I 
118TH CONGRESS 
1ST SESSION H. R. 3166 
To require the Cybersecurity and Infrastructure Security Agency of the De-
partment of Homeland Security to submit a report on the impact of 
the SolarWinds cyber incident on information systems owned and oper-
ated by Federal departments and agencies and other critical infrastruc-
ture, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 9, 2023 
Mr. TORRES of New York introduced the following bill; which was referred 
to the Committee on Homeland Security, and in addition to the Com-
mittee on Oversight and Accountability, for a period to be subsequently 
determined by the Speaker, in each case for consideration of such provi-
sions as fall within the jurisdiction of the committee concerned 
A BILL 
To require the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security to sub-
mit a report on the impact of the SolarWinds cyber 
incident on information systems owned and operated by 
Federal departments and agencies and other critical in-
frastructure, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:17 May 20, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3166.IH
H3166
kjohnson on DSK79L0C42PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Building Cyber Resil-
ience After SolarWinds Act of 2023’’. 
SEC. 2. BUILDING CYBER RESILIENCE AFTER SOLARWINDS. 
(a) DEFINITIONS.—In this section: 
(1) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given such 
term in section 1016(e) of Public Law 107–56 (42 
U.S.C. 5195c(e)). 
(2) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency. 
(3) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given such term in 
section 2200 of the Homeland Security Act of 2002 
(6 U.S.C. 650). 
(4) SIGNIFICANT CYBER INCIDENT.—The term 
‘‘significant cyber incident’’ has the meaning given 
such term in section 2240 of the Homeland Security 
Act of 2002 (6 U.S.C. 681). 
(5) 
SOLARWINDS
INCIDENT.—The 
term 
‘‘SolarWinds incident’’ refers to the significant cyber 
incident that prompted the establishment of a Uni-
fied Cyber Coordination Group, as provided by sec-
tion V(B)(2) of Presidential Policy Directive 41, in 
December 2020. 
VerDate Sep 11 2014 
02:17 May 20, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3166.IH
H3166
kjohnson on DSK79L0C42PROD with BILLS
(b) SOLARWINDS INVESTIGATION AND REPORT.— 
(1) INVESTIGATION.—The Director, in con-
sultation with the National Cyber Director and the 
heads of other relevant Federal departments and 
agencies, shall carry out an investigation to evaluate 
the impact of the SolarWinds incident on informa-
tion systems owned and operated by Federal depart-
ments and agencies, and, to the extent practicable, 
other critical infrastructure. 
(2) ELEMENTS.—In carrying out subsection 
(b), the Director shall review the following: 
(A) The extent to which Federal informa-
tion systems were accessed, compromised, or 
otherwise impacted by the SolarWinds incident, 
and any potential ongoing security concerns or 
consequences arising from such incident. 
(B) The extent to which information sys-
tems that support other critical infrastructure 
were accessed, compromised, or otherwise im-
pacted by the SolarWinds incident, where such 
information is available to the Director. 
(C) Any ongoing security concerns or con-
sequences arising from the SolarWinds incident, 
including any sensitive information that may 
VerDate Sep 11 2014 
02:17 May 20, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3166.IH
H3166
kjohnson on DSK79L0C42PROD with BILLS
have been accessed or exploited in a manner 
that poses a threat to national security. 
(D) Implementation of Executive Order 
14028 (Improving the Nation’s Cybersecurity 
(May 12, 2021)). 
(E) Efforts taken by the Director, the 
heads of Federal departments and agencies, 
and critical infrastructure owners and operators 
to address cybersecurity vulnerabilities and 
mitigate risks associated with the SolarWinds 
incident. 
(c) REPORT.—Not later than 120 days after the date 
of the enactment of this Act, the Director shall submit 
to the Committee on Homeland Security of the House of 
Representatives and Committee on Homeland Security 
and Governmental Affairs of the Senate a report that in-
cludes the following: 
(1) Findings for each of the elements specified 
in subsection (b). 
(2) Recommendations to address security gaps, 
improve incident response efforts, and prevent simi-
lar cyber incidents. 
(3) Any areas with respect to which the Direc-
tor lacked the information necessary to fully review 
and assessment such elements, the reason the infor-
VerDate Sep 11 2014 
02:17 May 20, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3166.IH
H3166
kjohnson on DSK79L0C42PROD with BILLS
mation necessary was unavailable, and recommenda-
tions to close such informational gaps. 
(d) GAO REPORT
ON CYBER SAFETY REVIEW 
BOARD.—Not later than one year after the date of the 
enactment of this Act, the Comptroller General of the 
United States shall evaluate the activities of the Cyber 
Safety Review Board established pursuant to Executive 
Order 14028 (Improving the Nation’s Cybersecurity (May 
12, 2021)), with a focus on the Board’s inaugural review 
announced in February 2022, and assess whether the 
Board has the authorities, resources, and expertise nec-
essary to carry out its mission of reviewing and assessing 
significant cyber incidents. 
Æ 
VerDate Sep 11 2014 
02:17 May 20, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H3166.IH
H3166
kjohnson on DSK79L0C42PROD with BILLS