SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Things Cy-
bersecurity Improvement Act of 2020’’ or the ‘‘IoT Cyber-
security Improvement Act of 2020’’. 
SEC. 2. SENSE OF CONGRESS. 
It is the sense of Congress that— 
(1) ensuring the highest level of cybersecurity 
at agencies in the executive branch is the responsi-
bility of the President, followed by the Director of 
the Office of Management and Budget, the Sec-
retary of Homeland Security, and the head of each 
such agency; 
(2) this responsibility is to be carried out by 
working collaboratively within and among agencies 
in the executive branch, industry, and academia; 
(3) the strength of the cybersecurity of the 
Federal Government and the positive benefits of dig-
ital technology transformation depend on proactively 
addressing cybersecurity throughout the acquisition 
and operation of Internet of Things devices by the 
Federal Government; and 
(4) consistent with the second draft National 
Institute for Standards and Technology Interagency 
or Internal Report 8259 titled ‘‘Recommendations 
for IoT Device Manufacturers: Foundational Activi-
ties and Core Device Cybersecurity Capability Base-
line’’, published in January 2020, Internet of Things 
devices are devices that— 
(A) have at least one transducer (sensor or 
actuator) for interacting directly with the phys-
ical world, have at least one network interface, 
and are not conventional Information Tech-
nology devices, such as smartphones and 
laptops, for which the identification and imple-
mentation of cybersecurity features is already 
well understood; and 
(B) can function on their own and are not 
only able to function when acting as a compo-
nent of another device, such as a processor. 
SEC. 3. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given that term in section 3502 of title 44, 
United States Code. 
(2) DIRECTOR OF OMB.—The term ‘‘Director of 
OMB’’ means the Director of the Office of Manage-
ment and Budget. 
(3) DIRECTOR OF THE INSTITUTE.—The term 
‘‘Director of the Institute’’ means the Director of 
the National Institute of Standards and Technology.
(4) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given that term in 
section 3502 of title 44, United States Code. 
(5) NATIONAL SECURITY SYSTEM.—The term 
‘‘national security system’’ has the meaning given 
that term in section 3552(b)(6) of title 44, United 
States Code. 
(6) OPERATIONAL
TECHNOLOGY.—The term 
‘‘operational technology’’ means hardware and soft-
ware that detects or causes a change through the di-
rect monitoring or control of physical devices, proc-
esses, and events in the enterprise. 
(7) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
(8) SECURITY VULNERABILITY.—The term ‘‘se-
curity vulnerability’’ has the meaning given that 
term in section 102(17) of the Cybersecurity Infor-
mation Sharing Act of 2015 (6 U.S.C. 1501(17)). 
SEC. 4. SECURITY STANDARDS AND GUIDELINES FOR 
AGENCIES ON USE AND MANAGEMENT OF 
INTERNET OF THINGS DEVICES. 
(a) NATIONAL
INSTITUTE
OF
STANDARDS
AND 
TECHNOLOGY
DEVELOPMENT
OF
STANDARDS
AND 
GUIDELINES FOR USE OF INTERNET OF THINGS DEVICES 
BY AGENCIES.—
(1) IN GENERAL.—Not later than 90 days after 
the date of the enactment of this Act, the Director 
of the Institute shall develop and publish under sec-
tion 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) standards and 
guidelines for the Federal Government on the appro-
priate use and management by agencies of Internet 
of Things devices owned or controlled by an agency 
and connected to information systems owned or con-
trolled by an agency, including minimum informa-
tion security requirements for managing cybersecu-
rity risks associated with such devices. 
(2) CONSISTENCY WITH ONGOING EFFORTS.— 
The Director of the Institute shall ensure that the 
standards and guidelines developed under paragraph 
(1) are consistent with the efforts of the National 
Institute of Standards and Technology in effect on 
the date of the enactment of this Act— 
(A) regarding— 
(i) examples of possible security 
vulnerabilities of Internet of Things de-
vices; and 
(ii) considerations for managing the 
security vulnerabilities of Internet of 
Things devices; and
(B) with respect to the following consider-
ations for Internet of Things devices: 
(i) Secure Development. 
(ii) Identity management. 
(iii) Patching. 
(iv) Configuration management. 
(3) CONSIDERING RELEVANT STANDARDS.—In 
developing the standards and guidelines under para-
graph (1), the Director of the Institute shall con-
sider relevant standards, guidelines, and best prac-
tices developed by the private sector, agencies, and 
public-private partnerships. 
(b) REVIEW OF AGENCY INFORMATION SECURITY 
POLICIES AND PRINCIPLES.— 
(1) REQUIREMENT.—Not later than 180 days 
after the date on which the Director of the Institute 
completes the development of the standards and 
guidelines required under subsection (a), the Direc-
tor of OMB shall review agency information security 
policies and principles on the basis of the standards 
and guidelines published under subsection (a) per-
taining to Internet of Things devices owned or con-
trolled by agencies (excluding agency information se-
curity policies and principles pertaining to Internet 
of Things of devices owned or controlled by agencies
that are or comprise a national security system) for 
consistency with the standards and guidelines sub-
mitted under subsection (a) and issue such policies 
and principles as may be necessary to ensure those 
policies and principles are consistent with such 
standards and guidelines. 
(2) REVIEW.—In reviewing agency information 
security policies and principles under paragraph (1) 
and issuing policies and principles under such para-
graph, as may be necessary, the Director of OMB 
shall— 
(A) consult with the Director of the Cyber-
security and Infrastructure Security Agency of 
the Department of Homeland Security; and 
(B) ensure such policies and principles are 
consistent with the information security require-
ments under subchapter II of chapter 35 of 
title 44, United States Code. 
(3) NATIONAL SECURITY SYSTEMS.—Any policy 
or principle issued by the Director of OMB under 
paragraph (1) shall not apply to national security 
systems. 
(c) QUINQUENNIAL REVIEW AND REVISION.— 
(1) REVIEW AND REVISION OF NIST STANDARDS 
AND GUIDELINES.—Not later than 5 years after the
SEC. 5. GUIDELINES ON THE DISCLOSURE PROCESS FOR 
SECURITY VULNERABILITIES RELATING TO 
INFORMATION SYSTEMS, INCLUDING INTER-
NET OF THINGS DEVICES. 
(a) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Director of the In-
stitute, in consultation with such cybersecurity researchers 
and private sector industry experts as the Director con-
siders appropriate, and in consultation with the Secretary, 
shall develop and publish under section 20 of the National 
Institute of Standards and Technology Act (15 U.S.C. 
278g–3) guidelines— 
(1) for the reporting, coordinating, publishing, 
and receiving of information about— 
(A) a security vulnerability relating to in-
formation systems owned or controlled by an 
agency (including Internet of Things devices 
owned or controlled by an agency); and 
(B) the resolution of such security vulner-
ability; and 
(2) for a contractor providing to an agency an 
information system (including an Internet of Things 
device) and any subcontractor thereof at any tier 
providing such information system to such con-
tractor, on—
(A) receiving information about a potential 
security vulnerability relating to the information 
system; and 
(B) disseminating information about the 
resolution of a security vulnerability relating to 
the information system. 
(b) ELEMENTS.—The guidelines published under 
subsection (a) shall— 
(1) to the maximum extent practicable, be 
aligned with industry best practices and Standards 
29147 and 30111 of the International Standards 
Organization (or any successor standard) or any 
other appropriate, relevant, and widely-used stand-
ard; 
(2) incorporate guidelines on— 
(A) receiving information about a potential 
security vulnerability relating to an information 
system owned or controlled by an agency (in-
cluding an Internet of Things device); and 
(B) disseminating information about the 
resolution of a security vulnerability relating to 
an information system owned or controlled by 
an agency (including an Internet of Things de-
vice); and
(3) be consistent with the policies and proce-
dures produced under section 2009(m) of the Home-
land Security Act of 2002 (6 U.S.C. 659(m)). 
(c) INFORMATION ITEMS.—The guidelines published 
under subsection (a) shall include example content, on the 
information items that should be reported, coordinated, 
published, or received pursuant to this section by a con-
tractor, or any subcontractor thereof at any tier, providing 
an information system (including Internet of Things de-
vice) to the Federal Government. 
(d) OVERSIGHT.—The Director of OMB shall oversee 
the implementation of the guidelines published under sub-
section (a). 
(e) OPERATIONAL AND TECHNICAL ASSISTANCE.— 
The Secretary, in consultation with the Director of OMB, 
shall administer the implementation of the guidelines pub-
lished under subsection (a) and provide operational and 
technical assistance in implementing such guidelines. 
SEC. 6. IMPLEMENTATION OF COORDINATED DISCLOSURE 
OF SECURITY VULNERABILITIES RELATING 
TO 
AGENCY 
INFORMATION 
SYSTEMS, 
IN-
CLUDING INTERNET OF THINGS DEVICES. 
(a) AGENCY GUIDELINES REQUIRED.—Not later 
than 2 years after the date of the enactment of this Act, 
the Director of OMB, in consultation with the Secretary,
shall develop and oversee the implementation of policies, 
principles, standards, or guidelines as may be necessary 
to address security vulnerabilities of information systems 
(including Internet of Things devices). 
(b) OPERATIONAL AND TECHNICAL ASSISTANCE.— 
Consistent with section 3553(b) of title 44, United States 
Code, the Secretary, in consultation with the Director of 
OMB, shall provide operational and technical assistance 
to agencies on reporting, coordinating, publishing, and re-
ceiving information about security vulnerabilities of infor-
mation systems (including Internet of Things devices). 
(c) CONSISTENCY WITH GUIDELINES FROM NA-
TIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.— 
The Secretary shall ensure that the assistance provided 
under subsection (b) is consistent with applicable stand-
ards and publications developed by the Director of the In-
stitute. 
(d) REVISION OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be re-
vised as necessary to implement the provisions under this 
section.
SEC. 7. CONTRACTOR COMPLIANCE WITH COORDINATED 
DISCLOSURE 
OF 
SECURITY 
VULNERABILITIES 
RELATING 
TO 
AGENCY 
INTERNET OF THINGS DEVICES. 
(a) PROHIBITION ON PROCUREMENT AND USE.— 
(1) IN GENERAL.—The head of an agency is 
prohibited from procuring or obtaining, renewing a 
contract to procure or obtain, or using an Internet 
of Things device, if the Chief Information Officer of 
that agency determines during a review required by 
section 11319(b)(1)(C) of title 40, United States 
Code, of a contract for such device that the use of 
such device prevents compliance with the standards 
and guidelines developed under section 4 or the 
guidelines published under section 5 with respect to 
such device. 
(2) SIMPLIFIED
ACQUISITION
THRESHOLD.— 
Notwithstanding section 1905 of title 41, United 
States Code, the requirements under paragraph (1) 
shall apply to a contract or subcontract in amounts 
not greater than the simplified acquisition threshold. 
(b) WAIVER.— 
(1) AUTHORITY.—The head of an agency may 
waive the prohibition under subsection (a)(1) with 
respect to an Internet of Things device if the Chief
Information Officer of that agency determines 
that— 
(A) the waiver is necessary in the interest 
of national security; 
(B) procuring, obtaining, or using such de-
vice is necessary for research purposes; or 
(C) such device is secured using alternative 
and effective methods appropriate to the func-
tion of such device. 
(2) AGENCY PROCESS.—The Director of OMB 
shall establish a standardized process for the Chief 
Information Officer of each agency to follow in de-
termining whether the waiver under paragraph (1) 
may be granted. 
(c) REPORTS TO CONGRESS.— 
(1) REPORT.—Every 2 years during the 6-year 
period beginning on the date of the enactment of 
this Act, the Comptroller General of the United 
States shall submit to the Committee on Oversight 
and Reform of the House of Representatives, the 
Committee on Homeland Security of the House of 
Representatives, and the Committee on Homeland 
Security and Governmental Affairs of the Senate a 
report—
SEC. 8. GOVERNMENT ACCOUNTABILITY OFFICE REPORT 
ON CYBERSECURITY CONSIDERATIONS STEM-
MING FROM THE CONVERGENCE OF INFOR-
MATION 
TECHNOLOGY, 
INTERNET 
OF 
THINGS, AND OPERATIONAL TECHNOLOGY 
DEVICES, NETWORKS, AND SYSTEMS. 
(a) BRIEFING.—Not later than 1 year after the date 
of the enactment of this Act, the Comptroller General of 
the United States shall provide a briefing to the Com-
mittee on Oversight and Reform of the House of Rep-
resentatives, the Committee on Homeland Security of the 
House of Representatives, and the Committee on Home-
land Security and Governmental Affairs of the Senate on 
broader Internet of Things efforts, including projects de-
signed 
to 
assist 
in 
managing 
potential 
security 
vulnerabilities associated with the use of traditional infor-
mation technology devices, networks, and systems with— 
(1) Internet of Things devices, networks, and 
systems; and 
(2) operational technology devices, networks, 
and systems. 
(b) REPORT.—Not later than 2 years after the date 
of enactment of this Act, the Comptroller General shall 
submit a report to the Committee on Oversight and Re-
form of the House of Representatives, the Committee on 
Homeland Security of the House of Representatives, and
the Committee on Homeland Security and Governmental 
Affairs of the Senate on broader Internet of Things efforts 
addressed in subsection (a). 
Passed the House of Representatives September 14, 
2020. 
Attest: 
Clerk.
116TH CONGRESS 
2D SESSION 
H. R. 1668 
AN ACT 
To establish minimum security standards for Inter-
net of Things devices owned or controlled by the 
Federal Government, and for other purposes.