IB 
Union Calendar No. 402 
116TH CONGRESS 
2D SESSION 
H. R. 1668 
[Report No. 116–501, Part I] 
To leverage Federal Government procurement power to encourage increased 
cybersecurity for Internet of Things devices, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 11, 2019 
Ms. KELLY of Illinois (for herself, Mr. HURD of Texas, Mr. KHANNA, Mr. 
BUDD, Mr. RUPPERSBERGER, Mr. MARSHALL, Mr. TED LIEU of Cali-
fornia, Mr. RATCLIFFE, Mr. MEADOWS, Mr. SOTO, Mr. WALKER, Mr. 
CONNOLLY, Mr. FOSTER, and Mr. BAIRD) introduced the following bill; 
which was referred to the Committee on Oversight and Reform, and in 
addition to the Committee on Science, Space, and Technology, for a pe-
riod to be subsequently determined by the Speaker, in each case for con-
sideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
SEPTEMBER 14, 2020 
Additional sponsors: Mr. OLSON, Ms. HILL of California, Mr. FITZPATRICK, 
Mr. O’HALLERAN, Mrs. BROOKS of Indiana, Ms. CLARKE of New York, 
Ms. STEVENS, Mr. HARDER of California, Mr. NORMAN, Mr. ROUDA, Mr. 
GRAVES of Georgia, Ms. WASSERMAN SCHULTZ, and Ms. DELBENE 
SEPTEMBER 14, 2020 
Reported from the Committee on Oversight and Reform with an amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
SEPTEMBER 14, 2020 
Committee on Science, Space, and Technology discharged; committed to the 
Committee of the Whole House on the State of the Union and ordered 
to be printed 
[For text of introduced bill, see copy of bill as introduced on March 11, 2019] 
A BILL 
To leverage Federal Government procurement power to en-
courage increased cybersecurity for Internet of Things 
devices, and for other purposes. 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Things Cy-
bersecurity Improvement Act of 2019’’ or the ‘‘IoT Cyberse-
curity Improvement Act of 2019’’. 
SEC. 2. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘agency’’ has the mean-
ing given such term in section 3502 of title 44, 
United States Code. 
(2) COVERED DEVICE.—The term ‘‘covered de-
vice’’ means a physical object that— 
(A) is capable of being in regular connec-
tion with— 
(i) the Internet; or 
(ii) a network that is connected to the 
Internet on a recurring basis; 
(B) has computer processing capabilities of 
collecting, sending, or receiving data; and 
(C) is not a— 
(i) general-purpose computing device; 
(ii) personal computing system; 
(iii) smart mobile communications de-
vice; 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
(iv) programmable logic controller with 
an industrial control system specifically not 
designed for connection to the internet; 
(v) mainframe computing system; or 
(vi) subcomponent of a device. 
(3) DIRECTOR OF OMB.—The term ‘‘Director of 
OMB’’ means the Director of the Office of Manage-
ment and Budget. 
(4) DIRECTOR OF THE INSTITUTE.—The term 
‘‘Director of the Institute’’ means the Director of the 
National Institute of Standards and Technology. 
(5) SECURITY VULNERABILITY.—The term ‘‘secu-
rity vulnerability’’ has the meaning given that term 
under section 102(17) of the Cybersecurity Informa-
tion Sharing Act of 2015 (6 U.S.C. 1501(17)). 
SEC. 3. COMPLETION OF ONGOING EFFORTS RELATING TO 
CONSIDERATIONS FOR MANAGING INTERNET 
OF THINGS CYBERSECURITY RISKS. 
Not later than December 31, 2019, the Director of the 
National Institute of Standards and Technology shall com-
plete the efforts of the Institute in effect on the date of the 
enactment of this Act regarding considerations for man-
aging the security vulnerabilities of Internet of Things de-
vices and examples of possible cybersecurity capabilities of 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS
such devices by publishing a report that includes, at a min-
imum, the following considerations for covered devices: 
(1) Secure development. 
(2) Identity management. 
(3) Patching. 
(4) Configuration management. 
SEC. 4. SECURITY STANDARDS FOR USE OF COVERED DE-
VICES BY THE FEDERAL GOVERNMENT. 
(a) GUIDELINES REQUIRED.— 
(1) GUIDELINES.—Not later than 6 months after 
the date on which the report under section 3 is com-
pleted, the Director of the Institute shall develop 
under section 20 of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g-3), and 
submit to the Director of OMB, guidelines on— 
(A) the appropriate use and management 
by the agencies of covered devices owned or con-
trolled by the agencies; and 
(B) minimum information security require-
ments for managing security vulnerabilities asso-
ciated with such devices. 
(2) DEVELOPMENT OF GUIDELINES.—In devel-
oping the guidelines submitted under paragraph (1), 
the Director of the Institute shall— 
VerDate Sep 11 2014 
23:57 Sep 14, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1668.RH
H1668
SSpencer on DSK126QN23PROD with BILLS