IB 
Union Calendar No. 276 
115TH CONGRESS 
1ST SESSION H. R. 1224 
[Report No. 115–376] 
To amend the National Institute of Standards and Technology Act to imple-
ment a framework, assessment, and audits for improving United States 
cybersecurity. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 27, 2017 
Mr. ABRAHAM (for himself, Mr. SMITH of Texas, Mr. LUCAS, Mrs. COM-
STOCK, and Mr. KNIGHT) introduced the following bill; which was re-
ferred to the Committee on Science, Space, and Technology 
OCTOBER 31, 2017 
Additional sponsor: Mr. SESSIONS 
OCTOBER 31, 2017 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on February 27, 2017] 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
A BILL 
To amend the National Institute of Standards and Tech-
nology Act to implement a framework, assessment, and 
audits for improving United States cybersecurity. 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘NIST Cybersecurity 
Framework, Assessment, and Auditing Act of 2017’’. 
SEC. 2. NIST MISSION TO ADDRESS CYBERSECURITY 
THREATS. 
Section 20(a)(1) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3(a)(1)) is amended 
by inserting ‘‘, emphasizing the principle that expanding 
cybersecurity threats require engineering security from the 
beginning of an information system’s life cycle, building 
more trustworthy and secure components and systems from 
the start, and applying well-defined security design prin-
ciples throughout’’ before the semicolon. 
SEC. 3. IMPLEMENTATION OF CYBERSECURITY FRAME-
WORK. 
The National Institute of Standards and Technology 
Act (15 U.S.C. 271 et seq.) is amended by inserting after 
section 20 the following: 
‘‘SEC. 20A. FRAMEWORK FOR IMPROVING CRITICAL INFRA-
STRUCTURE CYBERSECURITY. 
‘‘(a) IMPLEMENTATION BY FEDERAL AGENCIES.—The 
Institute shall promote the implementation by Federal 
agencies of the Framework for Improving Critical Infra-
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
structure Cybersecurity (in this section and section 20B re-
ferred to as the ‘Framework’) by providing to the Office of 
Management and Budget, the Office of Science and Tech-
nology Policy, and all other Federal agencies, not later than 
6 months after the date of enactment of the NIST Cybersecu-
rity Framework, Assessment, and Auditing Act of 2017, 
guidance that Federal agencies may use to incorporate the 
Framework into their information security risk manage-
ment efforts, including practices related to compliance with 
chapter 35 of title 44, United States Code, and any other 
applicable Federal law. 
‘‘(b) GUIDANCE.—The guidance required under sub-
section (a) shall— 
‘‘(1) describe how the Framework aligns with or 
augments existing agency practices related to compli-
ance with chapter 35 of title 44, United States Code, 
and any other applicable Federal law; 
‘‘(2) identify any areas of conflict or overlap be-
tween the Framework and existing cybersecurity re-
quirements, including gap areas where additional 
policies, standards, guidelines, or programs may be 
needed to encourage Federal agencies to use the 
Framework and improve the ability of Federal agen-
cies to manage cybersecurity risk; 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
‘‘(3) include a template for Federal agencies on 
how to use the Framework, and recommend proce-
dures for streamlining and harmonizing existing and 
future cybersecurity-related requirements, in support 
of the goal of using the Framework to supplant Fed-
eral agency practices in compliance with chapter 35 
of title 44, United States Code; 
‘‘(4) recommend other procedures for compliance 
with cybersecurity reporting, oversight, and policy re-
view and creation requirements under such chapter 
35 and any other applicable Federal law; and 
‘‘(5) be updated, as the Institute considers nec-
essary, to reflect what the Institute learns from ongo-
ing research, the audits conducted pursuant to section 
20B(c), the information compiled by the Federal 
working group established pursuant to subsection (c), 
and the annual reports published pursuant to sub-
section (d). 
‘‘(c) FEDERAL WORKING GROUP.—Not later than 3 
months after the date of enactment of the NIST Cybersecu-
rity Framework, Assessment, and Auditing Act of 2017, the 
Institute shall establish and chair a working group (in this 
section referred to as the ‘Federal working group’), includ-
ing representatives of the Office of Management and Budget, 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
the Office of Science and Technology Policy, and other ap-
propriate Federal agencies, which shall— 
‘‘(1) not later than 6 months after the date of en-
actment of the NIST Cybersecurity Framework, As-
sessment, and Auditing Act of 2017, develop outcome- 
based and quantifiable metrics to help Federal agen-
cies in their analysis and assessment of the effective-
ness of the Framework in protecting their information 
and information systems; 
‘‘(2) update such metrics as the Federal working 
group considers necessary; 
‘‘(3) compile information from Federal agencies 
on their use of the Framework and the results of the 
analysis and assessment described in paragraph (1); 
and 
‘‘(4) assist the Office of Management and Budget 
and the Office of Science and Technology Policy in 
publishing the annual report required under sub-
section (d). 
‘‘(d) REPORT.—The Office of Management and Budget 
and the Office of Science and Technology Policy shall de-
velop and make publicly available an annual report on 
agency adoption rates and the effectiveness of the Frame-
work. In preparing such report, the Offices shall use the 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
information compiled by the Federal working group pursu-
ant to subsection (c)(3). 
‘‘SEC. 20B. CYBERSECURITY AUDITS. 
‘‘(a) INITIAL ASSESSMENT.— 
‘‘(1) REQUIREMENT.—Not later than 6 months 
after the date of enactment of the NIST Cybersecurity 
Framework, Assessment, and Auditing Act of 2017, 
the Institute shall complete an initial assessment of 
the cybersecurity preparedness of the agencies de-
scribed in paragraph (2). Such assessment shall be 
based on information security standards developed 
under section 20, and may also be informed by work 
done or reports published by other Federal agencies or 
officials. 
‘‘(2) AGENCIES.—The agencies referred to in 
paragraph (1) are the agencies referred to in section 
901(b) of title 31, United States Code, and any other 
agency that has reported a major incident (as defined 
in the Office of Management and Budget Memo-
randum—16—03, published on October 30, 2015, or 
any successor document). 
‘‘(3) NATIONAL
SECURITY
SYSTEMS.—The re-
quirement under paragraph (1) shall not apply to na-
tional security systems (as defined in section 3552(b) 
of title 44, United States Code). 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
‘‘(b) AUDIT PLAN.—Not later than 6 months after the 
date of enactment of this Act, the Institute shall prepare 
a needs-based plan for carrying out the audits of agencies 
as required under subsection (c). Such plan shall include 
a description of staffing plans, workforce capabilities, meth-
ods for conducting such audits, coordination with agencies 
to support such audits, expected timeframes for the comple-
tion of audits, and other information the Institute considers 
relevant. The plan shall be transmitted by the Institute to 
the congressional entities described in subsection (c)(4)(F). 
‘‘(c) AUDITS.— 
‘‘(1) REQUIREMENT.—Not later than 6 months 
after the date of enactment of the NIST Cybersecurity 
Framework, Assessment, and Auditing Act of 2017, 
the Institute shall initiate an individual cybersecurity 
audit of each agency described in subsection (a)(2), to 
assess the extent to which the agency is meeting the 
information security standards developed under sec-
tion 20. 
‘‘(2) RELATION
TO
FRAMEWORK.—Audits con-
ducted under this subsection shall— 
‘‘(A) to the extent applicable and available, 
be informed by the report on agency adoption 
rates and the effectiveness of the Framework de-
scribed in section 20A(d); and 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
‘‘(B) if the agency is required by law or ex-
ecutive order to adopt the Framework, be based 
on the guidance described in section 20A(b) and 
metrics developed under section 20A(c)(1). 
‘‘(3) SCHEDULE.—The Institute shall establish a 
schedule for completion of audits under this sub-
section to ensure that— 
‘‘(A) audits of agencies whose information 
security risk is high, based on the assessment 
conducted under subsection (a), are completed 
not later than 1 year after the date of enactment 
of the NIST Cybersecurity Framework, Assess-
ment, and Auditing Act of 2017, and are audited 
annually thereafter; and 
‘‘(B) audits of all other agencies described 
in subsection (a)(2) are completed not later than 
2 years after the date of enactment of the NIST 
Cybersecurity Framework, Assessment, and Au-
diting Act of 2017, and are audited biennially 
thereafter. 
‘‘(4) REPORT.—A report of each audit conducted 
under this subsection shall be transmitted by the In-
stitute to— 
‘‘(A) the Office of Management and Budget; 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
‘‘(B) the Office of Science and Technology 
Policy; 
‘‘(C) the Government Accountability Office; 
‘‘(D) the agency being audited; 
‘‘(E) the Inspector General of such agency, 
if there is one; and 
‘‘(F) Congress, including the Committee on 
Science, Space, and Technology of the House of 
Representatives and the Committee on Com-
merce, Science, and Transportation of the Sen-
ate.’’. 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS
Union Calendar No. 276 
115TH CONGRESS 
1ST SESSION 
H. R. 1224 
[Report No. 115–376] 
A BILL 
To amend the National Institute of Standards and 
Technology Act to implement a framework, as-
sessment, and audits for improving United States 
cybersecurity. 
OCTOBER 31, 2017 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
20:58 Oct 31, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6651
Sfmt 6651
E:\BILLS\H1224.RH
H1224
srobinson on DSKBC5CHB2PROD with BILLS