‘‘(k) COORDINATION.—The head of each agency shall 
coordinate with the inspector general of the agency, as ap-
plicable, to ensure consistent understanding of agency cy-
bersecurity or information security policies for the purpose 
of evaluations of such policies conducted by the inspector 
general.’’; and 
(5) in section 3556(a)— 
(A) in the matter preceding paragraph (1), 
by inserting ‘‘within the Cybersecurity and In-
frastructure Security Agency’’ after ‘‘incident 
center’’; and 
(B) in paragraph (4), by striking ‘‘3554(b)’’ 
and inserting ‘‘3554(a)(1)(A)’’. 
(d) CONFORMING AMENDMENTS.— 
(1) TABLE OF SECTIONS.—The table of sections 
for chapter 35 of title 44, United States Code, is 
amended by striking the item relating to section 3555 
and inserting the following: 
‘‘3555. Independent evaluation.’’. 
(2) OMB REPORTS.—Section 226(c) of the Cy-
bersecurity Act of 2015 (6 U.S.C. 1524(c)) is amend-
ed— 
(A) in paragraph (1)(B), in the matter pre-
ceding clause (i), by striking ‘‘annually there-
after’’ and inserting ‘‘thereafter during the years 
during which a report is required to be sub-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
mitted under section 3553(c) of title 44, United 
States Code’’; and 
(B) in paragraph (2)(B), in the matter pre-
ceding clause (i)— 
(i) by striking ‘‘annually thereafter’’ 
and inserting ‘‘thereafter during the years 
during which a report is required to be sub-
mitted under section 3553(c) of title 44, 
United States Code’’; and 
(ii) by striking ‘‘the report required 
under section 3553(c) of title 44, United 
States Code’’ and inserting ‘‘that report’’. 
(3) 
NIST 
RESPONSIBILITIES.—Section 
20(d)(3)(B) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3(d)(3)(B)) is 
amended by striking ‘‘annual’’. 
(e) FEDERAL SYSTEM INCIDENT RESPONSE.— 
(1) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT 
RESPONSE 
‘‘§ 3591. Definitions 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(b), the definitions under sections 3502 and 3552 shall 
apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this sub-
chapter: 
‘‘(1) APPROPRIATE REPORTING ENTITIES.—The 
term ‘appropriate reporting entities’ means— 
‘‘(A) the majority and minority leaders of 
the Senate; 
‘‘(B) the Speaker and minority leader of the 
House of Representatives; 
‘‘(C) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(D) the Committee on Commerce, Science, 
and Transportation of the Senate; 
‘‘(E) the Committee on Oversight and Ac-
countability of the House of Representatives; 
‘‘(F) the Committee on Homeland Security 
of the House of Representatives; 
‘‘(G) the Committee on Science, Space, and 
Technology of the House of Representatives; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(H) the appropriate authorization and ap-
propriations committees of Congress; 
‘‘(I) the Director; 
‘‘(J) the Director of the Cybersecurity and 
Infrastructure Security Agency; 
‘‘(K) the National Cyber Director; 
‘‘(L) the Comptroller General of the United 
States; and 
‘‘(M) the inspector general of any impacted 
agency. 
‘‘(2) AWARDEE.—The term ‘awardee’, with re-
spect to an agency— 
‘‘(A) means— 
‘‘(i) the recipient of a grant from an 
agency; 
‘‘(ii) a party to a cooperative agree-
ment with an agency; and 
‘‘(iii) a party to an other transaction 
agreement with an agency; and 
‘‘(B) includes a subawardee of an entity de-
scribed in subparagraph (A). 
‘‘(3) BREACH.—The term ‘breach’— 
‘‘(A) means the compromise, unauthorized 
disclosure, unauthorized acquisition, or loss of 
control of personally identifiable information 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
owned, maintained or otherwise controlled by an 
agency, or any similar occurrence; and 
‘‘(B) includes any additional meaning 
given the term in policies, principles, standards, 
or guidelines issued by the Director. 
‘‘(4) CONTRACTOR.—The term ‘contractor’ means 
a prime contractor of an agency or a subcontractor 
of a prime contractor of an agency that creates, col-
lects, stores, processes, maintains, or transmits Fed-
eral information on behalf of an agency. 
‘‘(5) FEDERAL INFORMATION.—The term ‘Fed-
eral information’ means information created, col-
lected, processed, maintained, disseminated, disclosed, 
or disposed of by or for the Federal Government in 
any medium or form. 
‘‘(6) FEDERAL INFORMATION SYSTEM.—The term 
‘Federal information system’ means an information 
system owned, managed, or operated by an agency, or 
on behalf of an agency by a contractor, an awardee, 
or another organization. 
‘‘(7) INTELLIGENCE COMMUNITY.—The term ‘in-
telligence community’ has the meaning given the term 
in section 3 of the National Security Act of 1947 (50 
U.S.C. 3003). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(8) NATIONWIDE CONSUMER REPORTING AGEN-
CY.—The term ‘nationwide consumer reporting agen-
cy’ means a consumer reporting agency described in 
section 603(p) of the Fair Credit Reporting Act (15 
U.S.C. 1681a(p)). 
‘‘(9) VULNERABILITY
DISCLOSURE.—The term 
‘vulnerability disclosure’ means a vulnerability iden-
tified under section 3559B. 
‘‘§ 3592. Notification of breach 
‘‘(a) DEFINITION.—In this section, the term ‘covered 
breach’ means a breach— 
‘‘(1) involving not less than 50,000 potentially 
affected individuals; or 
‘‘(2) the result of which the head of an agency 
determines that notifying potentially affected individ-
uals is necessary pursuant to subsection (b)(1), re-
gardless of whether— 
‘‘(A) the number of potentially affected in-
dividuals is less than 50,000; or 
‘‘(B) the notification is delayed under sub-
section (d). 
‘‘(b) NOTIFICATION.—As expeditiously as practicable 
and without unreasonable delay, and in any case not later 
than 45 days after an agency has a reasonable basis to con-
clude that a breach has occurred, the head of the agency, 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
in consultation with the Chief Information Officer and 
Chief Privacy Officer of the agency and, as appropriate, 
any non-Federal entity supporting the remediation of the 
breach, shall— 
‘‘(1) determine whether notice to any individual 
potentially affected by the breach is appropriate, in-
cluding by conducting an assessment of the risk of 
harm to the individual that considers— 
‘‘(A) the nature and sensitivity of the per-
sonally identifiable information affected by the 
breach; 
‘‘(B) the likelihood of access to and use of 
the personally identifiable information affected 
by the breach; 
‘‘(C) the type of breach; and 
‘‘(D) any other factors determined by the 
Director; and 
‘‘(2) if the head of the agency determines notifi-
cation is necessary pursuant to paragraph (1), pro-
vide written notification in accordance with sub-
section (c) to each individual potentially affected by 
the breach— 
‘‘(A) to the last known mailing address of 
the individual; or 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) through an appropriate alternative 
method of notification. 
‘‘(c) CONTENTS OF NOTIFICATION.—Each notification 
of a breach provided to an individual under subsection 
(b)(2) shall include, to the maximum extent practicable— 
‘‘(1) a brief description of the breach; 
‘‘(2) if possible, a description of the types of per-
sonally identifiable information affected by the 
breach; 
‘‘(3) contact information of the agency that may 
be used to ask questions of the agency, which— 
‘‘(A) shall include an e-mail address or an-
other digital contact mechanism; and 
‘‘(B) may include a telephone number, 
mailing address, or a website; 
‘‘(4) information on any remedy being offered by 
the agency; 
‘‘(5) any applicable educational materials relat-
ing to what individuals can do in response to a 
breach that potentially affects their personally identi-
fiable information, including relevant contact infor-
mation for the appropriate Federal law enforcement 
agencies and each nationwide consumer reporting 
agency; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(6) any other appropriate information, as de-
termined by the head of the agency or established in 
guidance by the Director. 
‘‘(d) DELAY OF NOTIFICATION.— 
‘‘(1) IN GENERAL.—The head of an agency, in 
coordination with the Director and the National 
Cyber Director, and as appropriate, the Attorney 
General, the Director of National Intelligence, or the 
Secretary of Homeland Security, may delay a notifi-
cation required under subsection (b) or (e) if the noti-
fication would— 
‘‘(A) impede a criminal investigation or a 
national security activity; 
‘‘(B) cause an adverse result (as described 
in section 2705(a)(2) of title 18); 
‘‘(C) reveal sensitive sources and methods; 
‘‘(D) cause damage to national security; or 
‘‘(E) hamper security remediation actions. 
‘‘(2) RENEWAL.—A delay under paragraph (1) 
shall be for a period of 60 days and may be renewed. 
‘‘(3) NATIONAL SECURITY SYSTEMS.—The head 
of an agency delaying notification under this sub-
section with respect to a breach exclusively of a na-
tional security system shall coordinate such delay 
with the Secretary of Defense. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(e) UPDATE NOTIFICATION.—If an agency determines 
there is a significant change in the reasonable basis to con-
clude that a breach occurred, a significant change to the 
determination made under subsection (b)(1), or that it is 
necessary to update the details of the information provided 
to potentially affected individuals as described in subsection 
(c), the agency shall as expeditiously as practicable and 
without unreasonable delay, and in any case not later than 
30 days after such a determination, notify each individual 
who received a notification pursuant to subsection (b) of 
those changes. 
‘‘(f) DELAY OF NOTIFICATION REPORT.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Federal Information Se-
curity Modernization Act of 2024, and annually 
thereafter, the head of an agency, in coordination 
with any official who delays a notification under sub-
section (d), shall submit to the appropriate reporting 
entities a report on each delay that occurred during 
the previous 2 years. 
‘‘(2) COMPONENT OF OTHER REPORT.—The head 
of an agency may submit the report required under 
paragraph (1) as a component of the report submitted 
under section 3554(c). 
‘‘(g) CONGRESSIONAL REPORTING REQUIREMENTS.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) REVIEW
AND
UPDATE.—On a periodic 
basis, the Director of the Office of Management and 
Budget shall review, and update as appropriate, 
breach notification policies and guidelines for agen-
cies. 
‘‘(2) REQUIRED NOTICE FROM AGENCIES.—Sub-
ject to paragraph (4), the Director of the Office of 
Management and Budget shall require the head of an 
agency affected by a covered breach to expeditiously 
and not later than 30 days after the date on which 
the agency discovers the covered breach give notice of 
the breach, which may be provided electronically, to— 
‘‘(A) each congressional committee described 
in section 3554(c)(1); and 
‘‘(B) the Committee on the Judiciary of the 
Senate and the Committee on the Judiciary of 
the House of Representatives. 
‘‘(3) CONTENTS OF NOTICE.—Notice of a covered 
breach provided by the head of an agency pursuant 
to paragraph (2) shall include, to the extent prac-
ticable— 
‘‘(A) information about the covered breach, 
including a summary of any information about 
how the covered breach occurred known by the 
agency as of the date of the notice; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) an estimate of the number of individ-
uals affected by the covered breach based on in-
formation known by the agency as of the date of 
the notice, including an assessment of the risk of 
harm to affected individuals; 
‘‘(C) a description of any circumstances ne-
cessitating a delay in providing notice to indi-
viduals affected by the covered breach in accord-
ance with subsection (d); and 
‘‘(D) an estimate of when the agency will 
provide notice to individuals affected by the cov-
ered breach, if applicable. 
‘‘(4) EXCEPTION.—Any agency that is required 
to provide notice to Congress pursuant to paragraph 
(2) due to a covered breach exclusively on a national 
security system shall only provide such notice to— 
‘‘(A) the majority and minority leaders of 
the Senate; 
‘‘(B) the Speaker and minority leader of the 
House of Representatives; 
‘‘(C) the appropriations committees of Con-
gress; 
‘‘(D) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(E) the Select Committee on Intelligence of 
the Senate; 
‘‘(F) the Committee on Oversight and Ac-
countability of the House of Representatives; and 
‘‘(G) the Permanent Select Committee on 
Intelligence of the House of Representatives. 
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in 
paragraphs (1) through (3) shall be construed to alter 
any authority of an agency. 
‘‘(h) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to— 
‘‘(1) limit— 
‘‘(A) the authority of the Director to issue 
guidance relating to notifications of, or the head 
of an agency to notify individuals potentially af-
fected by, breaches that are not determined to be 
covered breaches or major incidents; 
‘‘(B) the authority of the Director to issue 
guidance relating to notifications and reporting 
of breaches, covered breaches, or major incidents; 
‘‘(C) the authority of the head of an agency 
to provide more information than required under 
subsection (b) when notifying individuals poten-
tially affected by a breach; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(D) the timing of incident reporting or the 
types of information included in incident reports 
provided, pursuant to this subchapter, to— 
‘‘(i) the Director; 
‘‘(ii) the National Cyber Director; 
‘‘(iii) the Director of the Cybersecurity 
and Infrastructure Security Agency; or 
‘‘(iv) any other agency; 
‘‘(E) the authority of the head of an agency 
to provide information to Congress about agency 
breaches, including— 
‘‘(i) breaches that are not covered 
breaches; and 
‘‘(ii) additional information beyond 
the information described in subsection 
(g)(3); or 
‘‘(F) any congressional reporting require-
ments of agencies under any other law; or 
‘‘(2) limit or supersede any existing privacy pro-
tections in existing law. 
‘‘§ 3593. Congressional and executive branch reports 
on major incidents 
‘‘(a) APPROPRIATE CONGRESSIONAL ENTITIES.—In 
this section, the term ‘appropriate congressional entities’ 
means— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) the majority and minority leaders of the 
Senate; 
‘‘(2) the Speaker and minority leader of the 
House of Representatives; 
‘‘(3) the Committee on Homeland Security and 
Governmental Affairs of the Senate; 
‘‘(4) the Committee on Commerce, Science, and 
Transportation of the Senate; 
‘‘(5) the Committee on Oversight and Account-
ability of the House of Representatives; 
‘‘(6) the Committee on Homeland Security of the 
House of Representatives; 
‘‘(7) the Committee on Science, Space, and Tech-
nology of the House of Representatives; and 
‘‘(8) the appropriate authorization and appro-
priations committees of Congress. 
‘‘(b) INITIAL NOTIFICATION.— 
‘‘(1) IN GENERAL.—Not later than 72 hours after 
an agency has a reasonable basis to conclude that a 
major incident occurred, the head of the agency im-
pacted by the major incident shall submit to the ap-
propriate reporting entities a written notification, 
which may be submitted electronically and include 1 
or more annexes that contain classified or other sen-
sitive information, as appropriate. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(2) CONTENTS.—A notification required under 
paragraph (1) with respect to a major incident shall 
include the following, based on information available 
to agency officials as of the date on which the agency 
submits the notification: 
‘‘(A) A summary of the information avail-
able about the major incident, including how the 
major incident occurred and the threat causing 
the major incident. 
‘‘(B) If applicable, information relating to 
any breach associated with the major incident, 
regardless of whether— 
‘‘(i) the breach was the reason the inci-
dent was determined to be a major incident; 
and 
‘‘(ii) head of the agency determined it 
was appropriate to provide notification to 
potentially impacted individuals pursuant 
to section 3592(b)(1). 
‘‘(C) A preliminary assessment of the im-
pacts to— 
‘‘(i) the agency; 
‘‘(ii) the Federal Government; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(iii) the national security, foreign re-
lations, homeland security, and economic 
security of the United States; and 
‘‘(iv) the civil liberties, public con-
fidence, privacy, and public health and 
safety of the people of the United States. 
‘‘(D) If applicable, whether any ransom has 
been demanded or paid, or is expected to be 
paid, by any entity operating a Federal infor-
mation system or with access to Federal infor-
mation or a Federal information system, includ-
ing, as available, the name of the entity demand-
ing ransom, the date of the demand, and the 
amount and type of currency demanded, unless 
disclosure of such information will disrupt an 
active Federal law enforcement or national secu-
rity operation. 
‘‘(c) SUPPLEMENTAL UPDATE.—Within a reasonable 
amount of time, but not later than 30 days after the date 
on which the head of an agency submits a written notifica-
tion under subsection (b), the head of the agency shall pro-
vide to the appropriate congressional entities an unclassi-
fied and written update, which may include 1 or more an-
nexes that contain classified or other sensitive information, 
as appropriate, on the major incident, based on informa-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
tion available to agency officials as of the date on which 
the agency provides the update, on— 
‘‘(1) system vulnerabilities relating to the major 
incident, where applicable, means by which the major 
incident occurred, the threat causing the major inci-
dent, where applicable, and impacts of the major inci-
dent to— 
‘‘(A) the agency; 
‘‘(B) other Federal agencies, Congress, or 
the judicial branch; 
‘‘(C) the national security, foreign relations, 
homeland security, or economic security of the 
United States; or 
‘‘(D) the civil liberties, public confidence, 
privacy, or public health and safety of the people 
of the United States; 
‘‘(2) the status of compliance of the affected Fed-
eral information system with applicable security re-
quirements at the time of the major incident; 
‘‘(3) if the major incident involved a breach, a 
description of the affected information, an estimate of 
the number of individuals potentially impacted, and 
any assessment to the risk of harm to such individ-
uals; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(4) an update to the assessment of the risk to 
agency operations, or to impacts on other agency or 
non-Federal entity operations, affected by the major 
incident; 
‘‘(5) the detection, response, and remediation ac-
tions of the agency, including any support provided 
by the Cybersecurity and Infrastructure Security 
Agency under section 3594(d), if applicable; 
‘‘(6) as appropriate and available, actions un-
dertaken by any non-Federal entities impacted by or 
supporting remediation of the major incident; and 
‘‘(7) as appropriate and available, recommenda-
tions for mitigating future similar incidents, includ-
ing recommendations from any non-Federal entity 
impacted by or supporting the remediation of the 
major incident. 
‘‘(d) ADDITIONAL UPDATE.—If the head of an agency, 
the Director, or the National Cyber Director determines that 
there is any significant change in the understanding of the 
scope, scale, or consequence of a major incident for which 
the head of the agency submitted a written notification and 
update under subsections (b) and (c), the head of the agency 
shall submit to the appropriate congressional entities a 
written update that includes information relating to the 
change in understanding. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(e) BIENNIAL REPORT.—Each agency shall submit as 
part of the biennial report required under section 
3554(c)(1) a description of each major incident that oc-
curred during the 2-year period preceding the date on which 
the biennial report is submitted. 
‘‘(f) REPORT DELIVERY.— 
‘‘(1) IN GENERAL.—Any written notification or 
update required to be submitted under this section— 
‘‘(A) shall be submitted in an electronic for-
mat; and 
‘‘(B) may be submitted in a paper format. 
‘‘(2) CLASSIFICATION STATUS.—Any written no-
tification or update required to be submitted under 
this section— 
‘‘(A) shall be— 
‘‘(i) unclassified; and 
‘‘(ii) submitted through unclassified 
electronic means pursuant to paragraph 
(1)(A); and 
‘‘(B) may include classified annexes, as ap-
propriate. 
‘‘(g) REPORT CONSISTENCY.—To achieve consistent 
and coherent agency reporting to Congress, the National 
Cyber Director, in coordination with the Director, shall— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) provide recommendations to agencies on for-
matting and the contents of information to be in-
cluded in the reports required under this section, in-
cluding recommendations for consistent formats for 
presenting any associated metrics; and 
‘‘(2) maintain a comprehensive record of each 
major incident notification, update, and briefing pro-
vided under this section, which shall— 
‘‘(A) include, at a minimum— 
‘‘(i) the full contents of the written no-
tification or update; 
‘‘(ii) the identity of the reporting agen-
cy; and 
‘‘(iii) the date of submission; and 
‘‘(iv) a list of the recipient congres-
sional entities; and 
‘‘(B) be made available upon request to the 
majority and minority leaders of the Senate, the 
Speaker and minority leader of the House of 
Representatives, the Committee on Homeland Se-
curity and Governmental Affairs of the Senate, 
and the Committee on Oversight and Account-
ability of the House of Representatives. 
‘‘(h) NATIONAL SECURITY SYSTEMS CONGRESSIONAL 
REPORTING EXEMPTION.—With respect to a major incident 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
that occurs exclusively on a national security system, the 
head of the affected agency shall submit the notifications 
and reports required to be submitted to Congress under this 
section only to— 
‘‘(1) the majority and minority leaders of the 
Senate; 
‘‘(2) the Speaker and minority leader of the 
House of Representatives; 
‘‘(3) the appropriations committees of Congress; 
‘‘(4) the appropriate authorization committees of 
Congress; 
‘‘(5) the Committee on Homeland Security and 
Governmental Affairs of the Senate; 
‘‘(6) the Select Committee on Intelligence of the 
Senate; 
‘‘(7) the Committee on Oversight and Account-
ability of the House of Representatives; and 
‘‘(8) the Permanent Select Committee on Intel-
ligence of the House of Representatives. 
‘‘(i) MAJOR INCIDENTS INCLUDING BREACHES.—If a 
major incident constitutes a covered breach, as defined in 
section 3592(a), information on the covered breach required 
to be submitted to Congress pursuant to section 3592(g) 
may— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) be included in the notifications required 
under subsection (b) or (c); or 
‘‘(2) be reported to Congress under the process es-
tablished under section 3592(g). 
‘‘(j) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to— 
‘‘(1) limit— 
‘‘(A) the ability of an agency to provide ad-
ditional reports or briefings to Congress; 
‘‘(B) Congress from requesting additional 
information from agencies through reports, brief-
ings, or other means; and 
‘‘(C) any congressional reporting require-
ments of agencies under any other law; or 
‘‘(2) limit or supersede any privacy protections 
under any other law. 
‘‘§ 3594. Government information sharing and inci-
dent response 
‘‘(a) IN GENERAL.— 
‘‘(1) INCIDENT SHARING.—Subject to paragraph 
(4) and subsection (b), and in accordance with the 
applicable 
requirements 
pursuant 
to 
section 
3553(b)(2)(A) for reporting to the Federal informa-
tion security incident center established under section 
3556, the head of each agency shall provide to the Cy-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
bersecurity and Infrastructure Security Agency infor-
mation relating to any incident affecting the agency, 
whether the information is obtained by the Federal 
Government directly or indirectly. 
‘‘(2) CONTENTS.—A provision of information re-
lating to an incident made by the head of an agency 
under paragraph (1) shall include, at a minimum— 
‘‘(A) a full description of the incident, in-
cluding— 
‘‘(i) all indicators of compromise and 
tactics, techniques, and procedures; 
‘‘(ii) an indicator of how the intruder 
gained initial access, accessed agency data 
or systems, and undertook additional ac-
tions on the network of the agency; 
‘‘(iii) information that would support 
enabling defensive measures; and 
‘‘(iv) other information that may assist 
in identifying other victims; 
‘‘(B) information to help prevent similar 
incidents, such as information about relevant 
safeguards in place when the incident occurred 
and the effectiveness of those safeguards; and 
‘‘(C) information to aid in incident re-
sponse, such as— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(i) a description of the affected sys-
tems or networks; 
‘‘(ii) the estimated dates of when the 
incident occurred; and 
‘‘(iii) information that could reason-
ably help identify any malicious actor that 
may have conducted or caused the incident, 
subject to appropriate privacy protections. 
‘‘(3) INFORMATION
SHARING.—The Director of 
the Cybersecurity and Infrastructure Security Agency 
shall— 
‘‘(A) make incident information provided 
under paragraph (1) available to the Director 
and the National Cyber Director; 
‘‘(B) to the greatest extent practicable, share 
information relating to an incident with— 
‘‘(i) the head of any agency that may 
be— 
‘‘(I) impacted by the incident; 
‘‘(II) particularly susceptible to 
the incident; or 
‘‘(III) similarly targeted by the 
incident; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(ii) appropriate Federal law enforce-
ment agencies to facilitate any necessary 
threat response activities, as requested; 
‘‘(C) coordinate any necessary information 
sharing efforts relating to a major incident with 
the private sector; and 
‘‘(D) notify the National Cyber Director of 
any efforts described in subparagraph (C). 
‘‘(4) NATIONAL
SECURITY
SYSTEMS
EXEMP-
TION.— 
‘‘(A) IN GENERAL.—Notwithstanding para-
graphs (1) and (3), each agency operating or ex-
ercising control of a national security system 
shall share information about an incident that 
occurs exclusively on a national security system 
with the Secretary of Defense, the Director, the 
National Cyber Director, and the Director of the 
Cybersecurity and Infrastructure Security Agen-
cy to the extent consistent with standards and 
guidelines for national security systems issued in 
accordance with law and as directed by the 
President. 
‘‘(B) 
PROTECTIONS.—Any 
information 
sharing and handling of information under this 
paragraph shall be appropriately protected con-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
sistent with procedures authorized for the protec-
tion of sensitive sources and methods or by pro-
cedures established for information that have 
been specifically authorized under criteria estab-
lished by an Executive order or an Act of Con-
gress to be kept classified in the interest of na-
tional defense or foreign policy. 
‘‘(b) AUTOMATION.—In providing information and se-
lecting a method to provide information under subsection 
(a), the head of each agency shall implement subsection 
(a)(1) in a manner that provides such information to the 
Cybersecurity and Infrastructure Security Agency in an 
automated and machine-readable format, to the greatest ex-
tent practicable. 
‘‘(c) INCIDENT RESPONSE.—Each agency that has a 
reasonable basis to suspect or conclude that a major inci-
dent occurred involving Federal information in electronic 
medium or form that does not exclusively involve a national 
security system shall coordinate with— 
‘‘(1) the Cybersecurity and Infrastructure Secu-
rity Agency to facilitate asset response activities and 
provide recommendations for mitigating future inci-
dents; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(2) consistent with relevant policies, appro-
priate Federal law enforcement agencies to facilitate 
threat response activities. 
‘‘§ 3595. Responsibilities of contractors and awardees 
‘‘(a) NOTIFICATION.— 
‘‘(1) IN GENERAL.—Any contractor or awardee 
of an agency shall provide written notification to the 
agency if the contractor or awardee has a reasonable 
basis to conclude that— 
‘‘(A) an incident or breach has occurred 
with respect to Federal information the con-
tractor or awardee collected, used, or maintained 
on behalf of an agency; 
‘‘(B) an incident or breach has occurred 
with respect to a Federal information system 
used, operated, managed, or maintained on be-
half of an agency by the contractor or awardee; 
‘‘(C) a component of any Federal informa-
tion system operated, managed, or maintained 
by a contractor or awardee contains a security 
vulnerability, including a supply chain com-
promise or an identified software or hardware 
vulnerability, for which there is reliable evidence 
of a successful exploitation of the vulnerability 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
by an actor without authorization of the Federal 
information system owner; or 
‘‘(D) the contractor or awardee has received 
from the agency personally identifiable informa-
tion or personal health information that is be-
yond the scope of the contract or agreement with 
the agency that the contractor or awardee is not 
authorized to receive. 
‘‘(2) 
THIRD-PARTY
NOTIFICATION
OF 
VULNERABILITIES.—Subject to the guidance issued by 
the Director pursuant to paragraph (4), any con-
tractor or awardee of an agency shall provide written 
notification to the agency and the Cybersecurity and 
Infrastructure Security Agency if the contractor or 
awardee has a reasonable basis to conclude that a 
component of any Federal information system oper-
ated, managed, or maintained on behalf of an agency 
by the contractor or awardee on behalf of the agency 
contains a security vulnerability, including a supply 
chain compromise or an identified software or hard-
ware vulnerability, that has been reported to the con-
tractor or awardee by a third party, including 
through a vulnerability disclosure program. 
‘‘(3) PROCEDURES.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(A) SHARING
WITH
CISA.—As soon as 
practicable following a notification of an inci-
dent or vulnerability to an agency by a con-
tractor or awardee under paragraph (1), the 
head of the agency shall provide, pursuant to sec-
tion 3594, information about the incident or vul-
nerability to the Director of the Cybersecurity 
and Infrastructure Security Agency. 
‘‘(B) TIMING OF NOTIFICATIONS.—Unless a 
different time for notification is specified in a 
contract, grant, cooperative agreement, or other 
transaction agreement, a contractor or awardee 
shall— 
‘‘(i) make a notification required 
under paragraph (1) not later than 1 day 
after the date on which the contractor or 
awardee has reasonable basis to suspect or 
conclude that the criteria under paragraph 
(1) have been met; and 
‘‘(ii) make a notification required 
under paragraph (2) within a reasonable 
time, but not later than 90 days after the 
date on which the contractor or awardee has 
reasonable basis to suspect or conclude that 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
the criteria under paragraph (2) have been 
met. 
‘‘(C) PROCEDURES.—Following a notifica-
tion of a breach or incident to an agency by a 
contractor or awardee under paragraph (1), the 
head of the agency, in consultation with the con-
tractor or awardee, shall carry out the applicable 
requirements under sections 3592, 3593, and 
3594 with respect to the breach or incident. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing in 
subparagraph (B) shall be construed to allow the 
negation 
of 
the 
requirements 
to 
notify 
vulnerabilities under paragraph (1) or (2) 
through a contract, grant, cooperative agreement, 
or other transaction agreement. 
‘‘(4) GUIDANCE.—The Director shall issue guid-
ance as soon as practicable to agencies relating to the 
scope of vulnerabilities to be included in required no-
tifications under paragraph (2), such as the min-
imum severity or minimum risk level of a vulner-
ability included in required notifications, whether 
vulnerabilities that are already publicly disclosed 
must be reported, or likely cybersecurity impact to 
Federal information systems. 
‘‘(b) REGULATIONS; MODIFICATIONS.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) IN GENERAL.—Not later than 2 years after 
the date of enactment of the Federal Information Se-
curity Modernization Act of 2024— 
‘‘(A) the Federal Acquisition Regulatory 
Council shall promulgate regulations, as appro-
priate, relating to the responsibilities of contrac-
tors and recipients of other transaction agree-
ments and cooperative agreements to comply 
with this section; and 
‘‘(B) the Office of Federal Financial Man-
agement shall promulgate regulations under title 
2, Code of Federal Regulations, as appropriate, 
relating to the responsibilities of grantees to com-
ply with this section. 
‘‘(2) IMPLEMENTATION.—Not later than 1 year 
after the date on which the Federal Acquisition Regu-
latory Council and the Office of Federal Financial 
Management promulgates regulations under para-
graph (1), the head of each agency shall implement 
policies and procedures, as appropriate, necessary to 
implement those regulations. 
‘‘(3) CONGRESSIONAL NOTIFICATION.— 
‘‘(A) IN GENERAL.—The head of each agen-
cy head shall notify the Director upon imple-
mentation of policies and procedures necessary to 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
implement the regulations promulgated under 
paragraph (1). 
‘‘(B) OMB NOTIFICATION.— Not later than 
30 days after the date described in paragraph 
(2), the Director shall notify the Committee on 
Homeland Security and Governmental Affairs of 
the Senate and the Committees on Oversight and 
Accountability and Homeland Security of the 
House of Representatives on the status of the im-
plementation by each agency of the regulations 
promulgated under paragraph (1). 
‘‘(c) ALLOWABLE USE.—Information provided to an 
agency pursuant to this section may be disclosed to, re-
tained by, and used by any agency, component, officer, em-
ployee, or agent of the Federal Government solely for any 
of the following: 
‘‘(1) A cybersecurity purpose (as defined in sec-
tion 2200 of the Homeland Security Act of 2002 (6 
U.S.C. 650)). 
‘‘(2) Identifying— 
‘‘(A) a cyber threat (as defined in such sec-
tion 2200), including the source of the cyber 
threat; or 
‘‘(B) a security vulnerability (as defined in 
such section 2200). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(3) Preventing, investigating, disrupting, or 
prosecuting an offense arising out of an incident noti-
fied to an agency pursuant to this section or any of 
the offenses listed in section 105(d)(5)(A)(v) of the Cy-
bersecurity Information Sharing Act of 2015 (6 
U.S.C. 1504(d)(5)(A)(v)). 
‘‘(d) HARMONIZATION
OF OTHER PRIVATE-SECTOR 
CYBERSECURITY
REPORTING
OBLIGATIONS.—Any non- 
Federal entity required to report an incident under section 
2242 of the Homeland Security Act of 2002 (6 U.S.C. 681b) 
may submit as part of the written notification requirements 
in this section all information required by such section 2242 
to the agency of which the entity is a contractor or recipient 
of Federal financial assistance, or with which the entity 
holds an other transaction agreement or cooperative agree-
ment, 
within 
the 
deadline 
specified 
in 
subsection 
(a)(3)(B)(1). If such submission is completed, the non-Fed-
eral entity shall not be required to subsequently report the 
same incident under the requirements of such section 2242. 
Any incident information shared under this subsection shall 
be shared with the Director of the Cybersecurity and Infra-
structure Security Agency pursuant to subsection (a)(3)(A). 
‘‘(e) NATIONAL SECURITY SYSTEMS EXEMPTION.— 
Notwithstanding any other provision of this section, a con-
tractor or awardee of an agency that would be required to 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
report an incident or vulnerability pursuant to this section 
that occurs exclusively on a national security system 
shall— 
‘‘(1) report the incident or vulnerability to the 
head of the agency and the Secretary of Defense; and 
‘‘(2) comply with applicable laws and policies 
relating to national security systems. 
‘‘§ 3596. Training 
‘‘(a) COVERED INDIVIDUAL DEFINED.—In this section, 
the term ‘covered individual’ means an individual who ob-
tains access to a Federal information system because of the 
status of the individual as— 
‘‘(1) an employee, contractor, awardee, volunteer, 
or intern of an agency; or 
‘‘(2) an employee of a contractor or awardee of 
an agency. 
‘‘(b) BEST PRACTICES AND CONSISTENCY.—The Direc-
tor of the Cybersecurity and Infrastructure Security Agen-
cy, in consultation with the Director, the National Cyber 
Director, and the Director of the National Institute of 
Standards and Technology, shall consolidate best practices 
to support consistency across agencies in cybersecurity inci-
dent response training, including— 
‘‘(1) information to be collected and shared with 
the Cybersecurity and Infrastructure Security Agency 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
pursuant to section 3594(a) and processes for sharing 
such information; and 
‘‘(2) appropriate training and qualifications for 
cyber incident responders. 
‘‘(c) AGENCY TRAINING.—The head of each agency 
shall develop training for covered individuals on how to 
identify and respond to an incident, including— 
‘‘(1) the internal process of the agency for report-
ing an incident; and 
‘‘(2) the obligation of a covered individual to re-
port to the agency any suspected or confirmed inci-
dent involving Federal information in any medium 
or form, including paper, oral, and electronic. 
‘‘(d) INCLUSION IN ANNUAL TRAINING.—The training 
developed under subsection (c) may be included as part of 
an annual privacy, security awareness, or other appro-
priate training of an agency. 
‘‘§ 3597. Analysis and report on Federal incidents 
‘‘(a) ANALYSIS OF FEDERAL INCIDENTS.— 
‘‘(1) QUANTITATIVE
AND
QUALITATIVE
ANAL-
YSES.—The Director of the Cybersecurity and Infra-
structure Security Agency shall perform and, in co-
ordination with the Director and the National Cyber 
Director, develop, continuous monitoring and quan-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
titative and qualitative analyses of incidents at agen-
cies, including major incidents, including— 
‘‘(A) the causes of incidents, including— 
‘‘(i) attacker tactics, techniques, and 
procedures; and 
‘‘(ii) system vulnerabilities, including 
zero days, unpatched systems, and informa-
tion system misconfigurations; 
‘‘(B) the scope and scale of incidents at 
agencies; 
‘‘(C) common root causes of incidents across 
multiple agencies; 
‘‘(D) agency incident response, recovery, 
and remediation actions and the effectiveness of 
those actions, as applicable; 
‘‘(E) lessons learned and recommendations 
in responding to, recovering from, remediating, 
and mitigating future incidents; and 
‘‘(F) trends across multiple agencies to ad-
dress intrusion detection and incident response 
capabilities using the metrics established under 
section 224(c) of the Cybersecurity Act of 2015 (6 
U.S.C. 1522(c)). 
‘‘(2) AUTOMATED ANALYSIS.—The analyses de-
veloped under paragraph (1) shall, to the greatest ex-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
tent practicable, use machine-readable data, automa-
tion, and machine learning processes. 
‘‘(3) SHARING OF DATA AND ANALYSIS.— 
‘‘(A) IN GENERAL.—The Director of the Cy-
bersecurity and Infrastructure Security Agency 
shall share on an ongoing basis the analyses and 
underlying data required under this subsection 
with agencies, the Director, and the National 
Cyber Director to— 
‘‘(i) improve the understanding of cy-
bersecurity risk of agencies; and 
‘‘(ii) support the cybersecurity im-
provement efforts of agencies. 
‘‘(B) FORMAT.—In carrying out subpara-
graph (A), the Director of the Cybersecurity and 
Infrastructure Security Agency shall share the 
analyses— 
‘‘(i) in human-readable written prod-
ucts; and 
‘‘(ii) to the greatest extent practicable, 
in machine-readable formats in order to en-
able automated intake and use by agencies. 
‘‘(C) EXEMPTION.—This subsection shall 
not apply to incidents that occur exclusively on 
national security systems. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(b) ANNUAL REPORT ON FEDERAL INCIDENTS.—Not 
later than 2 years after the date of enactment of this section, 
and not less frequently than annually thereafter, the Direc-
tor of the Cybersecurity and Infrastructure Security Agen-
cy, in consultation with the Director, the National Cyber 
Director and the heads of other agencies, as appropriate, 
shall submit to the appropriate reporting entities a report 
that includes— 
‘‘(1) a summary of causes of incidents from 
across the Federal Government that categorizes those 
incidents as incidents or major incidents; 
‘‘(2) the quantitative and qualitative analyses of 
incidents developed under subsection (a)(1) on an 
agency-by-agency basis and comprehensively across 
the Federal Government, including— 
‘‘(A) a specific analysis of breaches; and 
‘‘(B) an analysis of the Federal Govern-
ment’s performance against the metrics estab-
lished under section 224(c) of the Cybersecurity 
Act of 2015 (6 U.S.C. 1522(c)); and 
‘‘(3) an annex for each agency that includes— 
‘‘(A) a description of each major incident; 
‘‘(B) the total number of incidents of the 
agency; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(C) an analysis of the agency’s perform-
ance against the metrics established under sec-
tion 224(c) of the Cybersecurity Act of 2015 (6 
U.S.C. 1522(c)). 
‘‘(c) PUBLICATION.— 
‘‘(1) IN GENERAL.—The Director of the Cyberse-
curity and Infrastructure Security Agency shall make 
a version of each report submitted under subsection 
(b) publicly available on the website of the Cybersecu-
rity and Infrastructure Security Agency during the 
year during which the report is submitted. 
‘‘(2) EXEMPTION.—The publication requirement 
under paragraph (1) shall not apply to a portion of 
a report that contains content that should be protected 
in the interest of national security, as determined by 
the Director, the Director of the Cybersecurity and In-
frastructure Security Agency, or the National Cyber 
Director. 
‘‘(3) LIMITATION ON EXEMPTION.—The exemp-
tion under paragraph (2) shall not apply to any 
version of a report submitted to the appropriate re-
porting entities under subsection (b). 
‘‘(4) REQUIREMENT
FOR
COMPILING
INFORMA-
TION.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(A) COMPILATION.—Subject to subpara-
graph (B), in making a report publicly available 
under paragraph (1), the Director of the Cyberse-
curity and Infrastructure Security Agency shall 
sufficiently compile information so that no spe-
cific incident of an agency can be identified. 
‘‘(B) EXCEPTION.—The Director of the Cy-
bersecurity and Infrastructure Security Agency 
may include information that enables a specific 
incident of an agency to be identified in a pub-
licly available report— 
‘‘(i) with the concurrence of the Direc-
tor and the National Cyber Director; 
‘‘(ii) in consultation with the impacted 
agency, which may, as appropriate, consult 
with any non-Federal entity impacted by or 
supporting the remediation of such incident; 
and 
‘‘(iii) in consultation with the inspec-
tor general of the impacted agency. 
‘‘(d) INFORMATION PROVIDED BY AGENCIES.— 
‘‘(1) IN GENERAL.—The analysis required under 
subsection (a) and each report submitted under sub-
section (b) shall use information provided by agencies 
under section 3594(a). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(2) NONCOMPLIANCE
REPORTS.—During any 
year during which the head of an agency does not 
provide data for an incident to the Cybersecurity and 
Infrastructure Security Agency in accordance with 
section 3594(a), the head of the agency, in coordina-
tion with the Director of the Cybersecurity and Infra-
structure Security Agency and the Director, shall sub-
mit to the appropriate reporting entities a report that 
includes the information described in subsection (b) 
with respect to the agency. 
‘‘(e) NATIONAL SECURITY SYSTEM REPORTS.— 
‘‘(1) IN GENERAL.—Notwithstanding any other 
provision of this section, the Secretary of Defense, in 
consultation with the Director, the National Cyber 
Director, the Director of National Intelligence, and 
the Director of the Cybersecurity and Infrastructure 
Security Agency shall annually submit a report that 
includes the information described in subsection (b) 
with respect to national security systems, to the extent 
that the submission is consistent with standards and 
guidelines for national security systems issued in ac-
cordance with law and as directed by the President, 
to— 
‘‘(A) the majority and minority leaders of 
the Senate; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) the Speaker and minority leader of the 
House of Representatives; 
‘‘(C) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(D) the Select Committee on Intelligence of 
the Senate; 
‘‘(E) the Committee on Armed Services of 
the Senate; 
‘‘(F) the Committee on Appropriations of 
the Senate; 
‘‘(G) the Committee on Oversight and Ac-
countability of the House of Representatives; 
‘‘(H) the Committee on Homeland Security 
of the House of Representatives; 
‘‘(I) the Permanent Select Committee on In-
telligence of the House of Representatives; 
‘‘(J) the Committee on Armed Services of 
the House of Representatives; and 
‘‘(K) the Committee on Appropriations of 
the House of Representatives. 
‘‘(2) CLASSIFIED
FORM.—A report required 
under paragraph (1) may be submitted in a classified 
form. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘§ 3598. Major incident definition 
‘‘(a) IN GENERAL.—Not later than 1 year after the 
later of the date of enactment of the Federal Information 
Security Modernization Act of 2024 and the most recent 
publication by the Director of guidance to agencies regard-
ing major incidents as of the date of enactment of the Fed-
eral Information Security Modernization Act of 2024, the 
Director shall develop, in coordination with the National 
Cyber Director, and promulgate guidance on the definition 
of the term ‘major incident’ for the purposes of subchapter 
II and this subchapter. 
‘‘(b) REQUIREMENTS.—With respect to the guidance 
issued under subsection (a), the definition of the term 
‘major incident’ shall— 
‘‘(1) include, with respect to any information 
collected or maintained by or on behalf of an agency 
or a Federal information system— 
‘‘(A) any incident the head of the agency 
determines is likely to result in demonstrable 
harm to— 
‘‘(i) the national security interests, for-
eign relations, homeland security, or eco-
nomic security of the United States; or 
‘‘(ii) the civil liberties, public con-
fidence, privacy, or public health and safety 
of the people of the United States; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) any incident the head of the agency 
determines likely to result in an inability or sub-
stantial disruption for the agency, a component 
of the agency, or the Federal Government, to pro-
vide 1 or more critical services; 
‘‘(C) any incident the head of the agency 
determines substantially disrupts or substan-
tially degrades the operations of a high value 
asset owned or operated by the agency; 
‘‘(D) any incident involving the exposure to 
a foreign entity of sensitive agency information, 
such as the communications of the head of the 
agency, the head of a component of the agency, 
or the direct reports of the head of the agency or 
the head of a component of the agency; and 
‘‘(E) any other type of incident determined 
appropriate by the Director; 
‘‘(2) stipulate that the National Cyber Director, 
in consultation with the Director and the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy, may declare a major incident at any agency, and 
such a declaration shall be considered if it is deter-
mined that an incident— 
‘‘(A) occurs at not less than 2 agencies; and 
‘‘(B) is enabled by— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(i) a common technical root cause, 
such as a supply chain compromise, or a 
common software or hardware vulnerability; 
or 
‘‘(ii) the related activities of a common 
threat actor; 
‘‘(3) stipulate that, in determining whether an 
incident constitutes a major incident under the stand-
ards described in paragraph (1), the head of the agen-
cy shall consult with the National Cyber Director; 
and 
‘‘(4) stipulate that the mere report of a vulner-
ability discovered or disclosed without a loss of con-
fidentiality, integrity, or availability shall not on its 
own constitute a major incident. 
‘‘(c) EVALUATION AND UPDATES.—Not later than 60 
days after the date on which the Director first promulgates 
the guidance required under subsection (a), and not less fre-
quently than once during the first 90 days of each evenly 
numbered Congress thereafter, the Director shall provide to 
the Committee on Homeland Security and Governmental 
Affairs of the Senate and the Committees on Oversight and 
Accountability and Homeland Security of the House of 
Representatives a briefing that includes— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) an evaluation of any necessary updates to 
the guidance; 
‘‘(2) an evaluation of any necessary updates to 
the definition of the term ‘major incident’ included in 
the guidance; and 
‘‘(3) an explanation of, and the analysis that led 
to, the definition described in paragraph (2).’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions for chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT RESPONSE 
‘‘3591. Definitions. 
‘‘3592. Notification of breach. 
‘‘3593. Congressional and executive branch reports on major incidents. 
‘‘3594. Government information sharing and incident response. 
‘‘3595. Responsibilities of contractors and awardees. 
‘‘3596. Training. 
‘‘3597. Analysis and report on Federal incidents. 
‘‘3598. Major incident definition.’’. 
SEC. 4. AMENDMENTS TO SUBTITLE III OF TITLE 40. 
(a) MODERNIZING GOVERNMENT TECHNOLOGY.—Sub-
title G of title X of division A of the National Defense Au-
thorization Act for Fiscal Year 2018 (40 U.S.C. 11301 note) 
is amended in section 1078— 
(1) by striking subsection (a) and inserting the 
following: 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) AGENCY.—The term ‘agency’ has the mean-
ing given the term in section 551 of title 5, United 
States Code. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(2) HIGH VALUE ASSET.—The term ‘high value 
asset’ has the meaning given the term in section 3552 
of title 44, United States Code.’’; 
(2) in subsection (b), by adding at the end the 
following: 
‘‘(8) 
PROPOSAL
EVALUATION.—The 
Director 
shall— 
‘‘(A) give consideration for the use of 
amounts in the Fund to improve the security of 
high value assets; and 
‘‘(B) require that any proposal for the use 
of amounts in the Fund includes, as appro-
priate, and which may be incorporated into oth-
erwise required project proposal documenta-
tion— 
‘‘(i) cybersecurity risk management 
considerations; and 
‘‘(ii) a supply chain risk assessment in 
accordance with section 1326 of title 41.’’; 
and 
(3) in subsection (c)— 
(A) in paragraph (2)(A)(i), by inserting ‘‘, 
including a consideration of the impact on high 
value assets’’ after ‘‘operational risks’’; 
(B) in paragraph (5)— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘; and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
‘‘(C) a senior official from the Cybersecurity 
and Infrastructure Security Agency of the De-
partment of Homeland Security, appointed by 
the Director.’’; and 
(C) in paragraph (6)(A), by striking ‘‘shall 
be—’’ and all that follows through ‘‘4 employees’’ 
and inserting ‘‘shall be 4 employees’’. 
(b) SUBCHAPTER I.—Subchapter I of chapter 113 of 
subtitle III of title 40, United States Code, is amended— 
(1) in section 11302— 
(A) in subsection (b), by striking ‘‘use, secu-
rity, and disposal of’’ and inserting ‘‘use, and 
disposal of, and, in consultation with the Direc-
tor of the Cybersecurity and Infrastructure Secu-
rity Agency and the National Cyber Director, 
promote and improve the security of,’’; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
SEC. 5. ACTIONS TO ENHANCE FEDERAL INCIDENT TRANS-
PARENCY. 
(a) RESPONSIBILITIES OF THE CYBERSECURITY AND 
INFRASTRUCTURE SECURITY AGENCY.— 
(1) IN GENERAL.—Not later than 180 days after 
the date of enactment of this Act, the Director of the 
Cybersecurity and Infrastructure Security Agency 
shall— 
(A) develop a plan for the development, 
using systems in place on the date of enactment 
of this Act, of the analysis required under section 
3597(a) of title 44, United States Code, as added 
by this Act, and the report required under sub-
section (b) of that section that includes— 
(i) a description of any challenges the 
Director of the Cybersecurity and Infra-
structure Security Agency anticipates en-
countering; and 
(ii) the use of automation and ma-
chine-readable formats for collecting, com-
piling, monitoring, and analyzing data; 
and 
(B) provide to the appropriate congressional 
committees a briefing on the plan developed 
under subparagraph (A). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(2) BRIEFING.—Not later than 1 year after the 
date of enactment of this Act, the Director of the Cy-
bersecurity and Infrastructure Security Agency shall 
provide to the appropriate congressional committees a 
briefing on— 
(A) the execution of the plan required under 
paragraph (1)(A); and 
(B) the development of the report required 
under section 3597(b) of title 44, United States 
Code, as added by this Act. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE OF-
FICE OF MANAGEMENT AND BUDGET.— 
(1) UPDATING FISMA 2014.—Section 2 of the Fed-
eral Information Security Modernization Act of 2014 
(Public Law 113–283; 128 Stat. 3073) is amended— 
(A) by striking subsections (b) and (d); and 
(B) by redesignating subsections (c), (e), 
and (f) as subsections (b), (c), and (d), respec-
tively. 
(2) INCIDENT DATA SHARING.— 
(A) IN GENERAL.—The Director, in coordi-
nation with the Director of the Cybersecurity 
and Infrastructure Security Agency, shall de-
velop, and as appropriate update, guidance, on 
the content, timeliness, and format of the infor-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
mation provided by agencies under section 
3594(a) of title 44, United States Code, as added 
by this Act. 
(B) REQUIREMENTS.—The guidance devel-
oped under subparagraph (A) shall— 
(i) enable the efficient development 
of— 
(I) 
lessons 
learned 
and 
rec-
ommendations in responding to, recov-
ering from, remediating, and miti-
gating future incidents; and 
(II) the report on Federal inci-
dents required under section 3597(b) of 
title 44, United States Code, as added 
by this Act; and 
(ii) include requirements for the time-
liness of data production. 
(C) AUTOMATION.—The Director, in coordi-
nation with the Director of the Cybersecurity 
and Infrastructure Security Agency, shall pro-
mote, as feasible, the use of automation and ma-
chine-readable data for data sharing under sec-
tion 3594(a) of title 44, United States Code, as 
added by this Act. 
(3) CONTRACTOR AND AWARDEE GUIDANCE.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(A) IN GENERAL.—Not later than 1 year 
after the date of enactment of this Act, the Direc-
tor shall issue guidance to agencies on how to 
deconflict, to the greatest extent practicable, ex-
isting regulations, policies, and procedures relat-
ing to the responsibilities of contractors and 
awardees established under section 3595 of title 
44, United States Code, as added by this Act. 
(B) EXISTING PROCESSES.—To the greatest 
extent practicable, the guidance issued under 
subparagraph (A) shall allow contractors and 
awardees to use existing processes for notifying 
agencies of incidents involving information of 
the Federal Government. 
(c) UPDATE TO THE PRIVACY ACT OF 1974.—Section 
552a(b) of title 5, United States Code (commonly known 
as the ‘‘Privacy Act of 1974’’) is amended— 
(1) in paragraph (11), by striking ‘‘or’’ at the 
end; 
(2) in paragraph (12), by striking the period at 
the end and inserting ‘‘; or’’; and 
(3) by adding at the end the following: 
‘‘(13) to another agency, to the extent necessary, 
to assist the recipient agency in responding to an in-
cident (as defined in section 3552 of title 44) or 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
breach (as defined in section 3591 of title 44) or to 
fulfill the information sharing requirements under 
section 3594 of title 44.’’. 
SEC. 6. AGENCY REQUIREMENTS TO NOTIFY PRIVATE SEC-
TOR ENTITIES IMPACTED BY INCIDENTS. 
(a) DEFINITIONS.—In this section: 
(1) REPORTING ENTITY.—The term ‘‘reporting 
entity’’ means private organization or governmental 
unit that is required by statute or regulation to sub-
mit sensitive information to an agency. 
(2) SENSITIVE INFORMATION.—The term ‘‘sen-
sitive information’’ has the meaning given the term 
by the Director in guidance issued under subsection 
(b). 
(b) GUIDANCE ON NOTIFICATION OF REPORTING ENTI-
TIES.—Not later than 1 year after the date of enactment 
of this Act, the Director shall develop, in consultation with 
the National Cyber Director, and issue guidance requiring 
the head of each agency to notify a reporting entity in an 
appropriate and timely manner, and take into consider-
ation the need to coordinate with Sector Risk Management 
Agencies (as defined in section 2200 of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 650)), as appropriate, of an inci-
dent at the agency that is likely to substantially affect— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(1) the confidentiality or integrity of sensitive 
information submitted by the reporting entity to the 
agency pursuant to a statutory or regulatory require-
ment; or 
(2) any information system (as defined in sec-
tion 3502 of title 44, United States Code) used in the 
transmission or storage of the sensitive information 
described in paragraph (1). 
SEC. 7. FEDERAL PENETRATION TESTING POLICY. 
(a) IN GENERAL.—Subchapter II of chapter 35 of title 
44, United States Code, is amended by adding at the end 
the following: 
‘‘§ 3559A. Federal penetration testing 
‘‘(a) GUIDANCE.—The Director, in consultation with 
the Director of the Cybersecurity and Infrastructure Secu-
rity Agency, shall issue guidance to agencies that— 
‘‘(1) requires agencies to perform penetration 
testing on information systems, as appropriate, in-
cluding on high value assets; 
‘‘(2) provides policies governing the development 
of— 
‘‘(A) rules of engagement for using penetra-
tion testing; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) procedures to use the results of pene-
tration testing to improve the cybersecurity and 
risk management of the agency; 
‘‘(3) ensures that operational support or a 
shared service is available; and 
‘‘(4) in no manner restricts the authority of the 
Secretary of Homeland Security or the Director of the 
Cybersecurity and Infrastructure Agency to conduct 
threat hunting pursuant to section 3553, or penetra-
tion testing under this chapter. 
‘‘(b) EXCEPTION
FOR
NATIONAL
SECURITY
SYS-
TEMS.—The guidance issued under subsection (a) shall not 
apply to national security systems. 
‘‘(c) DELEGATION OF AUTHORITY FOR CERTAIN SYS-
TEMS.—The authorities of the Director described in sub-
section (a) shall be delegated to— 
‘‘(1) the Secretary of Defense in the case of a sys-
tem described in section 3553(e)(2); and 
‘‘(2) the Director of National Intelligence in the 
case of a system described in section 3553(e)(3).’’. 
(b) EXISTING GUIDANCE.— 
(1) IN
GENERAL.—Compliance with guidance 
issued by the Director relating to penetration testing 
before the date of enactment of this Act shall be 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
deemed to be compliant with section 3559A of title 44, 
United States Code, as added by this Act. 
(2) 
IMMEDIATE
NEW
GUIDANCE
NOT
RE-
QUIRED.—Nothing in section 3559A of title 44, 
United States Code, as added by this Act, shall be 
construed to require the Director to issue new guid-
ance to agencies relating to penetration testing before 
the date described in paragraph (3). 
(3) 
GUIDANCE
UPDATES.—Notwithstanding 
paragraphs (1) and (2), not later than 2 years after 
the date of enactment of this Act, the Director shall 
review and, as appropriate, update existing guidance 
requiring penetration testing by agencies. 
(c) CLERICAL AMENDMENT.—The table of sections for 
chapter 35 of title 44, United States Code, is amended by 
adding after the item relating to section 3559 the following: 
‘‘3559A. Federal penetration testing.’’. 
(d) PENETRATION TESTING BY THE SECRETARY OF 
HOMELAND SECURITY.—Section 3553(b) of title 44, United 
States Code, as amended by this Act, is further amended 
by inserting after paragraph (8) the following: 
‘‘(9) performing penetration testing that may le-
verage manual expert analysis to identify threats and 
vulnerabilities within information systems— 
‘‘(A) without consent or authorization from 
agencies; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) with prior consultation with the head 
of the agency at least 72 hours in advance of 
such testing;’’. 
SEC. 8. VULNERABILITY DISCLOSURE POLICIES. 
(a) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by inserting after section 3559A, 
as added by this Act, the following: 
‘‘§ 3559B. Federal vulnerability disclosure policies 
‘‘(a) PURPOSE; SENSE OF CONGRESS.— 
‘‘(1) PURPOSE.—The purpose of Federal vulner-
ability disclosure policies is to create a mechanism to 
enable the public to inform agencies of vulnerabilities 
in Federal information systems. 
‘‘(2) SENSE OF CONGRESS.—It is the sense of 
Congress that, in implementing the requirements of 
this section, the Federal Government should take ap-
propriate steps to reduce real and perceived burdens 
in communications between agencies and security re-
searchers. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) CONTRACTOR.—The term ‘contractor’ has 
the meaning given the term in section 3591. 
‘‘(2) INTERNET OF THINGS.—The term ‘internet 
of things’ has the meaning given the term in Special 
Publication 800–213 of the National Institute of 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Standards and Technology, entitled ‘IoT Device Cy-
bersecurity Guidance for the Federal Government: Es-
tablishing IoT Device Cybersecurity Requirements’, or 
any successor document. 
‘‘(3) SECURITY VULNERABILITY.—The term ‘se-
curity vulnerability’ has the meaning given the term 
in section 102 of the Cybersecurity Information Shar-
ing Act of 2015 (6 U.S.C. 1501). 
‘‘(4) SUBMITTER.—The term ‘submitter’ means 
an individual that submits a vulnerability disclosure 
report pursuant to the vulnerability disclosure process 
of an agency. 
‘‘(5) VULNERABILITY DISCLOSURE REPORT.—The 
term ‘vulnerability disclosure report’ means a disclo-
sure of a security vulnerability made to an agency by 
a submitter. 
‘‘(c) GUIDANCE.—The Director shall issue guidance to 
agencies that includes— 
‘‘(1) use of the information system security 
vulnerabilities disclosure process guidelines estab-
lished under section 4(a)(1) of the IoT Cybersecurity 
Improvement Act of 2020 (15 U.S.C. 278g–3b(a)(1)); 
‘‘(2) direction to not recommend or pursue legal 
action against a submitter or an individual that con-
ducts a security research activity that— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(A) represents a good faith effort to iden-
tify and report security vulnerabilities in infor-
mation systems; or 
‘‘(B) otherwise represents a good faith effort 
to follow the vulnerability disclosure policy of the 
agency developed under subsection (f)(2); 
‘‘(3) direction on sharing relevant information 
in a consistent, automated, and machine-readable 
manner with the Director of the Cybersecurity and 
Infrastructure Security Agency; 
‘‘(4) the minimum scope of agency systems re-
quired to be covered by the vulnerability disclosure 
policy of an agency required under subsection (f)(2), 
including exemptions under subsection (g); 
‘‘(5) requirements for providing information to 
the submitter of a vulnerability disclosure report on 
the resolution of the vulnerability disclosure report; 
‘‘(6) a stipulation that the mere identification by 
a submitter of a security vulnerability, without a sig-
nificant compromise of confidentiality, integrity, or 
availability, does not constitute a major incident; and 
‘‘(7) the applicability of the guidance to internet 
of things devices owned or controlled by an agency. 
‘‘(d) CONSULTATION.—In developing the guidance re-
quired under subsection (c)(3), the Director shall consult 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
with the Director of the Cybersecurity and Infrastructure 
Security Agency. 
‘‘(e) RESPONSIBILITIES OF CISA.—The Director of the 
Cybersecurity and Infrastructure Security Agency shall— 
‘‘(1) provide support to agencies with respect to 
the implementation of the requirements of this section; 
‘‘(2) develop tools, processes, and other mecha-
nisms determined appropriate to offer agencies capa-
bilities to implement the requirements of this section; 
‘‘(3) upon a request by an agency, assist the 
agency in the disclosure to vendors of newly identified 
security vulnerabilities in vendor products and serv-
ices; and 
‘‘(4) as appropriate, implement the requirements 
of this section, in accordance with the authority 
under section 3553(b)(8), as a shared service available 
to agencies. 
‘‘(f) RESPONSIBILITIES OF AGENCIES.— 
‘‘(1) PUBLIC INFORMATION.—The head of each 
agency shall make publicly available, with respect to 
each internet domain under the control of the agency 
that is not a national security system and to the ex-
tent consistent with the security of information sys-
tems but with the presumption of disclosure— 
‘‘(A) an appropriate security contact; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
100 
‘‘(B) the component of the agency that is re-
sponsible for the internet accessible services of-
fered at the domain. 
‘‘(2) VULNERABILITY DISCLOSURE POLICY.—The 
head of each agency shall develop and make publicly 
available a vulnerability disclosure policy for the 
agency, which shall— 
‘‘(A) describe— 
‘‘(i) the scope of the systems of the 
agency included in the vulnerability disclo-
sure policy, including for internet of things 
devices owned or controlled by the agency; 
‘‘(ii) the type of information system 
testing that is authorized by the agency; 
‘‘(iii) the type of information system 
testing that is not authorized by the agency; 
‘‘(iv) the disclosure policy for a con-
tractor; and 
‘‘(v) the disclosure policy of the agency 
for sensitive information; 
‘‘(B) with respect to a vulnerability disclo-
sure report to an agency, describe— 
‘‘(i) how the submitter should submit 
the vulnerability disclosure report; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
101 
‘‘(ii) if the report is not anonymous, 
when the reporter should anticipate an ac-
knowledgment of receipt of the report by the 
agency; 
‘‘(C) include any other relevant informa-
tion; and 
‘‘(D) be mature in scope and cover every 
internet accessible information system used or 
operated by that agency or on behalf of that 
agency. 
‘‘(3) IDENTIFIED SECURITY VULNERABILITIES.— 
The head of each agency shall— 
‘‘(A) consider security vulnerabilities re-
ported in accordance with paragraph (2); 
‘‘(B) commensurate with the risk posed by 
the security vulnerability, address such security 
vulnerability using the security vulnerability 
management process of the agency; and 
‘‘(C) in accordance with subsection (c)(5), 
provide information to the submitter of a vulner-
ability disclosure report. 
‘‘(g) EXEMPTIONS.— 
‘‘(1) IN GENERAL.—The Director and the head of 
each agency shall carry out this section in a manner 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
102 
consistent with the protection of national security in-
formation. 
‘‘(2) LIMITATION.—The Director and the head of 
each agency may not publish under subsection (f)(1) 
or include in a vulnerability disclosure policy under 
subsection (f)(2) host names, services, information 
systems, or other information that the Director or the 
head of an agency, in coordination with the Director 
and other appropriate heads of agencies, determines 
would— 
‘‘(A) disrupt a law enforcement investiga-
tion; 
‘‘(B) endanger national security or intel-
ligence activities; or 
‘‘(C) impede national defense activities or 
military operations. 
‘‘(3) NATIONAL SECURITY SYSTEMS.—This sec-
tion shall not apply to national security systems. 
‘‘(h) DELEGATION OF AUTHORITY FOR CERTAIN SYS-
TEMS.—The authorities of the Director and the Director of 
the Cybersecurity and Infrastructure Security Agency de-
scribed in this section shall be delegated— 
‘‘(1) to the Secretary of Defense in the case of 
systems described in section 3553(e)(2); and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
103 
‘‘(2) to the Director of National Intelligence in 
the case of systems described in section 3553(e)(3). 
‘‘(i) REVISION OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be revised 
as necessary to implement the provisions under this sec-
tion.’’. 
(b) EXISTING GUIDANCE AND POLICIES.— 
(1) IN
GENERAL.—Compliance with guidance 
issued by the Director relating to vulnerability disclo-
sure policies before the date of enactment of this Act 
shall be deemed to be compliance with section 3559B 
of title 44, United States Code, as added by this title. 
(2) 
IMMEDIATE
NEW
GUIDANCE
NOT
RE-
QUIRED.—Nothing in section 3559B of title 44, 
United States Code, as added by this title, shall be 
construed to require the Director to issue new guid-
ance to agencies relating to vulnerability disclosure 
policies before the date described in paragraph (4). 
(3) IMMEDIATE NEW POLICIES NOT REQUIRED.— 
Nothing in section 3559B of title 44, United States 
Code, as added by this title, shall be construed to re-
quire the head of any agency to issue new policies re-
lating to vulnerability disclosure policies before the 
issuance of any updated guidance under paragraph 
(4). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
104 
(4) GUIDANCE UPDATE.—Notwithstanding para-
graphs (1), (2) and (3), not later than 4 years after 
the date of enactment of this Act, the Director shall 
review and, as appropriate, update existing guidance 
relating to vulnerability disclosure policies. 
(c) CLERICAL AMENDMENT.—The table of sections for 
chapter 35 of title 44, United States Code, is amended by 
adding after the item relating to section 3559A, as added 
by this Act, the following: 
‘‘3559B. Federal vulnerability disclosure policies.’’. 
(d) CONFORMING UPDATE AND REPEAL.— 
(1) GUIDELINES ON THE DISCLOSURE PROCESS 
FOR
SECURITY
VULNERABILITIES
RELATING
TO
IN-
FORMATION
SYSTEMS, 
INCLUDING
INTERNET
OF 
THINGS DEVICES.—Section 5 of the IoT Cybersecurity 
Improvement Act of 2020 (15 U.S.C. 278g–3c) is 
amended by striking subsections (d) and (e). 
(2) IMPLEMENTATION AND CONTRACTOR COMPLI-
ANCE.—The IoT Cybersecurity Improvement Act of 
2020 (15 U.S.C. 278g–3a et seq.) is amended— 
(A) by striking section 6 (15 U.S.C. 278g– 
3d); and 
(B) by striking section 7 (15 U.S.C. 278g– 
3e). 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB