113 
(1) AMENDMENT TO FEDERAL CYBERSECURITY 
ENHANCEMENT ACT OF 2015.—Section 225 of the 
Federal Cybersecurity Enhancement Act of 2015 (6 
U.S.C. 1523) is amended by striking subsections (b) 
and (c). 
(2) TITLE 44.—Section 3554 of title 44, United 
States Code, as amended by this Act, is further 
amended by adding at the end the following: 
‘‘(f) SPECIFIC CYBERSECURITY REQUIREMENTS AT 
AGENCIES.— 
‘‘(1) IN
GENERAL.—Consistent with policies, 
standards, guidelines, and directives on information 
security under this subchapter, and except as pro-
vided under paragraph (3), the head of each agency 
shall— 
‘‘(A) identify sensitive and mission critical 
data stored by the agency consistent with the 
inventory required under section 3505(c); 
‘‘(B) assess access controls to the data de-
scribed in subparagraph (A), the need for read-
ily accessible storage of the data, and the need 
of individuals to access the data; 
‘‘(C) encrypt or otherwise render indeci-
pherable to unauthorized users the data de-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
114 
scribed in subparagraph (A) that is stored on 
or transiting agency information systems; 
‘‘(D) implement a single sign-on trusted 
identity platform for individuals accessing each 
public website of the agency that requires user 
authentication, as developed by the Adminis-
trator of General Services in collaboration with 
the Secretary; and 
‘‘(E) implement identity management con-
sistent with section 504 of the Cybersecurity 
Enhancement Act of 2014 (15 U.S.C. 7464), 
including multi-factor authentication, for— 
‘‘(i) remote access to an information 
system; and 
‘‘(ii) each user account with elevated 
privileges on an information system. 
‘‘(2) PROHIBITION.— 
‘‘(A) DEFINITION.—In this paragraph, the 
term ‘internet of things’ has the meaning given 
the term in section 3559B. 
‘‘(B) PROHIBITION.—Consistent with poli-
cies, standards, guidelines, and directives on in-
formation security under this subchapter, and 
except as provided under paragraph (3), the 
head of an agency may not procure, obtain, 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
115 
renew a contract to procure or obtain in any 
amount, notwithstanding section 1905 of title 
41, United States Code, or use an internet of 
things device if the Chief Information Officer of 
the agency determines during a review required 
under section 11319(b)(1)(C) of title 40 of a 
contract for an internet of things device that 
the use of the device prevents compliance with 
the standards and guidelines developed under 
section 4 of the IoT Cybersecurity Improvement 
Act (15 U.S.C. 278g–3b) with respect to the 
device. 
‘‘(3) EXCEPTION.—The requirements under 
paragraph (1) shall not apply to an information sys-
tem for which— 
‘‘(A) the head of the agency, without dele-
gation, has certified to the Director with par-
ticularity that— 
‘‘(i) operational requirements articu-
lated in the certification and related to the 
information system would make it exces-
sively burdensome to implement the cyber-
security requirement; 
‘‘(ii) the cybersecurity requirement is 
not necessary to secure the information 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
116 
system or agency information stored on or 
transiting it; and 
‘‘(iii) the agency has taken all nec-
essary steps to secure the information sys-
tem and agency information stored on or 
transiting it; and 
‘‘(B) the head of the agency has submitted 
the certification described in subparagraph (A) 
to the appropriate congressional committees 
and the authorizing committees of the agency. 
‘‘(4) DURATION OF CERTIFICATION.— 
‘‘(A) IN
GENERAL.—A certification and 
corresponding exemption of an agency under 
paragraph (3) shall expire on the date that is 
4 years after the date on which the head of the 
agency submits the certification under para-
graph (3)(A). 
‘‘(B) RENEWAL.—Upon the expiration of a 
certification of an agency under paragraph (3), 
the head of the agency may submit an addi-
tional certification in accordance with that 
paragraph. 
‘‘(5) RULES
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
117 
‘‘(A) to alter the authority of the Sec-
retary, the Director, or the Director of the Na-
tional Institute of Standards and Technology in 
implementing subchapter II of this title; 
‘‘(B) to affect the standards or process of 
the National Institute of Standards and Tech-
nology; 
‘‘(C) to affect the requirement under sec-
tion 3553(a)(4); or 
‘‘(D) to discourage continued improve-
ments and advancements in the technology, 
standards, policies, and guidelines used to pro-
mote Federal information security. 
‘‘(g) EXCEPTION.— 
‘‘(1) REQUIREMENTS.—The requirements under 
subsection (f)(1) shall not apply to— 
‘‘(A) the Department of Defense; 
‘‘(B) a national security system; or 
‘‘(C) an element of the intelligence commu-
nity. 
‘‘(2) PROHIBITION.—The prohibition under 
subsection (f)(2) shall not apply to— 
‘‘(A) internet of things devices that are or 
comprise a national security system; 
‘‘(B) national security systems; or 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
118 
‘‘(C) a procured internet of things device 
described in subsection (f)(2)(B) that the Chief 
Information Officer of an agency determines 
is— 
‘‘(i) necessary for research purposes; 
or 
‘‘(ii) secured using alternative and ef-
fective methods appropriate to the function 
of the internet of things device.’’. 
(b) REPORT ON EXEMPTIONS.—Section 3554(c)(1) 
of title 44, United States Code, as amended by this Act, 
is further amended— 
(1) in subparagraph (C), by striking ‘‘and’’ at 
the end; 
(2) in subparagraph (D), by striking the period 
at the end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(E) with respect to any exemption from 
the requirements of subsection (f)(3) that is ef-
fective on the date of submission of the report, 
the number of information systems that have 
received an exemption from those require-
ments.’’. 
(c) DURATION
OF
CERTIFICATION
EFFECTIVE 
DATE.—Paragraph (3) of section 3554(f) of title 44, 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
119 
United States Code, as added by this Act, shall take effect 
on the date that is 1 year after the date of enactment 
of this Act. 
(d) FEDERAL CYBERSECURITY ENHANCEMENT ACT 
OF 2015 UPDATE.—Section 222(3)(B) of the Federal Cy-
bersecurity Enhancement Act of 2015 (6 U.S.C. 
1521(3)(B)) is amended by inserting ‘‘and the Committee 
on Oversight and Accountability’’ before ‘‘of the House of 
Representatives.’’ 
SEC. 19. FEDERAL CHIEF INFORMATION SECURITY OFFI-
CER. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘§ 3617. Federal Chief Information Security Officer 
‘‘(a) ESTABLISHMENT.—There is established a Fed-
eral Chief Information Security Officer, who shall serve 
in— 
‘‘(1) the Office of the Federal Chief Informa-
tion Officer of the Office of Management and Budg-
et; and 
‘‘(2) the Office of the National Cyber Director. 
‘‘(b) APPOINTMENT.—The Federal Chief Information 
Security Officer shall be appointed by the President. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
120 
‘‘(c) OMB DUTIES.—The Federal Chief Information 
Security Officer shall report to the Federal Chief Informa-
tion Officer and assist the Federal Chief Information Offi-
cer in carrying out— 
‘‘(1) every function under this chapter; 
‘‘(2) every function assigned to the Director 
under title II of the E-Government Act of 2002 (44 
U.S.C. 3501 note; Public Law 107–347); 
‘‘(3) other electronic government initiatives con-
sistent with other statutes; and 
‘‘(4) other Federal cybersecurity initiatives de-
termined by the Federal Chief Information Officer. 
‘‘(d) ADDITIONAL DUTIES.—The Federal Chief In-
formation Security Officer shall— 
‘‘(1) support the Federal Chief Information Of-
ficer in overseeing and implementing Federal cyber-
security under the E-Government Act of 2002 (Pub-
lic Law 107–347; 116 Stat. 2899) and other rel-
evant statutes in a manner consistent with law; and 
‘‘(2) perform every function assigned to the Di-
rector under sections 1321 through 1328 of title 41, 
United States Code. 
‘‘(e) COORDINATION WITH ONCD.—The Federal 
Chief Information Security Officer shall support initiatives 
determined by the Federal Chief Information Officer nec-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
121 
essary to coordinate with the Office of the National Cyber 
Director.’’. 
(b) NATIONAL CYBER DIRECTOR DUTIES.—Section 
1752 of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (6 U.S.C. 
1500) is amended— 
(1) by redesignating subsection (g) as sub-
section (h); and 
(2) by inserting after subsection (f) the fol-
lowing: 
‘‘(g) SENIOR FEDERAL CYBERSECURITY OFFICER.— 
The Federal Chief Information Security Officer appointed 
by the President under section 3617 of title 44, United 
States Code, shall be a senior official within the Office 
and carry out duties applicable to the protection of infor-
mation technology (as defined in section 11101 of title 40, 
United States Code), including initiatives determined by 
the Director necessary to coordinate with the Office of the 
Federal Chief Information Officer.’’. 
(c) TREATMENT
OF INCUMBENT.—The individual 
serving as the Federal Chief Information Security Officer 
appointed by the President as of the date of the enactment 
of this Act may serve as the Federal Chief Information 
Security Officer under section 3617 of title 44, United 
States Code, as added by this Act, beginning on the date 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
122 
of enactment of this Act, without need for a further or 
additional appointment under such section. 
(d) CLERICAL AMENDMENT.—The table of sections 
for chapter 36 of title 44, United States Code, is amended 
by adding at the end the following: 
‘‘Sec. 3617. Federal Chief Information Security Officer’’. 
SEC. 20. RENAMING OFFICE OF THE FEDERAL CHIEF IN-
FORMATION OFFICER. 
(a) DEFINITIONS.— 
(1) IN
GENERAL.—Section 3601 of title 44, 
United States Code, is amended— 
(A) by striking paragraph (1); and 
(B) 
by 
redesignating 
paragraphs 
(2) 
through (8) as paragraphs (1) through (7), re-
spectively. 
(2) CONFORMING AMENDMENTS.— 
(A) TITLE 10.—Section 2222(i)(6) of title 
10, United States Code, is amended by striking 
‘‘section 
3601(4)’’ 
and 
inserting 
‘‘section 
3601’’. 
(B) NATIONAL SECURITY ACT OF 1947.— 
Section 506D(k)(1) of the National Security 
Act of 1947 (50 U.S.C. 3100(k)(1)) is amended 
by striking ‘‘section 3601(4)’’ and inserting 
‘‘section 3601’’. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
123 
(b) OFFICE OF ELECTRONIC GOVERNMENT.—Section 
3602 of title 44, United States Code, is amended— 
(1) in the heading, by striking ‘‘OFFICE OF 
ELECTRONIC GOVERNMENT’’ and inserting ‘‘OF-
FICE OF THE FEDERAL CHIEF INFORMATION 
OFFICER’’; 
(2) in subsection (a), by striking ‘‘Office of 
Electronic Government’’ and inserting ‘‘Office of the 
Federal Chief Information Officer’’; 
(3) in subsection (b), by striking ‘‘an Adminis-
trator’’ and inserting ‘‘a Federal Chief Information 
Officer’’; 
(4) in subsection (c), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(5) in subsection (d), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(6) in subsection (e), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(7) in subsection (f)— 
(A) in the matter preceding paragraph (1), 
by striking ‘‘the Administrator’’ and inserting 
‘‘the Federal Chief Information Officer’’; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB