. SECURITY STANDARDS AND GUIDELINES FOR 
AGENCIES ON USE AND MANAGEMENT OF 
INTERNET OF THINGS DEVICES. 
(a) NATIONAL
INSTITUTE
OF
STANDARDS
AND 
TECHNOLOGY
DEVELOPMENT
OF
STANDARDS
AND 
GUIDELINES FOR USE OF INTERNET OF THINGS DEVICES 
BY AGENCIES.— 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
(B) with respect to the following consider-
ations for Internet of Things devices: 
(i) Secure Development. 
(ii) Identity management. 
(iii) Patching. 
(iv) Configuration management. 
(3) CONSIDERING RELEVANT STANDARDS.—In 
developing the standards and guidelines under para-
graph (1), the Director of the Institute shall con-
sider relevant standards, guidelines, and best prac-
tices developed by the private sector, agencies, and 
public-private partnerships. 
(b) REVIEW OF AGENCY INFORMATION SECURITY 
POLICIES AND PRINCIPLES.— 
(1) REQUIREMENT.—Not later than 180 days 
after the date on which the Director of the Institute 
completes the development of the standards and 
guidelines required under subsection (a), the Direc-
tor of OMB shall review agency information security 
policies and principles on the basis of the standards 
and guidelines published under subsection (a) per-
taining to Internet of Things devices owned or con-
trolled by agencies (excluding agency information se-
curity policies and principles pertaining to Internet 
of Things of devices owned or controlled by agencies 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
that are or comprise a national security system) for 
consistency with the standards and guidelines sub-
mitted under subsection (a) and issue such policies 
and principles as may be necessary to ensure those 
policies and principles are consistent with such 
standards and guidelines. 
(2) REVIEW.—In reviewing agency information 
security policies and principles under paragraph (1) 
and issuing policies and principles under such para-
graph, as may be necessary, the Director of OMB 
shall— 
(A) consult with the Director of the Cyber-
security and Infrastructure Security Agency of 
the Department of Homeland Security; and 
(B) ensure such policies and principles are 
consistent with the information security require-
ments under subchapter II of chapter 35 of 
title 44, United States Code. 
(3) NATIONAL SECURITY SYSTEMS.—Any policy 
or principle issued by the Director of OMB under 
paragraph (1) shall not apply to national security 
systems. 
(c) QUINQUENNIAL REVIEW AND REVISION.— 
(1) REVIEW AND REVISION OF NIST STANDARDS 
AND GUIDELINES.—Not later than 5 years after the 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
date on which the Director of the Institute publishes 
the standards and guidelines under subsection (a), 
and not less frequently than once every 5 years 
thereafter, the Director of the Institute, shall— 
(A) review such standards and guidelines; 
and 
(B) revise such standards and guidelines 
as appropriate. 
(2) UPDATED OMB POLICIES AND PRINCIPLES 
FOR AGENCIES.—Not later than 180 days after the 
Director of the Institute makes a revision pursuant 
to paragraph (1), the Director of OMB, in consulta-
tion with the Director of the Cybersecurity and In-
frastructure Security Agency of the Department of 
Homeland Security, shall update any policy or prin-
ciple issued under subsection (b)(1) as necessary to 
ensure those policies and principles are consistent 
with the review and any revision under paragraph 
(1) under this subsection and paragraphs (2) and 
(3) of subsection (b). 
(d) REVISION OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be re-
vised as necessary to implement any standards and guide-
lines promulgated in this section. 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
SEC. 5. GUIDELINES ON THE DISCLOSURE PROCESS FOR 
SECURITY VULNERABILITIES RELATING TO 
INFORMATION SYSTEMS, INCLUDING INTER-
NET OF THINGS DEVICES. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Director of the In-
stitute, in consultation with such cybersecurity researchers 
and private sector industry experts as the Director con-
siders appropriate, and in consultation with the Secretary, 
shall develop and publish under section 20 of the National 
Institute of Standards and Technology Act (15 U.S.C. 
278g–3) guidelines— 
(1) for the reporting, coordinating, publishing, 
and receiving of information about— 
(A) a security vulnerability relating to in-
formation systems owned or controlled by an 
agency (including Internet of Things devices 
owned or controlled by an agency); and 
(B) the resolution of such security vulner-
ability; and 
(2) for a contractor providing to an agency an 
information system (including an Internet of Things 
device) and any subcontractor thereof at any tier 
providing such information system to such con-
tractor, on— 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
(A) receiving information about a potential 
security vulnerability relating to the information 
system; and 
(B) disseminating information about the 
resolution of a security vulnerability relating to 
the information system. 
(b) ELEMENTS.—The guidelines published under 
subsection (a) shall— 
(1) to the maximum extent practicable, be 
aligned with industry best practices and Standards 
29147 and 30111 of the International Standards 
Organization (or any successor standard) or any 
other appropriate, relevant, and widely-used stand-
ard; 
(2) incorporate guidelines on— 
(A) receiving information about a potential 
security vulnerability relating to an information 
system owned or controlled by an agency (in-
cluding an Internet of Things device); and 
(B) disseminating information about the 
resolution of a security vulnerability relating to 
an information system owned or controlled by 
an agency (including an Internet of Things de-
vice); and 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
(3) be consistent with the policies and proce-
dures produced under section 2009(m) of the Home-
land Security Act of 2002 (6 U.S.C. 659(m)). 
(c) INFORMATION ITEMS.—The guidelines published 
under subsection (a) shall include example content, on the 
information items that should be reported, coordinated, 
published, or received pursuant to this section by a con-
tractor, or any subcontractor thereof at any tier, providing 
an information system (including Internet of Things de-
vice) to the Federal Government. 
(d) OVERSIGHT.—The Director of OMB shall oversee 
the implementation of the guidelines published under sub-
section (a). 
(e) OPERATIONAL AND TECHNICAL ASSISTANCE.— 
The Secretary, in consultation with the Director of OMB, 
shall administer the implementation of the guidelines pub-
lished under subsection (a) and provide operational and 
technical assistance in implementing such guidelines. 
SEC. 6. IMPLEMENTATION OF COORDINATED DISCLOSURE 
OF SECURITY VULNERABILITIES RELATING 
TO 
AGENCY 
INFORMATION 
SYSTEMS, 
IN-
CLUDING INTERNET OF THINGS DEVICES. 
(a) AGENCY GUIDELINES REQUIRED.—Not later 
than 2 years after the date of the enactment of this Act, 
the Director of OMB, in consultation with the Secretary, 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
shall develop and oversee the implementation of policies, 
principles, standards, or guidelines as may be necessary 
to address security vulnerabilities of information systems 
(including Internet of Things devices). 
(b) OPERATIONAL AND TECHNICAL ASSISTANCE.— 
Consistent with section 3553(b) of title 44, United States 
Code, the Secretary, in consultation with the Director of 
OMB, shall provide operational and technical assistance 
to agencies on reporting, coordinating, publishing, and re-
ceiving information about security vulnerabilities of infor-
mation systems (including Internet of Things devices). 
(c) CONSISTENCY WITH GUIDELINES FROM NA-
TIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.— 
The Secretary shall ensure that the assistance provided 
under subsection (b) is consistent with applicable stand-
ards and publications developed by the Director of the In-
stitute. 
(d) REVISION OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be re-
vised as necessary to implement the provisions under this 
section. 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
SEC. 7. CONTRACTOR COMPLIANCE WITH COORDINATED 
DISCLOSURE 
OF 
SECURITY 
VULNERABILITIES 
RELATING 
TO 
AGENCY 
INTERNET OF THINGS DEVICES. 
(a) PROHIBITION ON PROCUREMENT AND USE.— 
(1) IN GENERAL.—The head of an agency is 
prohibited from procuring or obtaining, renewing a 
contract to procure or obtain, or using an Internet 
of Things device, if the Chief Information Officer of 
that agency determines during a review required by 
section 11319(b)(1)(C) of title 40, United States 
Code, of a contract for such device that the use of 
such device prevents compliance with the standards 
and guidelines developed under section 4 or the 
guidelines published under section 5 with respect to 
such device. 
(2) SIMPLIFIED
ACQUISITION
THRESHOLD.— 
Notwithstanding section 1905 of title 41, United 
States Code, the requirements under paragraph (1) 
shall apply to a contract or subcontract in amounts 
not greater than the simplified acquisition threshold. 
(b) WAIVER.— 
(1) AUTHORITY.—The head of an agency may 
waive the prohibition under subsection (a)(1) with 
respect to an Internet of Things device if the Chief 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
Information Officer of that agency determines 
that— 
(A) the waiver is necessary in the interest 
of national security; 
(B) procuring, obtaining, or using such de-
vice is necessary for research purposes; or 
(C) such device is secured using alternative 
and effective methods appropriate to the func-
tion of such device. 
(2) AGENCY PROCESS.—The Director of OMB 
shall establish a standardized process for the Chief 
Information Officer of each agency to follow in de-
termining whether the waiver under paragraph (1) 
may be granted. 
(c) REPORTS TO CONGRESS.— 
(1) REPORT.—Every 2 years during the 6-year 
period beginning on the date of the enactment of 
this Act, the Comptroller General of the United 
States shall submit to the Committee on Oversight 
and Reform of the House of Representatives, the 
Committee on Homeland Security of the House of 
Representatives, and the Committee on Homeland 
Security and Governmental Affairs of the Senate a 
report— 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
(A) on the effectiveness of the process es-
tablished under subsection (b)(2); 
(B) that contains recommended best prac-
tices for the procurement of Internet of Things 
devices; and 
(C) that lists— 
(i) the number and type of each Inter-
net of Things device for which a waiver 
under subsection (b)(1) was granted dur-
ing the 2-year period prior to the submis-
sion of the report; and 
(ii) the legal authority under which 
each such waiver was granted, such as 
whether the waiver was granted pursuant 
to subparagraph (A), (B), or (C) of such 
subsection. 
(2) CLASSIFICATION OF REPORT.—Each report 
submitted under this subsection shall be submitted 
in unclassified form, but may include a classified 
annex that contains the information described under 
paragraph (1)(C). 
(d) EFFECTIVE DATE.—The prohibition under sub-
section (a)(1) shall take effect 2 years after the date of 
the enactment of this Act. 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
SEC. 8. GOVERNMENT ACCOUNTABILITY OFFICE REPORT 
ON CYBERSECURITY CONSIDERATIONS STEM-
MING FROM THE CONVERGENCE OF INFOR-
MATION 
TECHNOLOGY, 
INTERNET 
OF 
THINGS, AND OPERATIONAL TECHNOLOGY 
DEVICES, NETWORKS, AND SYSTEMS. 
(a) BRIEFING.—Not later than 1 year after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall provide a briefing to the Com-
mittee on Oversight and Reform of the House of Rep-
resentatives, the Committee on Homeland Security of the 
House of Representatives, and the Committee on Home-
land Security and Governmental Affairs of the Senate on 
broader Internet of Things efforts, including projects de-
signed 
to 
assist 
in 
managing 
potential 
security 
vulnerabilities associated with the use of traditional infor-
mation technology devices, networks, and systems with— 
(1) Internet of Things devices, networks, and 
systems; and 
(2) operational technology devices, networks, 
and systems. 
(b) REPORT.—Not later than 2 years after the date 
of enactment of this Act, the Comptroller General shall 
submit a report to the Committee on Oversight and Re-
form of the House of Representatives, the Committee on 
Homeland Security of the House of Representatives, and 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS
HR 1668 RDS
the Committee on Homeland Security and Governmental 
Affairs of the Senate on broader Internet of Things efforts 
addressed in subsection (a). 
Passed the House of Representatives September 14, 
2020. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
03:04 Nov 18, 2020
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1668.RDS
H1668
pamtmann on DSKBC07HB2PROD with BILLS