I 
114TH CONGRESS 
2D SESSION 
H. R. 6066 
To enforce Federal cybersecurity responsibility and accountability. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 19, 2016 
Mr. ABRAHAM (for himself and Mr. SMITH of Texas) introduced the following 
bill; which was referred to the Committee on Oversight and Government 
Reform, and in addition to the Committee on Science, Space, and Tech-
nology, for a period to be subsequently determined by the Speaker, in 
each case for consideration of such provisions as fall within the jurisdic-
tion of the committee concerned 
A BILL 
To enforce Federal cybersecurity responsibility and 
accountability. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Respon-
sibility and Accountability Act of 2016’’. 
SEC. 2. DEFINITIONS. 
Section 3552 of title 44, United States Code, is 
amended— 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
(1) by redesignating paragraphs (6) and (7) as 
paragraphs (7) and (8), respectively; and 
(2) by inserting after paragraph (5) the fol-
lowing new paragraph: 
‘‘(6) The term ‘major cybersecurity incident’ 
has the meaning given the term ‘major incident’ in 
Office of Management and Budget Memorandum M– 
16–03, dated October 30, 2015, or any successor 
document.’’. 
SEC. 3. AUTHORITY AND FUNCTIONS OF THE DIRECTOR OF 
NIST. 
(a) AMENDMENT.—Section 3553 of title 44, United 
States Code, is amended— 
(1) by redesignating subsections (c) through (j) 
as subsections (d) through (k), respectively; and 
(2) by inserting after subsection (b) the fol-
lowing new subsection: 
‘‘(c) DIRECTOR OF THE NATIONAL INSTITUTE OF 
STANDARDS AND TECHNOLOGY.—The Director of the Na-
tional Institute of Standards and Technology shall further 
develop and update as necessary the standards and guide-
lines under section 20 of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3) to fulfill the 
additional objectives and requirements of the Cybersecuri-
ty Responsibility and Accountability Act of 2016. Further, 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
the Director of the National Institute of Standards and 
Technology shall— 
‘‘(1) provide to the Director of the Office of 
Management and Budget a framework and process 
for agency implementation of such standards and 
guidelines; 
‘‘(2) provide support to agency heads for the 
implementation of such standards and guidelines 
and their application to information security policies 
and principles, as well as with the development of in-
formation security training and certification for 
agency heads; 
‘‘(3) conduct cybersecurity research— 
‘‘(A) to identify and address prevalent in-
formation security challenges, concerns, and 
knowledge gaps identified by agencies, including 
those manifested in any of the reports, evalua-
tions, assessments, and plans described in this 
subchapter that may undermine agencies’ infor-
mation security policies and practices; 
‘‘(B) to assess the sufficiency of the cur-
rent statutory requirements of the Federal In-
formation Security Management Act of 2002 
and the Federal Information Security Mod-
ernization Act of 2014, and their effectiveness 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
in requiring agencies to implement standards 
and guidelines developed under section 20 of 
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3) and authorized 
by the Cybersecurity Responsibility and Ac-
countability Act of 2016 regarding information 
security policies and practices; and 
‘‘(C) that shall require the Director of the 
Office of Management and Budget, the Sec-
retary of Homeland Security, and the heads of 
other Federal agencies to provide the Director 
of the National Institute of Standards and 
Technology any resources, including reports, 
evaluations, assessments, and plans, that may 
be required for such research; and 
‘‘(4) develop, publish, and update as necessary 
information security standards and guidelines for 
national security systems based on established 
standards and guidelines for information systems.’’. 
(b) CONFORMING AMENDMENTS.—Subchapter II of 
chapter 35 of title 44, United States Code, is amended— 
(1) in the item relating to section 3553 in the 
table of sections, by striking ‘‘and the Secretary’’ 
and inserting ‘‘, the Secretary, and the Director of 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
the National Institute of Standards and Tech-
nology’’; 
(2) in the section heading for section 3553, by 
striking ‘‘and the Secretary’’ and inserting ‘‘, 
the Secretary, and the Director of the Na-
tional Institute of Standards and Tech-
nology’’; 
(3) in section 3553(e), as so redesignated by 
subsection (a)(1) of this section, by striking ‘‘sub-
section (c)’’ and inserting ‘‘subsection (d)’’; 
(4) in section 3553(i)(1)(B), as so redesignated 
by subsection (a)(1) of this section— 
(A) by striking ‘‘subsection (d)’’ and in-
serting ‘‘subsection (e)’’; and 
(B) by striking ‘‘subsection (e)’’ and in-
serting ‘‘subsection (f)’’; 
(5) in section 3554(a)(1)(B)(v), by striking 
‘‘section 3553(h)’’ and inserting ‘‘section 3553(i)’’; 
and 
(6) in section 3555(g)(1), by striking ‘‘section 
3553(c)’’ and inserting ‘‘section 3553(d)’’. 
SEC. 4. AGENCY HEADS. 
Section 2(d) of the Federal Information Security 
Modernization Act of 2014 (44 U.S.C. 3553 note) is 
amended— 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
(B) by redesignating clauses (i) through 
(iv) as clauses (ii) through (v), respectively; 
(C) by inserting before clause (ii), as so re-
designated, the following new clause: 
‘‘(i) have the job description and re-
sponsibilities that shall be provided in 
guidance issued by the Director, developed 
in consultation with the Director of the 
National Institute of Standards and Tech-
nology and the Secretary, within 6 months 
after the date of enactment of the Cyberse-
curity Responsibility and Accountability 
Act of 2016;’’; 
(D) in clause (iv), as so redesignated, by 
striking ‘‘and’’ at the end; 
(E) in clause (v), as so redesignated, by in-
serting ‘‘and’’ after the semicolon at the end; 
and 
(F) by adding at the end the following new 
clause: 
‘‘(vi) be designated without increasing 
the number of full-time equivalent em-
ployee positions at the agency;’’; 
(2) in subsection (b)— 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
(A) 
by 
redesignating 
paragraphs 
(5) 
through (8) as paragraphs (6) through (9), re-
spectively; and 
(B) by inserting after paragraph (4) the 
following new paragraph: 
‘‘(5) mandatory annual information security 
training and certification designed specifically for 
the agency head, developed and updated as nec-
essary by the National Institute of Standards and 
Technology, the purpose of which shall be to ensure 
that the agency head has an understanding of Fed-
eral cybersecurity policy, including an understanding 
of— 
‘‘(A) the information and information sys-
tems that support the operations and assets of 
the agency, using nontechnical terms as much 
as possible; 
‘‘(B) the potential impact of common types 
of cyber-attacks and data breaches on the agen-
cy’s operations and assets; 
‘‘(C) how cyber-attacks and data breaches 
occur; 
‘‘(D) steps the agency head and agency 
employees should take to protect their informa-
tion and information systems, including not 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
using private messaging system software or pri-
vate e-mail servers for official communications; 
and 
‘‘(E) the annual reporting requirements re-
quired of the agency head under subsection (c), 
including the certifications required under sub-
section (c)(1)(A)(iv);’’; 
(3) in subsection (c)— 
(A) in paragraph (1)(A)— 
(i) by striking ‘‘Each agency’’ and in-
serting ‘‘The head of each agency’’; 
(ii) by inserting ‘‘the Director of the 
National Institute of Standards and Tech-
nology,’’ after ‘‘the Director, the Sec-
retary,’’; 
(iii) by inserting ‘‘, Space, and Tech-
nology’’ after ‘‘the Committee on Science’’; 
(iv) by striking ‘‘and’’ at the end of 
clause (iii)(II); 
(v) by redesignating clause (iv) as 
clause (v); and 
(vi) by inserting after clause (iii) the 
following new clause: 
‘‘(iv) specific written certification by 
the agency head that— 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
‘‘(I) certifies that information se-
curity standards developed under sec-
tion 20 of the National Institute of 
Standards and Technology Act (15 
U.S.C. 278g–3) are being met by the 
agency; 
‘‘(II) identifies the security con-
trols in place at the agency and how 
they each meet the relevant informa-
tion security standard; 
‘‘(III) may be based on or in-
formed by the assessment described in 
section 3553(d)(4); and 
‘‘(IV) for any information secu-
rity standard that the agency does not 
meet, provides the reasons therefor 
and includes documentation of the Di-
rector’s certification of the agency not 
meeting the standard; and’’; and 
(B) in paragraph (2), by striking ‘‘Each 
agency’’ and inserting ‘‘The head of each agen-
cy’’; 
(4) in subsection (d), by striking ‘‘each agency’’ 
and inserting ‘‘the head of each agency’’; 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
(5) by redesignating subsection (e) as sub-
section (f); 
(6) by inserting after subsection (d) the fol-
lowing new subsection: 
‘‘(e) PLANS
FOR
IMPLEMENTATION
OF
REC-
OMMENDATIONS.— 
‘‘(1) COMPTROLLER
GENERAL
RECOMMENDA-
TIONS.— 
‘‘(A) IN GENERAL.—In addition to the re-
quirements of subsections (c) and (d), each 
agency head shall, not later than 6 months 
after the date of enactment of the Cybersecurity 
Responsibility and Accountability Act of 2016, 
develop a plan, in consultation with the Comp-
troller General, to implement all of the Comp-
troller General’s recommendations regarding in-
formation security controls relevant to that 
agency. 
‘‘(B) PLAN.—The plan required under sub-
paragraph (A)— 
‘‘(i) shall be submitted to the agencies 
and committees described in subsection 
(c)(1)(A); 
‘‘(ii) shall include a schedule for im-
plementation of the Comptroller General’s 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
recommendations, including a completion 
deadline; 
‘‘(iii) shall be updated annually, and 
such annual updates shall be included in 
the annual report described in subsection 
(c)(1)(A); and 
‘‘(iv) may, as appropriate, be based on 
or informed by recommendations included 
in the evaluation and report described in 
section 3555(h). 
‘‘(C) IF
NO
RECOMMENDATIONS.—If the 
Comptroller General does not have any relevant 
recommendations for an agency head to imple-
ment relative to information security controls, 
then the agency head shall accordingly notify 
the agencies and committees described in sub-
section (c)(1)(A). 
‘‘(D) REASONS FOR FAILURE TO IMPLE-
MENT.—If there are any Comptroller General 
recommendations that an agency head does not 
implement, the agency head shall provide the 
reasons for that failure to the Director for the 
Director’s approval. For each unimplemented 
recommendation, the plan shall include either 
the Director’s approval or a certification by the 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
Director of the agency head’s failure to imple-
ment such recommendation. 
‘‘(2) 
INSPECTOR
GENERAL
RECOMMENDA-
TIONS.— 
‘‘(A) IN GENERAL.—In addition to the re-
quirements of subsections (c) and (d), each 
agency head shall, not later than 6 months 
after the date of enactment of the Cybersecurity 
Responsibility and Accountability Act of 2016, 
develop a plan, in consultation with its Inspec-
tor General, to implement all of the Inspector 
General’s recommendations regarding the agen-
cy’s information security program. 
‘‘(B) PLAN.—The plan required under sub-
paragraph (A)— 
‘‘(i) shall be submitted to the agencies 
and committees described in subsection 
(c)(1)(A); 
‘‘(ii) shall include a schedule for im-
plementation of the Inspector General’s 
recommendations, including a completion 
deadline; 
‘‘(iii) shall be updated annually, and 
such annual updates shall be included in 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
(A) by striking ‘‘the head of an agency’’ 
and inserting ‘‘an agency head’’; 
(B) by striking ‘‘head of an agency’’ and 
inserting ‘‘agency head’’; and 
(C) by inserting ‘‘or section 3555a’’ after 
‘‘under this section’’; and 
(8) in subsection (j), by inserting ‘‘the Director 
of the National Institute of Standards and Tech-
nology,’’ after ‘‘with the Secretary,’’. 
SEC. 7. MAJOR CYBERSECURITY INCIDENT INDEPENDENT 
EVALUATIONS. 
(a) AMENDMENT.—Subchapter II of chapter 35 of 
title 44, United States Code, is amended by inserting after 
section 3555 the following new section: 
‘‘§ 3555a. Major cybersecurity incident independent 
evaluations 
‘‘(a) REQUIREMENT.—Each time an agency experi-
ences a major cybersecurity incident, the agency head 
shall have performed an independent evaluation of such 
incident. 
‘‘(b) INCLUSIONS.—An evaluation of a major cyberse-
curity incident under this section shall be transmitted by 
the agency head to the agencies and committees described 
in section 3554(c)(1)(A), and shall include— 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
‘‘(1) a description of each major cybersecurity 
incident including— 
‘‘(A) 
threats 
and 
threat 
actors, 
vulnerabilities, and impacts, including whether 
the incident involved information that is classi-
fied, controlled unclassified information propri-
etary, controlled unclassified information pri-
vacy, or controlled unclassified information 
other, as these terms are defined in Office of 
Management and Budget Memorandum M–16– 
03, dated October 30, 2015, or any successor 
document; 
‘‘(B) risk assessments conducted on the 
system before the incident; 
‘‘(C) the status of compliance of the af-
fected information system with information se-
curity requirements at the time of the incident, 
including— 
‘‘(i) information security control rec-
ommendations made by the agency’s In-
spector General that are part of the plan 
described in section 3554(e)(2); 
‘‘(ii) information security control rec-
ommendations made by the Comptroller 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
General that are part of the plan described 
in section 3554(e)(1); and 
‘‘(iii) National Institute of Standards 
and 
Technology 
information 
security 
standards that are part of the agency 
head’s certification described in section 
3554(c)(1)(A)(iv); 
‘‘(D) the detection, response, and remedi-
ation actions the agency has completed; and 
‘‘(E) recommendations for research, proc-
ess, and policy actions the agency should con-
sider taking in response to the incident and to 
help prevent future incidents of a similar na-
ture; and 
‘‘(2) for each major cybersecurity incident in-
volving a breach of personally identifiable informa-
tion— 
‘‘(A) the number of individuals whose in-
formation was affected by the incident and a 
description 
of 
the 
information 
that 
was 
breached or exposed; 
‘‘(B) an assessment of the risk of harm to 
affected individuals; and 
‘‘(C) details of whether and when the agen-
cy provided notice to affected individuals about 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
the data breach, including what protections 
were offered by the breached agency. 
‘‘(c) ENFORCEMENT.— 
‘‘(1) IN GENERAL.—If an evaluation of a major 
cybersecurity incident described in subsection (a) de-
termines that the major cybersecurity incident oc-
curred in part or in whole because the agency head 
had failed to comply sufficiently with the informa-
tion security requirements, recommendations, or 
standards described in subsection (b)(1)(C), the Di-
rector shall, within 60 days of receiving the evalua-
tion, take action under paragraph (2). 
‘‘(2) ENFORCEMENT
ACTIONS.—Enforcement 
actions the Director may take under this subsection 
are— 
‘‘(A) 
actions 
described 
in 
section 
11303(b)(5) of title 40, United States Code; 
and 
‘‘(B) either— 
‘‘(i) recommending to the President 
the removal or demotion of the agency 
head; or 
‘‘(ii) action to ensure the agency head 
does not receive any cash or pay awards or 
bonuses for a period of 1 year after sub-
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS
mission of the explanation required under 
paragraph (3). 
‘‘(3) EXPLANATION.—The Director shall pro-
vide a detailed explanation for enforcement actions 
taken under paragraph (2), or for a decision not to 
act, 
to 
the 
committees 
described 
in 
section 
3554(c)(1)(A).’’. 
(b) TABLE OF SECTIONS AMENDMENT.—The table of 
sections for such subchapter is amended by inserting after 
the item relating to section 3555 the following new item: 
‘‘3555a. Major cybersecurity incident independent evaluations.’’. 
Æ 
VerDate Sep 11 2014 
00:12 Sep 21, 2016
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6301
E:\BILLS\H6066.IH
H6066
emcdonald on DSK9F6TC42PROD with BILLS