SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Safe and Secure Fed-
eral Websites Act of 2014’’. 
SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 
FEDERAL WEBSITES THAT COLLECT PERSON-
ALLY IDENTIFIABLE INFORMATION. 
(a) CERTIFICATION REQUIREMENT.— 
(1) IN
GENERAL.—Except as otherwise pro-
vided under this subsection, an agency may not de-
ploy or make available to the public a new Federal 
PII website until the date on which the chief infor-
mation officer of the agency submits a certification 
to Congress that the website is fully functional and 
secure. 
(2) TRANSITION.—In the case of a new Federal 
PII website that is operational on the date of the en-
actment of this Act, paragraph (1) shall not apply 
until the end of the 90-day period beginning on such 
date of enactment. If the certification required under 
paragraph (1) for such website has not been sub-
mitted to Congress before the end of such period, 
the head of the responsible agency shall render the 
website inaccessible to the public until such certifi-
cation is submitted to Congress. 
(3) EXCEPTION FOR BETA WEBSITE WITH EX-
PLICIT PERMISSION.—Paragraph (1) shall not apply
to a website (or portion thereof) that is in a develop-
ment or testing phase, if the following conditions are 
met: 
(A) A member of the public may access 
PII-related portions of the website only after 
executing an agreement that acknowledges the 
risks involved. 
(B) No agency compelled, enjoined, or oth-
erwise provided incentives for such a member to 
access the website for such purposes. 
(4) CONSTRUCTION.—Nothing in this section 
shall be construed as applying to a website that is 
operated entirely by an entity (such as a State or lo-
cality) that is independent of the Federal Govern-
ment, regardless of the receipt of funding in support 
of such website from the Federal Government. 
(b) DEFINITIONS.—In this section: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given that term under section 551 of title 
5, United States Code. 
(2) FULLY
FUNCTIONAL.—The term ‘‘fully 
functional’’ means, with respect to a new Federal 
PII website, that the website can fully support the 
activities for which it is designed or intended with 
regard to the eliciting, collection, storage, or mainte-
nance of personally identifiable information, includ-
ing handling a volume of queries relating to such in-
formation commensurate with the purpose for which 
the website is designed. 
(3) NEW FEDERAL PERSONALLY IDENTIFIABLE 
INFORMATION
WEBSITE
(NEW
FEDERAL
PII 
WEBSITE).—The terms ‘‘new Federal personally 
identifiable information website’’ and ‘‘new Federal 
PII website’’ mean a website that— 
(A) is operated by (or under a contract 
with) an agency; 
(B) elicits, collects, stores, or maintains 
personally identifiable information of individuals 
and is accessible to the public; and 
(C) is first made accessible to the public 
and collects or stores personally identifiable in-
formation of individuals, on or after October 1, 
2012. 
(4) OPERATIONAL.—The term ‘‘operational’’ 
means, with respect to a website, that such website 
elicits, collects, stores, or maintains personally iden-
tifiable information of members of the public and is 
accessible to the public. 
(5) PERSONALLY IDENTIFIABLE INFORMATION 
(PII).—The terms ‘‘personally identifiable informa-
tion’’ and ‘‘PII’’ mean any information about an in-
dividual elicited, collected, stored, or maintained by 
an agency, including— 
(A) any information that can be used to 
distinguish or trace the identity of an indi-
vidual, such as a name, a social security num-
ber, a date and place of birth, a mother’s maid-
en name, or biometric records; and 
(B) any other information that is linked or 
linkable to an individual, such as medical, edu-
cational, financial, and employment informa-
tion. 
(6) RESPONSIBLE AGENCY.—The term ‘‘respon-
sible agency’’ means, with respect to a new Federal 
PII website, the agency that is responsible for the 
operation (whether directly or through contracts 
with other entities) of the website. 
(7) SECURE.—The term ‘‘secure’’ means, with 
respect to a new Federal PII website, that the fol-
lowing requirements are met: 
(A) The website is in compliance with sub-
chapter III of chapter 35 of title 44, United 
States Code. 
(B) The website ensures that personally 
identifiable 
information 
elicited, 
collected,
stored, or maintained in connection with the 
website is captured at the latest possible step in 
a user input sequence. 
(C) The responsible agency for the website 
has taken reasonable efforts to minimize do-
main name confusion, including through addi-
tional domain registrations. 
(D) The responsible agency requires all 
personnel who have access to personally identi-
fiable information in connection with the 
website to have completed a Standard Form 
85P and signed a non-disclosure agreement 
with respect to personally identifiable informa-
tion, and the agency takes proper precautions 
to ensure only trustworthy persons may access 
such information. 
(E) The responsible agency maintains (ei-
ther directly or through contract) sufficient per-
sonnel to respond in a timely manner to issues 
relating to the proper functioning and security 
of the website, and to monitor on an ongoing 
basis existing and emerging security threats to 
the website. 
(8) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia,