108 
the Permanent Select Committee on Intelligence of 
the House of Representatives a briefing on the im-
plementation of zero trust architecture with respect 
to national security systems. 
(2) PROGRESS
REPORT.—Not later than the 
date on which each update is required to be sub-
mitted under subsection (b), the Secretary of De-
fense shall submit to the congressional committees 
described in paragraph (1) a progress report on the 
implementation of zero trust architecture with re-
spect to national security systems. 
SEC. 14. AUTOMATION AND ARTIFICIAL INTELLIGENCE. 
(a) DEFINITION.—In this section, the term ‘‘informa-
tion system’’ has the meaning given the term in section 
3502 of title 44, United States Code. 
(b) USE OF ARTIFICIAL INTELLIGENCE.— 
(1) IN GENERAL.—As appropriate, the Director 
shall issue guidance on the use of artificial intel-
ligence by agencies to improve the cybersecurity of 
information systems. 
(2) CONSIDERATIONS.—The Director and head 
of each agency shall consider the use and capabilities 
of artificial intelligence systems wherever automation 
is used in furtherance of the cybersecurity of infor-
mation systems. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
109 
(3) REPORT.—Not later than 1 year after the 
date of enactment of this Act, and annually there-
after until the date that is 5 years after the date of 
enactment of this Act, the Director shall submit to 
the appropriate congressional committees a report 
on the use of artificial intelligence to further the cy-
bersecurity of information systems. 
(c) COMPTROLLER GENERAL REPORTS.— 
(1) IN GENERAL.—Not later than 2 years after 
the date of enactment of this Act, the Comptroller 
General of the United States shall submit to the ap-
propriate congressional committees a report on the 
risks to the privacy of individuals and the cybersecu-
rity of information systems associated with the use 
by Federal agencies of artificial intelligence systems 
or capabilities. 
(2) STUDY.—Not later than 2 years after the 
date of enactment of this Act, the Comptroller Gen-
eral of the United States shall perform a study, and 
submit to the Committees on Homeland Security 
and Governmental Affairs and Commerce, Science, 
and Transportation of the Senate and the Commit-
tees on Oversight and Accountability, Homeland Se-
curity, and Science, Space, and Technology of the 
House of Representatives a report, on the use of au-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
110 
tomation, including artificial intelligence, and ma-
chine-readable data across the Federal Government 
for cybersecurity purposes, including the automated 
updating of cybersecurity tools, sensors, or processes 
employed by agencies under paragraphs (1), (5)(C), 
and (8)(B) of section 3554(b) of title 44, United 
States Code, as amended by this Act. 
SEC. 15. EXTENSION OF CHIEF DATA OFFICER COUNCIL. 
Section 3520A(e)(2) of title 44, United States Code, 
is amended by striking ‘‘upon the expiration of the 2-year 
period that begins on the date the Comptroller General 
submits the report under paragraph (1) to Congress’’ and 
inserting ‘‘December 31, 2031’’. 
SEC. 16. COUNCIL OF THE INSPECTORS GENERAL ON IN-
TEGRITY AND EFFICIENCY DASHBOARD. 
(a) DASHBOARD REQUIRED.—Section 424(e) of title 
5, United States Code, is amended— 
(1) in paragraph (2)— 
(A) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(B) by redesignating subparagraph (B) as 
subparagraph (C); and 
(C) by inserting after subparagraph (A) 
the following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
111 
‘‘(B) that shall include a dashboard of 
open information security recommendations 
identified in the independent evaluations re-
quired by section 3555(a) of title 44; and’’; and 
(2) by adding at the end the following: 
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed to require the pub-
lication of information that is exempted from disclo-
sure under section 552 of this title.’’. 
SEC. 17. SECURITY OPERATIONS CENTER SHARED SERV-
ICE. 
(a) BRIEFING.—Not later than 180 days after the 
date of enactment of this Act, the Director of the Cyberse-
curity and Infrastructure Security Agency shall provide to 
the Committee on Homeland Security and Governmental 
Affairs of the Senate and the Committee on Homeland 
Security and the Committee on Oversight and Account-
ability of the House of Representatives a briefing on— 
(1) existing security operations center shared 
services; 
(2) the capability for such shared service to 
offer centralized and simultaneous support to mul-
tiple agencies; 
(3) the capability for such shared service to in-
tegrate with or support agency threat hunting activi-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
112 
ties authorized under section 3553 of title 44, 
United States Code, as amended by this Act; 
(4) the capability for such shared service to in-
tegrate with or support Federal vulnerability man-
agement activities; and 
(5) future plans for expansion and maturation 
of such shared service. 
(b) GAO REPORT.—Not less than 540 days after the 
date of enactment of this Act, the Comptroller General 
of the United States shall submit to the appropriate con-
gressional committees a report on Federal cybersecurity 
security operations centers that— 
(1) identifies Federal agency best practices for 
efficiency and effectiveness; 
(2) identifies non-Federal best practices used by 
large entity operations centers and entities providing 
operation centers as a service; and 
(3) includes recommendations for the Cyberse-
curity and Infrastructure Security Agency and any 
other relevant agency to improve the efficiency and 
effectiveness of security operations centers’ shared 
service offerings. 
SEC. 18. FEDERAL CYBERSECURITY REQUIREMENTS. 
(a) CODIFYING FEDERAL CYBERSECURITY REQUIRE-
MENTS IN TITLE 44.— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB