I 
115TH CONGRESS 
2D SESSION 
H. R. 7283 
To provide minimal cybersecurity operational standards for Internet-connected 
devices purchased by Federal agencies, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 12, 2018 
Ms. KELLY of Illinois (for herself and Mr. TED LIEU of California) introduced 
the following bill; which was referred to the Committee on Oversight and 
Government Reform, and in addition to the Committee on Science, Space, 
and Technology, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To provide minimal cybersecurity operational standards for 
Internet-connected devices purchased by Federal agen-
cies, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Things 
(IoT) Federal Cybersecurity Improvement Act of 2018’’. 
SEC. 2. FINDINGS; SENSE OF CONGRESS. 
(a) FINDINGS.—Congress finds the following: 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(1) The trust of the American people in the 
safety and security of their Government’s digital 
technologies, including the Internet of Things, is 
vital for advancing digital technology transforma-
tion. 
(2) Digital technology transformation portends 
tremendous opportunity for our nation to improve 
the daily lives of the American people and grow the 
economy. 
(3) The risk of exposure of Government, busi-
nesses, and individual citizens to malicious cyberat-
tacks grows dramatically if digital transformation is 
not managed with vigorous attention to cybersecu-
rity concerns, and failure to protect the Government 
systems that control our critical infrastructure and 
essential Government networks could have dev-
astating consequences. 
(4) Intelligence and national security leaders, 
including the Director of the Defense Intelligence 
Agency, have described Internet of Things (IoT) de-
vices as among the ‘‘most important emerging 
cyberthreats to our national security’’. 
(5) The Federal Government cannot achieve a 
high level of cybersecurity unless cybersecurity be-
VerDate Sep 11 2014 
00:12 Dec 18, 2018
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
comes the task of every person involved with Federal 
networks and devices. 
(6) Anchoring responsibility for cybersecurity at 
the top of governmental organizations is critical to 
set the correct mindset that enhancing cybersecurity 
of the Federal Government’s networks and devices is 
the responsibility of every Government employee to 
the extent practicable. 
(b) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) ensuring the highest level of cybersecurity 
at Government agencies is the responsibility of the 
President, followed by the Director of the Office of 
Management and Budget, and the head of each ex-
ecutive agency; 
(2) this responsibility is to be carried out by 
working collaboratively within and among executive 
agencies, industry, and academia; and 
(3) the strength of the Government’s cybersecu-
rity and the positive benefits of digital technology 
transformation depend on proactively addressing cy-
bersecurity throughout the Government’s acquisition 
and operation of IoT devices. 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
SEC. 3. CONTRACTOR MINIMUM SECURITY REQUIREMENTS 
FOR COVERED DEVICES. 
(a) STANDARD SECURITY CLAUSE REQUIRED
IN 
COVERED DEVICES.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Di-
rector in consultation with the Secretary of Defense, 
the Administrator of General Services, the Secretary 
of Commerce, the Secretary of Homeland Security, 
and any other intelligence or national security agen-
cy that the Director determines to be necessary shall 
issue guidelines for each executive agency that re-
quire the inclusion of a standard security clause in 
any contract (except as provided in paragraph (4)) 
for the acquisition of covered devices. 
(2) 
CONTENTS
OF
STANDARD
SECURITY 
CLAUSE.—The standard security clause required 
under paragraph (1) shall— 
(A) establish baseline security require-
ments that address aspects of device security 
relating to covered devices, including— 
(i) a requirement that software or 
firmware components accept properly au-
thenticated and trusted updates from the 
vendor; 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(ii) requirements relating to identity 
and access management, including a prohi-
bition of the use of fixed or hard-coded 
credentials used for remote administration, 
the delivery of updates, or communication; 
(iii) a requirement that the contractor 
participate in a coordinated vulnerability 
disclosure program training on the guide-
lines issued pursuant to subsection (f); and 
(iv) any other requirement the Direc-
tor determines to be appropriate; 
(B) require contractors to provide written 
attestation that the device meets such require-
ments as established under subparagraph (A); 
(C) to the maximum extent practicable, en-
sure that the requirements established under 
subparagraph (A) are— 
(i) tailored to address the characteris-
tics of different types of devices, including 
risk and intended function; 
(ii) based on technology-neutral, out-
come-based security principles; 
(iii) developed through a transparent 
process that incorporates input from rel-
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
evant stakeholders in industry and aca-
demia; 
(iv) aligned with internationally recog-
nized technical standards; and 
(v) updated regularly based on devel-
opments in technology and security meth-
odologies; 
(D) an identification of contractor respon-
sibilities to ensure that a covered device soft-
ware or firmware component is updated or re-
placed, consistent with other provisions in the 
contract governing the term of support, in a 
manner that allows for any future security vul-
nerability or defect in any part of the software 
or firmware to be patched, based on risk, in 
order to fix or remove a vulnerability or defect 
in the software or firmware component in a 
properly authenticated and secure manner; and 
(E) a requirement for the contractor to 
provide the purchasing agency with general in-
formation on the ability of the device to be up-
dated, such as— 
(i) the manner in which the device re-
ceives security updates; 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(ii) the business terms, including any 
fees for ongoing security support, under 
which security updates will be provided for 
a covered device; 
(iii) the anticipated timeline for end-
ing security support associated with the 
covered device; 
(iv) formal notification when security 
support has ceased; and 
(v) any other information the Director 
determines to be necessary. 
(3) VOLUNTARY CONSENSUS STANDARDS.—The 
Director shall ensure that, to the maximum extent 
practicable, the baseline security described in para-
graph (2)(A) reflects and aligns with existing vol-
untary consensus standards. 
(4) WAIVER OF REQUIREMENT BY AGENCIES.— 
The Director may establish a process for the Chief 
Information Officer of an executive agency to waive 
the requirements under this subsection for a case in 
which a petition is submitted by an entity seeking to 
enter into a contract with the executive agency and 
the following requirements are met: 
(A) A waiver is granted only in limited cir-
cumstances, including when an entity dem-
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
onstrates that a covered device meets a desired 
level of security through means other than 
those required under paragraph (2)(A) or when 
the executive agency reasonably believes that 
procurement of a covered device with limited 
data processing and software functionality 
would be unfeasible or economically impractical. 
(B) The Chief Information Officer of an 
executive agency that approves a waiver under 
this paragraph shall provide the entity a written 
statement that the executive agency accepts any 
risk resulting from use of the covered device. 
(5) ALIGNMENT WITH FISMA.—In issuing the 
guidelines required under paragraph (1), the Direc-
tor, in consultation with the Administrator of Gen-
eral Services, shall ensure that such guidelines are, 
to the greatest extent practicable, consistent with, 
non-duplicative of, and in compliance with any appli-
cable established information security policies, proce-
dures, standards, and compliance requirements 
under the subchapter II of chapter 35 of title 44, 
United States Code. 
(b) ALTERNATE CONDITIONS TO MITIGATE CYBER-
SECURITY RISKS.— 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Di-
rector, in consultation with NIST, shall define a set 
of conditions that— 
(A) ensure a non-compliant device can be 
used with a level of security that is equivalent 
or greater to the baseline security requirements 
described in subsection (a)(2); and 
(B) shall be met in order for an executive 
agency to purchase such a non-compliant de-
vice. 
(2) REQUIREMENTS.—In defining the set of 
conditions that must be met for non-compliant de-
vices required under paragraph (1), the Director, in 
consultation with NIST and relevant industry enti-
ties, may consider the use of conditions, including— 
(A) network segmentation or micro-seg-
mentation; 
(B) the adoption of system level security 
controls, including operating system containers 
and microservices; 
(C) multi-factor authentication; and 
(D) network access control and edge sys-
tems, such as gateways, that can isolate, dis-
able, or remediate connected devices. 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(3) 
SPECIFICATION
OF
ADDITIONAL
PRE-
CAUTIONS.—To address the long-term risk of non- 
compliant devices acquired in accordance with an ex-
ception under this subsection, the Director, in con-
sultation with NIST and private-sector industry ex-
perts and, with respect to medical devices regulated 
under the Federal Food, Drug, and Cosmetics Act, 
in consultation with the Commissioner of Food and 
Drugs, may stipulate additional requirements for 
management and use of non-compliant devices, in-
cluding deadlines for the removal, replacement, or 
disabling of non-compliant devices (or their Internet- 
connectivity), as well as minimal requirements for 
gateway products to ensure the integrity and secu-
rity of the non-compliant devices. 
(4) EXISTING THIRD-PARTY SECURITY STAND-
ARD.— 
(A) IN
GENERAL.—If a voluntary con-
sensus standard for the security of covered de-
vices provides an equivalent or greater level of 
security to that described in subsection (a)(2), 
the Director shall modify the requirements 
under subsection (a)(1) and the security clause 
under subsection (a)(2) to reflect conformity 
with that voluntary consensus standard. 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(B) WRITTEN
CERTIFICATION.—A con-
tractor providing a covered device shall provide 
third-party written certification that the device 
complies with the security requirements of the 
industry certification method of the third party. 
(C) NIST.—NIST, in consultation with 
the Director and the heads of other appropriate 
executive agencies, shall determine— 
(i) accreditation standards for third- 
party certifiers; and 
(ii) whether the standards described 
in clause (i) provide appropriate security 
and are aligned with the guidelines issued 
under subsection (a). 
(5) EXISTING AGENCY SECURITY EVALUATION 
STANDARDS.— 
(A) IN GENERAL.—If an executive agency 
employs a security evaluation process or criteria 
for covered devices that the agency believes pro-
vides an equivalent or greater level of security 
to the baseline security requirements described 
in subsection (a)(2), an executive agency may, 
upon the approval of the Director, continue to 
use that process or criteria in lieu of the re-
quirements under subsection (a)(2). 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(B) NIST.—NIST, in consultation with 
the Director and the heads of other appropriate 
executive agencies, shall determine whether the 
process or criteria described in subparagraph 
(A) provides appropriate security and is aligned 
with the guidelines issued under subsection (a). 
(c) GUIDELINES FOR LOWEST PRICE TECHNICALLY 
ACCEPTABLE SOURCE SELECTION.—Not later than 180 
days after the date of the enactment of this Act, the Direc-
tor, in consultation with the Administrator of General 
Services, shall issue guidelines for each executive agency 
to limit, to the maximum extent practicable, the use of 
lowest price technically acceptable source selection criteria 
in the case of a procurement that is predominately for the 
acquisition of a covered device. 
(d) REPORT TO CONGRESS.—Not later than 5 years 
after the date of the enactment of this Act, the Director 
shall submit to Congress a report on the effectiveness of 
the guidelines required to be issued under subsections (a) 
and (c), which shall include recommendations, if any, for 
legislation necessary to improve cybersecurity in executive 
agency acquisition of covered devices. 
(e) GENERAL WAIVER AUTHORITY FOR DIRECTOR.— 
Beginning on the date that is 5 years after the date of 
the enactment of this Act, the Director may waive, in 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
whole or in part, the requirements of the guidelines or set 
of conditions issued under this section, for an executive 
agency. 
(f) GUIDELINES REGARDING
THE COORDINATED 
DISCLOSURE OF SECURITY VULNERABILITIES AND DE-
FECTS.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Di-
rector, in consultation with the Department of 
Homeland Security and the Department of Justice, 
and cybersecurity researchers and private-sector in-
dustry experts, shall issue guidelines for each execu-
tive agency with respect to any covered device in use 
by the United States Government regarding cyberse-
curity coordinated disclosure requirements that shall 
be required of contractors providing such covered de-
vices to those executive agencies. 
(2) CONTENTS.—The guidelines required under 
paragraph (1) shall include policies and procedures 
for the processing and resolving of potential vulner-
ability information relating to a covered device, 
which shall be, to the maximum extent practicable, 
aligned with Standards 29147 and 30111 of the 
International Standards Organization, or any suc-
cessor standard, such as— 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(A) procedures for the provision of a cov-
ered device to executive agencies by a con-
tractor on how to— 
(i) receive information about potential 
vulnerabilities in the product or online 
service of the contractor; and 
(ii) disseminate resolution information 
about vulnerabilities in the product or on-
line service of the contractor; and 
(B) guidance, including example content, 
on the information items that should be pro-
duced through the implementation of the vul-
nerability disclosure process of the contractor. 
(g) REVISION OF FAR.—The Federal Acquisition 
Regulations System shall be revised to require the inclu-
sion of a standard security clause consistent with the re-
quirements of this section. 
SEC. 4. INVENTORY OF DEVICES. 
(a) IN GENERAL.—Not later than one year after the 
date of the enactment of this Act, the head of each execu-
tive agency shall establish and maintain an inventory of 
covered devices used by the agency procured under the re-
quirements of this Act. 
(b) GUIDELINES.—Not later than 30 days after the 
date of the enactment of this Act, the Director, in con-
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
sultation with the Secretary of Homeland Security, shall 
issue guidelines for executive agencies to develop and man-
age the inventories required under subsection (a), based 
on the Continuous Diagnostics and Mitigation program 
used by the Department of Homeland Security. 
(c) DEVICE DATABASES.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Homeland Security, in consultation with 
the Director shall establish and maintain— 
(A) a database of non-compliant devices 
and the manufacturers of such devices; and 
(B) a database of covered devices and the 
manufacturers of such devices about which the 
Government has received formal notification of 
security support ceasing, as required under sec-
tion 3(a)(2)(E)(iv). 
(2) UPDATES.—The Secretary of Homeland Se-
curity shall update the databases established under 
paragraph (1) not less frequently than every 30 
days. 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
SEC. 5. USE OF BEST PRACTICES IN IDENTIFICATION AND 
TRACKING OF VULNERABILITIES FOR PUR-
POSES OF THE NATIONAL VULNERABILITY 
DATABASE. 
The Director of NIST shall ensure that NIST estab-
lishes, maintains, and uses best practices in the identifica-
tion and tracking of vulnerabilities for purposes of the Na-
tional Vulnerability Database of NIST. 
SEC. 6. DEFINITIONS. 
In this Act: 
(1) COVERED DEVICE.— 
(A) IN GENERAL.—The term ‘‘covered de-
vice’’— 
(i) means a physical object that— 
(I) is capable of connecting to 
and is in regular connection with the 
Internet; and 
(II) has computer processing ca-
pabilities that can collect, send, or re-
ceive data; and 
(ii) does not include advanced or gen-
eral-purpose computing devices, including 
personal computing systems, smart mobile 
communications 
devices, 
programmable 
logic controls, and mainframe computing 
systems. 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(B) OMB EXEMPTION.—The Director may 
exempt additional devices under subparagraph 
(A)(ii) through a process in which interested 
parties may submit a petition for the exemp-
tion. The Director shall act in an expedited 
manner on any such petition submitted. 
(2) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Office of Management and Budg-
et. 
(3) EXECUTIVE AGENCY.—The term ‘‘executive 
agency’’ has the meaning given the term in section 
133 of title 41, United States Code. 
(4) FIRMWARE.—The term ‘‘firmware’’ means a 
computer program and the data stored in hardware, 
typically in read-only memory or programmable 
read-only memory, such that the program and data 
cannot be dynamically written or modified during 
execution of the program. 
(5) FIXED OR HARD-CODED CREDENTIAL.—The 
term ‘‘fixed or hard-coded credential’’ means a 
value, such as a password, token, cryptographic key, 
or other data element used as part of an authentica-
tion mechanism for granting remote access to an in-
formation system or the information of the system, 
that is— 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS
(A) established by a product vendor or 
service provider; and 
(B) incapable of being modified or revoked 
by the user or manufacturer lawfully operating 
the information system, except through a 
firmware update. 
(6) GATEWAY PRODUCT.—The term ‘‘gateway 
product’’ means a node or device that connects to 
multiple networks using standard protocols. 
(7) HARDWARE.—The term ‘‘hardware’’ means 
the physical components of an information system. 
(8) NIST.—The term ‘‘NIST’’ means the Na-
tional Institute of Standards and Technology. 
(9) NON-COMPLIANT DEVICE.—The term ‘‘non- 
compliant device’’ means a covered device that does 
not meet the baseline security requirements estab-
lished in section 3(a)(2)(A). 
(10) PROPERLY
AUTHENTICATED
UPDATE.— 
The term ‘‘properly authenticated update’’ means an 
update, remediation, or technical fix to a hardware, 
firmware, or software component issued by a prod-
uct vendor or service provider used to correct par-
ticular problems with the component, and that, in 
the case of software or firmware, contains some 
method of authenticity protection, such as a digital 
VerDate Sep 11 2014 
02:55 Dec 15, 2018
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H7283.IH
H7283
kjohnson on DSK79L0C42 with BILLS