I 
117TH CONGRESS 
2D SESSION 
H. R. 6497 
To modernize Federal information security management and improve Federal 
cybersecurity to combat persisting and emerging threats, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 25, 2022 
Mrs. CAROLYN B. MALONEY of New York (for herself, Mr. COMER, Mr. CON-
NOLLY, Mr. SESSIONS, Ms. NORTON, Mr. KELLER, Ms. WASSERMAN 
SCHULTZ, Mr. HICE of Georgia, Mr. COOPER, Mr. C. SCOTT FRANKLIN 
of Florida, Ms. BROWN of Ohio, Mr. GIBBS, Mr. LYNCH, and Mr. 
RASKIN) introduced the following bill; which was referred to the Com-
mittee on Oversight and Reform, and in addition to the Committee on 
Science, Space, and Technology, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To modernize Federal information security management and 
improve Federal cybersecurity to combat persisting and 
emerging threats, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Modernization Act of 2022’’. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
Sec. 1. Short title. 
Sec. 2. Table of contents. 
Sec. 3. Definitions. 
TITLE I—UPDATES TO FISMA 
Sec. 101. Title 44 amendments. 
Sec. 102. Amendments to subtitle III of title 40. 
Sec. 103. Actions to enhance Federal incident response. 
Sec. 104. Additional guidance to agencies on FISMA updates. 
Sec. 105. Agency requirements to notify private sector entities impacted by in-
cidents. 
TITLE II—IMPROVING FEDERAL CYBERSECURITY 
Sec. 201. Mobile security standards. 
Sec. 202. Data and logging retention for incident response. 
Sec. 203. Federal penetration testing policy. 
Sec. 204. Ongoing threat hunting program. 
Sec. 205. Codifying vulnerability disclosure programs. 
Sec. 206. Implementing zero trust architecture. 
Sec. 207. GAO automation report. 
Sec. 208. Extension of Federal Acquisition Security Council. 
Sec. 209. Federal chief information security officer. 
Sec. 210. Extension of Chief Data Officer Council. 
Sec. 211. Council of the inspectors general on integrity and efficiency dash-
board. 
Sec. 212. Quantitative cybersecurity metrics. 
TITLE III—PILOT PROGRAMS TO ENHANCE FEDERAL 
CYBERSECURITY 
Sec. 301. Risk-based budget pilot. 
Sec. 302. Active cyber defensive study. 
Sec. 303. Security operations center as a service pilot. 
Sec. 304. Endpoint detection and response as a service pilot. 
SEC. 3. DEFINITIONS. 
In this Act, unless otherwise specified: 
(1) 
ADDITIONAL
CYBERSECURITY
PROCE-
DURE.—The term ‘‘additional cybersecurity proce-
dure’’ has the meaning given the term in section 
3552(b) of title 44, United States Code, as amended 
by this Act. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(2) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(3) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
(B) the Committee on Oversight and Re-
form of the House of Representatives; and 
(C) the Committee on Homeland Security 
of the House of Representatives. 
(4) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Office of Management and Budg-
et. 
(5) INCIDENT.—The term ‘‘incident’’ has the 
meaning given the term in section 3552(b) of title 
44, United States Code. 
(6) NATIONAL SECURITY SYSTEM.—The term 
‘‘national security system’’ has the meaning given 
the term in section 3552(b) of title 44, United 
States Code. 
(7) PENETRATION TEST.—The term ‘‘penetra-
tion test’’ has the meaning given the term in section 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
3552(b) of title 44, United States Code, as amended 
by this Act. 
(8) THREAT
HUNTING.—The term ‘‘threat 
hunting’’ means iteratively searching systems for 
threats that evade detection by automated threat de-
tection systems. 
(9) ZERO
TRUST
ARCHITECTURE.—The term 
‘‘zero trust architecture’’ means a security model, a 
set of system design principles, and a coordinated 
cybersecurity and system management strategy that 
employs continuous monitoring, risk-based access 
controls, or system security automation techniques 
to address the cybersecurity principle that threats 
exist both inside and outside traditional network 
boundaries with an assumption that a breach is in-
evitable or has likely already occurred, and therefore 
employs least-privileged access for network or system 
users while monitoring for anomalous or malicious 
activity. 
TITLE I—UPDATES TO FISMA 
SEC. 101. TITLE 44 AMENDMENTS. 
(a) SUBCHAPTER I AMENDMENTS.—Subchapter I of 
chapter 35 of title 44, United States Code, is amended— 
(1) in subsection (a)(1)(B) of section 3504— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(A) by striking clause (v) and inserting the 
following: 
‘‘(v) confidentiality, privacy, disclo-
sure, and sharing of information;’’; 
(B) by redesignating clause (vi) as clause 
(vii); and 
(C) by inserting after clause (v) the fol-
lowing: 
‘‘(vi) in consultation with the National 
Cyber Director, confidentiality and security 
of information; and’’; 
(2) in section 3505— 
(A) in paragraph (2) of the first subsection 
designated as subsection (c) by adding ‘‘dis-
covery of internet-accessible information sys-
tems and assets, as well as’’ after ‘‘an inventory 
under this subsection shall include’’; 
(B) in paragraph (3) of the first subsection 
designated as subsection (c)— 
(i) in subparagraph (B)— 
(I) by inserting ‘‘the Secretary of 
Homeland Security acting through the 
Director of the Cybersecurity and In-
frastructure Security Agency, the Na-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
tional Cyber Director, and’’ before 
‘‘the Comptroller General’’; and 
(II) by striking ‘‘and’’ at the end; 
(ii) in subparagraph (C)(v), by strik-
ing the period at the end and inserting ‘‘; 
and’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(D) maintained on a continual basis 
through the use of automation, machine-read-
able data, and scanning wherever practicable.’’; 
and 
(C) by striking the second subsection des-
ignated as subsection (c); 
(3) in section 3506— 
(A) in subsection (a)(3), by inserting ‘‘In 
carrying out these duties, the Chief Information 
Officer shall coordinate, as appropriate, with 
the Chief Data Officer in accordance with the 
designated functions under section 3520(c).’’ 
after ‘‘reduction of information collection bur-
dens on the public.’’; and 
(B) in subsection (b)(1)(C), by inserting ‘‘, 
availability’’ after ‘‘integrity’’; and 
(4) in section 3513— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(A) by redesignating subsection (c) as sub-
section (d); and 
(B) by inserting after subsection (b) the 
following: 
‘‘(c) Each agency providing a written plan under sub-
section (b) shall provide any portion of the written plan 
addressing information security to the National Cyber Di-
rector.’’. 
(b) SUBCHAPTER II DEFINITIONS.— 
(1) IN GENERAL.—Section 3552(b) of title 44, 
United States Code, is amended— 
(A) by redesignating paragraphs (1), (2), 
(3), (4), (5), (6), and (7) as paragraphs (2), 
(4), (5), (6), (7), (9), and (11), respectively; 
(B) by inserting before paragraph (2), as 
so redesignated, the following: 
‘‘(1) The term ‘additional cybersecurity proce-
dure’ means a process, procedure, or other activity 
that is established in excess of the information secu-
rity standards promulgated under section 11331(b) 
of title 40 to increase the security and reduce the cy-
bersecurity risk of agency systems.’’; 
(C) by inserting after paragraph (2), as so 
redesignated, the following: 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) The term ‘high value asset’ means infor-
mation or an information system that the head of an 
agency determines, using policies, principles, stand-
ards, or guidelines issued by the Director under sec-
tion 3553(a), to be so critical to the agency that the 
loss or corruption of the information or the loss of 
access to the information system would have a seri-
ous impact on the ability of the agency to perform 
the mission of the agency or conduct business.’’; 
(D) by inserting after paragraph (7), as so 
redesignated, the following: 
‘‘(8) The term ‘major incident’ has the meaning 
given the term in guidance issued by the Director 
under section 3598(a).’’; 
(E) by inserting after paragraph (9), as so 
redesignated, the following: 
‘‘(10) The term ‘penetration test’ has the mean-
ing given the term in guidance issued by the Direc-
tor.’’; and 
(F) by inserting after paragraph (11), as 
so redesignated, the following: 
‘‘(12) The term ‘shared service’ means a cen-
tralized business or mission capability that is pro-
vided to multiple organizations within an agency or 
to multiple agencies.’’. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(2) CONFORMING AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Section 1001(c)(1)(A) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 511(1)(A)) is 
amended by striking ‘‘section 3552(b)(5)’’ and 
inserting ‘‘section 3552(b)’’. 
(B) TITLE 10.— 
(i) SECTION 2222.—Section 2222(i)(8) 
of title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)(A)’’ and 
inserting ‘‘section 3552(b)(9)(A)’’. 
(ii) 
SECTION
2223.—Section 
2223(c)(3) of title 10, United States Code, 
is 
amended 
by 
striking 
‘‘section 
3552(b)(6)’’ 
and 
inserting 
‘‘section 
3552(b)’’. 
(iii) SECTION 2315.—Section 2315 of 
title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)’’ and in-
serting ‘‘section 3552(b)’’. 
(iv) 
SECTION
2339A.—Section 
2339a(e)(5) of title 10, United States 
Code, is amended by striking ‘‘section 
3552(b)(6)’’ 
and 
inserting 
‘‘section 
3552(b)’’. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(I) in paragraph (3), by striking 
‘‘section 3532(1)’’ and inserting ‘‘sec-
tion 3552(b)’’; and 
(II) in paragraph (5), by striking 
‘‘section 3532(b)(2)’’ and inserting 
‘‘section 3552(b)’’. 
(c) SUBCHAPTER II AMENDMENTS.—Subchapter II 
of chapter 35 of title 44, United States Code, is amend-
ed— 
(1) in section 3551— 
(A) in paragraph (4), by striking ‘‘diag-
nose and improve’’ and inserting ‘‘integrate, de-
liver, diagnose, and improve’’; 
(B) in paragraph (5), by striking ‘‘and’’ at 
the end; 
(C) in paragraph (6), by striking the pe-
riod at the end and inserting a semicolon; and 
(D) by adding at the end the following: 
‘‘(7) recognize that each agency has specific 
mission requirements and, at times, unique cyberse-
curity requirements to meet the mission of the agen-
cy; 
‘‘(8) recognize that each agency does not have 
the same resources to secure agency systems, and an 
agency should not be expected to have the capability 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
to secure the systems of the agency from advanced 
adversaries alone; and 
‘‘(9) recognize that a holistic Federal cybersecu-
rity model is necessary to account for differences be-
tween the missions and capabilities of agencies.’’; 
(2) in section 3553— 
(A) in subsection (a)— 
(i) in paragraph (5), by striking 
‘‘and’’ at the end; 
(ii) in paragraph (6), by striking the 
period at the end and inserting ‘‘; and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
‘‘(7) promoting, in consultation with the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency, the National Cyber Director, and the Direc-
tor of the National Institute of Standards and Tech-
nology— 
‘‘(A) the use of automation to improve 
Federal cybersecurity and visibility with respect 
to the implementation of Federal cybersecurity; 
and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) the use of zero trust architecture to 
improve resiliency and timely response actions 
to incidents on Federal systems.’’; 
(B) in subsection (b)— 
(i) in the matter preceding paragraph 
(1), by striking ‘‘The Secretary, in con-
sultation with the Director’’ and inserting 
‘‘The Secretary of Homeland Security, act-
ing through the Director of the Cybersecu-
rity and Infrastructure Security Agency 
and in consultation with the Director and 
the National Cyber Director’’; 
(ii) in paragraph (2)(A), by inserting 
‘‘and reporting requirements under sub-
chapter IV of this chapter’’ after ‘‘section 
3556’’; 
(iii) redesignate paragraphs (8) and 
(9) as paragraphs (9) and (10); and 
(iv) insert a new paragraph (8): 
‘‘(8) expeditiously seek opportunities to reduce 
costs, administrative burdens, and other barriers to 
information technology security and modernization 
for Federal agencies, including through— 
‘‘(A) central shared services contracts for 
cybersecurity capabilities identified as optimal 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
by the Director, in coordination with the Sec-
retary acting through the Director of the Cy-
bersecurity and Infrastructure Security Agency 
and other agencies as appropriate; and 
‘‘(B) offering technical assistance and ex-
pertise to agencies on the selection and success-
ful engagement of highly adaptive cybersecurity 
service contracts and other relevant contracts 
provided by the U.S. General Services Adminis-
tration.’’; 
(C) in subsection (c)— 
(i) in the matter preceding paragraph 
(1), by striking ‘‘each year’’ and inserting 
‘‘each year during which agencies are re-
quired to submit reports under section 
3554(c)’’ and by striking ‘‘preceding year’’ 
and inserting ‘‘preceding two years’’; 
(ii) by striking paragraph (1); 
(iii) by redesignating paragraphs (2), 
(3), and (4) as paragraphs (1), (2), and 
(3), respectively; 
(iv) in paragraph (3), as so redesig-
nated, by striking ‘‘and’’ at the end; and 
(v) by inserting after paragraph (3), 
as so redesignated, the following: 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(4) a summary of each assessment of Federal 
risk posture performed under subsection (i); and’’; 
(D) by redesignating subsections (i), (j), 
(k), and (l) as subsections (j), (k), (l), and (m) 
respectively; 
(E) in subsection (h)— 
(i) in paragraph (2), subparagraph 
(A) adding ‘‘and the National Cyber Direc-
tor’’ after ‘‘in coordination with the Direc-
tor’’; 
(ii) in paragraph (2), subparagraph 
(D) adding ‘‘, the National Cyber Direc-
tor,’’ after ‘‘notify the Director’’; and 
(iii) in paragraph (3), subparagraph 
(A), clause (iv) adding ‘‘, the National 
Cyber Director,’’ after ‘‘the Secretary pro-
vides prior notice to the Director’’; 
(F) by inserting after subsection (h) the 
following: 
‘‘(i) FEDERAL RISK ASSESSMENTS.—On an ongoing 
and continuous basis, the Director of the Cybersecurity 
and Infrastructure Security Agency shall perform assess-
ments using any available information on the cybersecu-
rity posture of agencies, and brief the Director and Na-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
tional Cyber Director on the findings of those assessments 
including— 
‘‘(1) the status of agency cybersecurity remedial 
actions described in section 3554(b)(7); 
‘‘(2) any vulnerability information relating to 
the systems of an agency that is known by the agen-
cy; 
‘‘(3) analysis of incident information under sec-
tion 3597; 
‘‘(4) evaluation of penetration testing per-
formed under section 3559A; 
‘‘(5) evaluation of vulnerability disclosure pro-
gram information under section 3559B; 
‘‘(6) evaluation of agency threat hunting re-
sults; 
‘‘(7) evaluation of Federal and non-Federal 
cyber threat intelligence; 
‘‘(8) data on agency compliance with standards 
issued under section 11331 of title 40; 
‘‘(9) agency system risk assessments performed 
under section 3554(a)(1)(A); and 
‘‘(10) any other information the Director of the 
Cybersecurity and Infrastructure Security Agency 
determines relevant.’’; 
(G) in subsection (j), as so redesignated— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(i) by striking ‘‘Not later than’’ and 
inserting: 
‘‘(1) IN GENERAL.—Not later than’’; 
(ii) by striking ‘‘regarding the spe-
cific’’ and inserting ‘‘that includes a sum-
mary of— 
‘‘(A) the specific’’; 
(iii) in paragraph (1), as so des-
ignated, by striking the period at the end 
and inserting ‘‘; and’’; and 
(iv) by adding at the end the fol-
lowing: 
‘‘(B) the trends identified in the Federal 
risk assessments performed under subsection 
(i). 
‘‘(2) FORM.—The report required under para-
graph (1) shall be unclassified but may include a 
classified annex.’’; and 
(H) by adding at the end the following: 
‘‘(n) BINDING OPERATIONAL DIRECTIVES.—If the 
Director of the Cybersecurity and Infrastructure Security 
Agency issues a binding operational directive or an emer-
gency directive under this section, not later than 7 days 
after the date on which the binding operational directive 
requires an agency to take an action, the Director of the 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
Cybersecurity and Infrastructure Security Agency shall 
provide to the Director and National Cyber Director the 
status of the implementation of the binding operational 
directive at the agency.’’; 
(3) in section 3554— 
(A) in subsection (a)— 
(i) in paragraph (1)— 
(I) by redesignating subpara-
graphs (A), (B), and (C) as subpara-
graphs (B), (C), and (D), respectively; 
(II) by inserting before subpara-
graph (B), as so redesignated, the fol-
lowing: 
‘‘(A) on an ongoing and continuous basis, 
performing an agency system risk assessment 
that— 
‘‘(i) identifies and documents the high 
value assets of the agency using guidance 
from the Director; 
‘‘(ii) evaluates the data assets inven-
toried under section 3511 for sensitivity to 
compromises in confidentiality, integrity, 
and availability; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(iii) identifies agency systems that 
have access to or hold the data assets 
inventoried under section 3511; 
‘‘(iv) evaluates the threats facing 
agency systems and data, including high 
value assets, based on Federal and non- 
Federal cyber threat intelligence products, 
where available; 
‘‘(v) evaluates the vulnerability of 
agency systems and data, including high 
value assets, including by analyzing— 
‘‘(I) the results of penetration 
testing performed by the Department 
of Homeland Security under section 
3553(b)(9); 
‘‘(II) the results of penetration 
testing 
performed 
under 
section 
3559A; 
‘‘(III) information provided to 
the agency through the vulnerability 
disclosure program of the agency 
under section 3559B; 
‘‘(IV) incidents; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(V) any other vulnerability in-
formation relating to agency systems 
that is known to the agency; 
‘‘(vi) assesses the impacts of potential 
agency incidents to agency systems, data, 
and operations based on the evaluations 
described in clauses (ii) and (iv) and the 
agency systems identified under clause 
(iii); and 
‘‘(vii) assesses the consequences of po-
tential incidents occurring on agency sys-
tems that would impact systems at other 
agencies, including due to interconnectivity 
between different agency systems or oper-
ational reliance on the operations of the 
system or data in the system;’’; 
(III) in subparagraph (B), as so 
redesignated, in the matter preceding 
clause (i), by striking ‘‘providing in-
formation’’ and inserting ‘‘using infor-
mation from the assessment con-
ducted under subparagraph (A), pro-
viding information’’; 
(IV) in subparagraph (C), as so 
redesignated— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(aa) in clause (ii) by insert-
ing 
‘‘binding’’ 
before 
‘‘oper-
ational’’; and 
(bb) in clause (vi), by strik-
ing ‘‘and’’ at the end; and 
(V) by adding at the end the fol-
lowing: 
‘‘(E) providing an update on the ongoing 
and continuous assessment performed under 
subparagraph (A)— 
‘‘(i) upon request, to the inspector 
general of the agency or the Comptroller 
General of the United States; and 
‘‘(ii) on a periodic basis, as deter-
mined by guidance issued by the Director 
but not less frequently than every 2 years, 
to— 
‘‘(I) the Director; 
‘‘(II) the Director of the Cyberse-
curity and Infrastructure Security 
Agency; and 
‘‘(III) the National Cyber Direc-
tor; 
‘‘(F) in consultation with the Director of 
the Cybersecurity and Infrastructure Security 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
Agency and not less frequently than once every 
3 years, performing an evaluation of whether 
additional cybersecurity procedures are appro-
priate for securing a system of, or under the 
supervision of, the agency, which shall— 
‘‘(i) be completed considering the 
agency system risk assessment performed 
under subparagraph (A); and 
‘‘(ii) include a specific evaluation for 
high value assets; 
‘‘(G) not later than 30 days after com-
pleting the evaluation performed under sub-
paragraph (F), providing the evaluation and an 
implementation plan, if applicable, for using ad-
ditional cybersecurity procedures determined to 
be appropriate to— 
‘‘(i) the Director of the Cybersecurity 
and Infrastructure Security Agency; 
‘‘(ii) the Director; and 
‘‘(iii) the National Cyber Director; 
and 
‘‘(H) if the head of the agency determines 
there is need for additional cybersecurity proce-
dures, ensuring that those additional cybersecu-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
rity procedures are reflected in the budget re-
quest of the agency;’’; and 
(ii) in paragraph (2)— 
(I) in subparagraph (A), by in-
serting ‘‘in accordance with the agen-
cy system risk assessment performed 
under paragraph (1)(A)’’ after ‘‘infor-
mation systems’’; 
(II) in subparagraph (B)— 
(aa) by striking ‘‘in accord-
ance with standards’’ and insert-
ing ‘‘in accordance with— 
‘‘(i) standards’’; and 
(bb) by adding at the end 
the following: 
‘‘(ii) the evaluation performed under 
paragraph (1)(F); and 
‘‘(iii) the implementation plan de-
scribed in paragraph (1)(G);’’; and 
(III) in subparagraph (D), by in-
serting ‘‘, through the use of penetra-
tion testing, the vulnerability disclo-
sure program established under sec-
tion 3559B, and other means,’’ after 
‘‘periodically’’; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(B) in subsection (b)— 
(i) by striking paragraph (1) and in-
serting the following: 
‘‘(1) pursuant to subsection (a)(1)(A), per-
forming ongoing and continuous agency system risk 
assessment, which may include using automated 
tools consistent with standards and guidelines pro-
mulgated under section 11331 of title 40, as applica-
ble;’’; 
(ii) in paragraph (2)(D)— 
(I) by redesignating clauses (iii) 
and (iv) as clauses (iv) and (v), re-
spectively; 
(II) by inserting after clause (ii) 
the following: 
‘‘(iii) binding operational directives 
and emergency directives promulgated by 
the Director of the Cybersecurity and In-
frastructure Security Agency under section 
3553;’’; and 
(III) in clause (iv), as so redesig-
nated, by striking ‘‘as determined by 
the agency; and’’ and inserting ‘‘as 
determined by the agency, considering 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
the agency risk assessment performed 
under subsection (a)(1)(A).’’; 
(iii) in paragraph (5)(A), by inserting 
‘‘, including penetration testing, as appro-
priate,’’ after ‘‘shall include testing’’; 
(iv) by redesignating paragraphs (7) 
and (8) as paragraphs (8) and (9), respec-
tively; 
(v) by inserting after paragraph (6) 
the following: 
‘‘(7) a process for providing the status of every 
remedial action, as well as unremediated identified 
system vulnerabilities, to the Director and the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency, using automation and machine-readable 
data to the greatest extent practicable;’’; and 
(vi) in paragraph (8)(C), as so redes-
ignated— 
(I) by striking clause (ii) and in-
serting the following: 
‘‘(ii) notifying and consulting with the 
Federal information security incident cen-
ter established under section 3556 pursu-
ant to the requirements of section 3594;’’; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(II) by redesignating clause (iii) 
as clause (iv); 
(III) by inserting after clause (ii) 
the following: 
‘‘(iii) performing the notifications and 
other activities required under subchapter 
IV of this chapter; and’’; and 
(IV) in clause (iv), as so redesig-
nated— 
(aa) in subclause (II), by 
adding ‘‘and’’ at the end; 
(bb) by striking subclause 
(III); and 
(cc) by redesignating sub-
clause (IV) as subclause (III); 
and 
(C) in subsection (c)— 
(i) by redesignating paragraph (2) as 
paragraph (5); 
(ii) by striking paragraph (1) and in-
serting the following: 
‘‘(1) BIANNUAL
REPORT.—Not later than 2 
years after the date of the enactment of the Federal 
Information Security Modernization Act of 2022 and 
not less frequently than once every 2 years there-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
after, using the continuous and ongoing agency sys-
tem risk assessment under subsection (a)(1)(A), the 
head of each agency shall submit to the Director, 
the Director of the Cybersecurity and Infrastructure 
Security Agency, the majority and minority leaders 
of the Senate, the Speaker and minority leader of 
the House of Representatives, the Committee on 
Homeland Security and Governmental Affairs of the 
Senate, the Committee on Oversight and Reform of 
the House of Representatives, the Committee on 
Homeland Security of the House of Representatives, 
the Committee on Commerce, Science, and Trans-
portation of the Senate, the Committee on Science, 
Space, and Technology of the House of Representa-
tives, the appropriate authorization and appropria-
tions committees of Congress, the National Cyber 
Director, and the Comptroller General of the United 
States a report that— 
‘‘(A) summarizes the agency system risk 
assessment 
performed 
under 
subsection 
(a)(1)(A); 
‘‘(B) evaluates the adequacy and effective-
ness of information security policies, proce-
dures, and practices of the agency to address 
the risks identified in the agency system risk 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
assessment 
performed 
under 
subsection 
(a)(1)(A), including an analysis of the agency’s 
cybersecurity and incident response capabilities 
using the metrics established under section 
224(c) of the Cybersecurity Act of 2015 (6 
U.S.C. 1522(c)); 
‘‘(C) summarizes the evaluation and imple-
mentation plans described in subparagraphs (F) 
and (G) of subsection (a)(1) and whether those 
evaluation and implementation plans call for 
the use of additional cybersecurity procedures 
determined to be appropriate by the agency; 
and 
‘‘(D) summarizes the status of remedial 
actions identified by inspector general of the 
agency, the Comptroller General of the United 
States, and any other source determined appro-
priate by the head of the agency. 
‘‘(2) UNCLASSIFIED
REPORTS.—Each report 
submitted under paragraph (1)— 
‘‘(A) shall be, to the greatest extent prac-
ticable, in an unclassified and otherwise uncon-
trolled form; and 
‘‘(B) may include a classified annex. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) ACCESS TO INFORMATION.—The head of 
an agency shall ensure that, to the greatest extent 
practicable, information is included in the unclassi-
fied form of the report submitted by the agency 
under paragraph (2)(A). 
‘‘(4) BRIEFINGS.—During each year during 
which a report is not required to be submitted under 
paragraph (1), the Director shall provide to the con-
gressional committees described in paragraph (1) a 
briefing summarizing current cybersecurity posture 
of agencies.’’; and 
(iii) in paragraph (5), as so redesig-
nated, by inserting ‘‘, including the report-
ing procedures established under section 
11315(d) of title 40 and subsection 
(a)(3)(A)(v) of this section,’’ after ‘‘poli-
cies, procedures, and practices’’; and 
(4) in section 3555— 
(A) in the section heading, by striking 
‘‘ANNUAL
INDEPENDENT’’ 
and 
inserting 
‘‘INDEPENDENT’’; 
(B) in subsection (a)— 
(i) in paragraph (1), by inserting 
‘‘during which a report is required to be 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
submitted under section 3553(c),’’ after 
‘‘Each year’’; 
(ii) in paragraph (2)(A), by inserting 
‘‘, including by penetration testing and 
analyzing the vulnerability disclosure pro-
gram of the agency’’ after ‘‘information 
systems’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(3) An evaluation under this section may in-
clude recommendations for improving the cybersecu-
rity posture of the agency.’’; 
(C) in subsection (b)(1), by striking ‘‘an-
nual’’; 
(D) in subsection (e)(1), by inserting ‘‘dur-
ing which a report is required to be submitted 
under section 3553(c)’’ after ‘‘Each year’’; 
(E) by striking subsection (f) and inserting 
the following: 
‘‘(f) PROTECTION OF INFORMATION.—(1) Agencies, 
evaluators, and other recipients of information that, if dis-
closed, may cause grave harm to the efforts of Federal 
information security officers, shall take appropriate steps 
to ensure the protection of that information, including 
safeguarding the information from public disclosure. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) The protections required under paragraph (1) 
shall be commensurate with the risk and comply with all 
applicable laws and regulations. 
‘‘(3) With respect to information that is not related 
to national security systems, agencies and evaluators shall 
make a summary of the information unclassified and pub-
licly available, including information that does not iden-
tify— 
‘‘(A) specific information system incidents; or 
‘‘(B) 
specific 
information 
system 
vulnerabilities.’’; 
(F) in subsection (g)(2)— 
(i) by striking ‘‘this subsection shall’’ 
and inserting ‘‘this subsection— 
‘‘(A) shall’’; 
(ii) in subparagraph (A), as so des-
ignated, by striking the period at the end 
and inserting ‘‘; and’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(B) identify any entity that performs an 
independent evaluation under subsection (b).’’; 
and 
(G) striking subsection (j); and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(5) in section 3556(a)(4) by striking ‘‘3554(b)’’ 
and inserting ‘‘3554(a)(1)(A)’’. 
(d) CONFORMING AMENDMENTS.— 
(1) TABLE OF SECTIONS.—The table of sections 
for chapter 35 of title 44, United States Code, is 
amended— 
(A) by striking the item relating to section 
3553 and inserting the following: 
‘‘3553. Authority and functions of the Director and the Director of the Cyberse-
curity and Infrastructure Security Agency.’’; 
and 
(B) by striking the item relating to section 
3555 and inserting the following: 
‘‘3555. Independent evaluation.’’. 
(2) OMB REPORTS.—Section 226(c) of the Cy-
bersecurity Act of 2015 (6 U.S.C. 1524(c)) is 
amended— 
(A) in paragraph (1)(B), in the matter 
preceding clause (i), by striking ‘‘annually 
thereafter’’ and inserting ‘‘thereafter during the 
years during which a report is required to be 
submitted under section 3553(c) of title 44, 
United States Code’’; and 
(B) in paragraph (2)(B), in the matter 
preceding clause (i)— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(i) by striking ‘‘annually thereafter’’ 
and inserting ‘‘thereafter during the years 
during which a report is required to be 
submitted under section 3553(c) of title 
44, United States Code’’; and 
(ii) by striking ‘‘the report required 
under section 3553(c) of title 44, United 
States Code’’ and inserting ‘‘that report’’. 
(3) 
NIST 
RESPONSIBILITIES.—Section 
20(d)(3)(B) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3(d)(3)(B)) is 
amended by striking ‘‘annual’’. 
(e) FEDERAL SYSTEM INCIDENT RESPONSE.— 
(1) IN
GENERAL.—Chapter 35 of title 44, 
United States Code, is amended by adding at the 
end the following: 
‘‘SUBCHAPTER IV—FEDERAL SYSTEM 
INCIDENT RESPONSE 
‘‘§ 3591. Definitions 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(b), the definitions under sections 3502 and 3552 shall 
apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this 
subchapter: 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) APPROPRIATE REPORTING ENTITIES.—The 
term ‘appropriate reporting entities’ means— 
‘‘(A) the majority and minority leaders of 
the Senate; 
‘‘(B) the Speaker and minority leader of 
the House of Representatives; 
‘‘(C) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(D) the Committee on Oversight and Re-
form of the House of Representatives; 
‘‘(E) the Committee on Homeland Security 
of the House of Representatives; 
‘‘(F) the appropriate authorization and ap-
propriations committees of Congress; 
‘‘(G) the Director; 
‘‘(H) the Director of the Cybersecurity and 
Infrastructure Security Agency; 
‘‘(I) the National Cyber Director; 
‘‘(J) the Comptroller General of the United 
States; and 
‘‘(K) the inspector general of any impacted 
agency. 
‘‘(2) AWARDEE.—The term ‘awardee’— 
‘‘(A) means a person, business, or other 
entity that receives a grant from, or is a party 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
to a cooperative agreement or an other trans-
action agreement with, an agency; and 
‘‘(B) includes any subgrantee of a person, 
business, or other entity described in subpara-
graph (A). 
‘‘(3) BREACH.—The term ‘breach’ shall be de-
fined by the Director. 
‘‘(4) 
CONTRACTOR.—The 
term 
‘contractor’ 
means a prime contractor of an agency or a subcon-
tractor of a prime contractor of an agency. 
‘‘(5) FEDERAL INFORMATION.—The term ‘Fed-
eral information’ means information created, col-
lected, processed, maintained, disseminated, dis-
closed, or disposed of by or for the Federal Govern-
ment in any medium or form. 
‘‘(6) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ means an infor-
mation system used or operated by an agency, a con-
tractor, or another organization on behalf of an 
agency. 
‘‘(7) INTELLIGENCE
COMMUNITY.—The term 
‘intelligence community’ has the meaning given the 
term in section 3 of the National Security Act of 
1947 (50 U.S.C. 3003). 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(8) 
NATIONWIDE
CONSUMER
REPORTING 
AGENCY.—The term ‘nationwide consumer reporting 
agency’ means a consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
‘‘(9) VULNERABILITY DISCLOSURE.—The term 
‘vulnerability disclosure’ means a vulnerability iden-
tified under section 3559B. 
‘‘§ 3592. Notification of breach 
‘‘(a) NOTIFICATION.—As expeditiously as practicable 
and without unreasonable delay, and in any case not later 
than 45 days after an agency has a reasonable basis to 
conclude that a breach has occurred, the head of the agen-
cy, in consultation with the chief privacy officer of the 
agency, shall— 
‘‘(1) determine whether notice to any individual 
potentially affected by the breach is appropriate 
based on an assessment of the risk of harm to the 
individual that considers— 
‘‘(A) the nature and sensitivity of the per-
sonally identifiable information affected by the 
breach; 
‘‘(B) the likelihood of access to and use of 
the personally identifiable information affected 
by the breach; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) the type of breach; and 
‘‘(D) any other factors determined by the 
Director; and 
‘‘(2) as appropriate, provide written notice in 
accordance with subsection (b) to each individual po-
tentially affected by the breach— 
‘‘(A) to the last known mailing address of 
the individual; or 
‘‘(B) through an appropriate alternative 
method of notification that the head of the 
agency or a designated senior-level individual of 
the agency selects based on factors determined 
by the Director. 
‘‘(b) CONTENTS
OF NOTICE.—Each notice of a 
breach provided to an individual under subsection (a)(2) 
shall include— 
‘‘(1) a brief description of the breach; 
‘‘(2) if possible, a description of the types of 
personally identifiable information affected by the 
breach; 
‘‘(3) contact information of the agency that 
may be used to ask questions of the agency, which— 
‘‘(A) shall include an e-mail address or an-
other digital contact mechanism; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) may include a telephone number, 
mailing address, or a website; 
‘‘(4) information on any remedy being offered 
by the agency; 
‘‘(5) any applicable educational materials relat-
ing to what individuals can do in response to a 
breach that potentially affects their personally iden-
tifiable information, including relevant contact infor-
mation for Federal law enforcement agencies and 
each nationwide consumer reporting agency; and 
‘‘(6) any other appropriate information, as de-
termined by the head of the agency or established in 
guidance by the Director. 
‘‘(c) DELAY OF NOTIFICATION.— 
‘‘(1) IN GENERAL.—The Attorney General, the 
Director of National Intelligence, or the Secretary of 
Homeland Security may delay a notification required 
under subsection (a) if the notification would— 
‘‘(A) impede a criminal investigation or a 
national security activity; 
‘‘(B) reveal sensitive sources and methods; 
‘‘(C) cause damage to national security; or 
‘‘(D) hamper security remediation actions. 
‘‘(2) DOCUMENTATION.— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) IN GENERAL.—Any delay under para-
graph (1) shall be reported in writing to the Di-
rector, the Attorney General, the Director of 
National Intelligence, the Secretary of Home-
land Security, the National Cyber Director, the 
Director of the Cybersecurity and Infrastruc-
ture Security Agency, and the head of the agen-
cy and the inspector general of the agency that 
experienced the breach. 
‘‘(B) CONTENTS.—A report required under 
subparagraph (A) shall include a written state-
ment from the entity that delayed the notifica-
tion explaining the need for the delay. 
‘‘(C) FORM.—The report required under 
subparagraph (A) shall be unclassified but may 
include a classified annex. 
‘‘(3) RENEWAL.—A delay under paragraph (1) 
shall be for a period of 60 days and may be renewed. 
‘‘(d) UPDATE NOTIFICATION.—If an agency deter-
mines there is a significant change in the reasonable basis 
to conclude that a breach occurred, a significant change 
to the determination made under subsection (a)(1), or that 
it is necessary to update the details of the information pro-
vided to potentially affected individuals as described in 
subsection (b), the agency shall as expeditiously as prac-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
ticable and without unreasonable delay, and in any case 
not later than 30 days after such a determination, notify 
each individual who received a notification pursuant to 
subsection (a) of those changes. 
‘‘(e) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to limit— 
‘‘(1) the Director from issuing guidance relat-
ing to notifications or the head of an agency from 
notifying individuals potentially affected by breaches 
that are not determined to be major incidents; or 
‘‘(2) the Director from issuing guidance relat-
ing to notifications of major incidents or the head of 
an agency from providing more information than de-
scribed in subsection (b) when notifying individuals 
potentially affected by breaches. 
‘‘§ 3593. Congressional and executive branch reports 
‘‘(a) INITIAL REPORT.— 
‘‘(1) IN GENERAL.—Not later than 72 hours 
after an agency has a reasonable basis to conclude 
that a major incident occurred, the head of the 
agency impacted by the major incident shall submit 
to the appropriate reporting entities a written re-
port. Within 7 days of a major incident determina-
tion, the head of the agency impacted shall coordi-
nate with the National Cyber Director, or their des-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
ignee, to provide a briefing, along with any other 
Federal entity determined appropriate by the Na-
tional Cyber Director, to the Committee on Home-
land Security and Governmental Affairs of the Sen-
ate, the Committee on Oversight and Reform of the 
House of Representatives, the Committee on Home-
land Security of the House of Representatives, and 
the appropriate authorization and appropriations 
committees of Congress, in the manner requested by 
the Congressional entities, taking into account— 
‘‘(A) the information known at the time of 
the report, including the threat having likely 
caused the major incident; 
‘‘(B) the sensitivity of the details associ-
ated with the major incident; and 
‘‘(C) the classification level of the informa-
tion contained in the report. 
‘‘(2) CONTENTS.—A report required under 
paragraph (1) shall include, in a manner that ex-
cludes or otherwise reasonably protects personally 
identifiable information and to the extent permitted 
by applicable law, including privacy and statistical 
laws— 
‘‘(A) a summary of the information avail-
able about the major incident, including how 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
the major incident occurred and, if applicable, 
information relating to the major incident as a 
breach, based on information available to agen-
cy officials as of the date on which the agency 
submits the report; 
‘‘(B) if applicable, whether any ransom has 
been demanded or paid, or plans to be paid, by 
any entity operating a Federal information sys-
tem or with access to a Federal information 
system, unless disclosure of such information 
may disrupt an active Federal law enforcement 
or national security operation; 
‘‘(C) if applicable, a description and any 
associated documentation of any circumstances 
necessitating a delay in notification to individ-
uals potentially affected by the major incident 
under subsection (c) of section 3592; and 
‘‘(D) if applicable, an assessment of the 
impacts to the agency, the Federal Government, 
or the security of the United States, based on 
information available to agency officials on the 
date on which the agency submits the report. 
‘‘(3) COMPONENTS OF BRIEFING.—The 7 day 
briefing required under paragraph (1)— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) shall, to the greatest extent prac-
ticable, include an unclassified component; and 
‘‘(B) may include a classified component. 
‘‘(b) SUPPLEMENTAL REPORT.—Within a reasonable 
amount of time, but not later than 30 days after the date 
on which an agency submits a written report under sub-
section (a), the head of the agency shall provide to the 
appropriate reporting entities written updates on the 
major incident and, to the extent practicable, provide a 
briefing to the congressional committees described in sub-
section (a)(1), including summaries of— 
‘‘(1) vulnerabilities, means by which the major 
incident occurred, and impacts to the agency relat-
ing to the major incident; 
‘‘(2) any risk assessment and subsequent risk- 
based security implementation of the affected infor-
mation system before the date on which the major 
incident occurred; 
‘‘(3) an estimate of the number of individuals 
potentially affected by the major incident based on 
information available to agency officials as of the 
date on which the agency provides the update; 
‘‘(4) an assessment of the risk of harm to indi-
viduals potentially affected by the major incident 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
based on information available to agency officials as 
of the date on which the agency provides the update; 
‘‘(5) an update to the assessment of the risk to 
agency operations, or to impacts on other agency or 
non-Federal entity operations, affected by the major 
incident based on information available to agency of-
ficials as of the date on which the agency provides 
the update; and 
‘‘(6) the detection, response, and remediation 
actions of the agency, including any support pro-
vided by the Cybersecurity and Infrastructure Secu-
rity Agency under section 3594(d) and status up-
dates on the notification process described in section 
3592(a), including any delay described in subsection 
(c) of section 3592, if applicable. 
‘‘(c) UPDATE REPORT.—If the agency, or the Na-
tional Cyber Director, determines that there is any signifi-
cant change in the understanding of the agency of the 
scope, scale, or consequence of a major incident for which 
an agency submitted a written report under subsection 
(a), the agency shall provide an updated report to the ap-
propriate reporting entities that includes information re-
lating to the change in understanding. 
‘‘(d) BIANNUAL REPORT.—Each agency shall submit 
as part of the biannual report required under section 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
3554(c)(1) of this title a description of each major inci-
dent that occurred during the 2-year period preceding the 
date on which the biannual report is submitted. 
‘‘(e) DELAY REPORT.— 
‘‘(1) IN GENERAL.—The Director shall submit 
to the appropriate reporting entities an annual re-
port on all notification delays granted pursuant to 
subsection (c) of section 3592. 
‘‘(2) COMPONENT OF OTHER REPORT.—The Di-
rector may submit the report required under para-
graph (1) as a component of the annual report sub-
mitted under section 3597(b). 
‘‘(f) REPORT AND BRIEFING CONSISTENCY.—In car-
rying out the duties under this section, and to achieve con-
sistent and understandable agency reporting to Congress, 
the National Cyber Director shall— 
‘‘(1) provide to agencies formatting guidelines 
and recommended contents of information to be in-
cluded in the reports and briefings required under 
this section, including recommendations for the use 
of plain language terminology and consistent for-
mats for presenting any associated metrics; and 
‘‘(2) maintain a historical archive and major in-
cident log of all reports and briefings provided under 
the requirements of this section, which shall include 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
at a minimum an archive of the full contents of any 
written report and associated documentation, the re-
porting agency, the date of submission, and a list of 
the recipient Congressional entities, which shall be 
made available upon request to the Congressional 
entities listed under subsection (a)(1) and may, to 
the extent practicable, utilize an internet accessible 
portal for appropriate Congressional staff to directly 
access the log and archived materials required to be 
maintained under this paragraph. 
‘‘(g) REPORT DELIVERY.—Any written report re-
quired to be submitted under this section may be sub-
mitted in a paper or electronic format. 
‘‘(h) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to limit— 
‘‘(1) the ability of an agency to provide addi-
tional reports or briefings to Congress; or 
‘‘(2) Congress from requesting additional infor-
mation from agencies through reports, briefings, or 
other means. 
‘‘§ 3594. Government information sharing and inci-
dent response 
‘‘(a) IN GENERAL.— 
‘‘(1) INCIDENT REPORTING.—Subject to limita-
tions in subsection (b), the head of each agency shall 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
provide the information described in paragraph (2) 
relating to an incident affecting the agency, whether 
the information is obtained by the Federal Govern-
ment directly or indirectly, to the Cybersecurity and 
Infrastructure Security Agency, the Office of Man-
agement and Budget, and the Office of the National 
Cyber Director in a manner specified by the Director 
under subsection (b). 
‘‘(2) CONTENTS.—A provision of information 
relating to an incident made by the head of an agen-
cy under paragraph (1) shall— 
‘‘(A) include detailed information about 
the safeguards that were in place when the inci-
dent occurred; 
‘‘(B) whether the agency implemented the 
safeguards described in subparagraph (A) cor-
rectly; 
‘‘(C) in order to protect against a similar 
incident, identify— 
‘‘(i) how the safeguards described in 
subparagraph (A) should be implemented 
differently; and 
‘‘(ii) additional necessary safeguards; 
and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) include information to aid in incident 
response, such as— 
‘‘(i) a description of the affected sys-
tems or networks; 
‘‘(ii) the estimated dates of when the 
incident occurred; and 
‘‘(iii) information that could reason-
ably help identify the party that conducted 
the incident, as appropriate. 
‘‘(3) INFORMATION SHARING.—To the greatest 
extent practicable, the Director of the Cybersecurity 
and Infrastructure Security Agency shall— 
‘‘(A) share information relating to an inci-
dent with any agencies that may be impacted 
by the incident, or are potentially susceptible or 
similarly targeted, as well as with appropriate 
Federal law enforcement agencies to facilitate 
any necessary threat response activities as re-
quested; and 
‘‘(B) coordinate, in consultation with the 
National Cyber Director, any necessary infor-
mation sharing efforts related to a major inci-
dent with the private sector. 
‘‘(4) NATIONAL
SECURITY
SYSTEMS.—Each 
agency operating or exercising control of a national 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
security system shall share information about inci-
dents that occur on national security systems with 
the Director of the Cybersecurity and Infrastructure 
Security Agency to the extent consistent with stand-
ards and guidelines for national security systems 
issued in accordance with law and as directed by the 
President. 
‘‘(b) COMPLIANCE.—The information provided and 
method of reporting under subsection (a) shall take into 
account the level of classification of the information and 
any information sharing limitations and protections, such 
as limitations and protections relating to law enforcement, 
national security, privacy, statistical confidentiality, or 
other factors determined by the Director in order to imple-
ment subsection (a)(1) in a manner that enables auto-
mated and consistent reporting. 
‘‘(c) INCIDENT RESPONSE.—Each agency that has a 
reasonable basis to conclude that a major incident oc-
curred involving Federal information in electronic medium 
or form, as defined by the Director and not involving a 
national security system, regardless of delays from notifi-
cation granted for a major incident, shall coordinate with 
the Cybersecurity and Infrastructure Security Agency to 
facilitate asset response activities and recommendations 
for mitigating future incidents, and with appropriate Fed-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
eral law enforcement agencies to facilitate threat response 
activities, consistent with relevant policies, principles, 
standards, and guidelines on information security. 
‘‘§ 3595. Responsibilities of contractors and awardees 
‘‘(a) REPORTING.— 
‘‘(1) IN GENERAL.—Unless otherwise specified 
in a contract, grant, cooperative agreement, or any 
other transaction agreement, any contractor or 
awardee of an agency shall report to the agency 
within the same amount of time such agency is re-
quired to report an incident to the Cybersecurity 
and Infrastructure Security Agency, if the con-
tractor or awardee has a reasonable basis to suspect 
or conclude that— 
‘‘(A) an incident or breach has occurred 
with respect to Federal information collected, 
used, or maintained by the contractor or award-
ee in connection with the contract, grant, coop-
erative agreement, or other transaction agree-
ment of the contractor or awardee; 
‘‘(B) an incident or breach has occurred 
with respect to a Federal information system 
used or operated by the contractor or awardee 
in connection with the contract, grant, coopera-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
tive agreement, or other transaction agreement 
of the contractor or awardee; 
‘‘(C) a component of any Federal informa-
tion system, or a system able to access, store, 
or process Federal information, contains a secu-
rity vulnerability, including a supply chain com-
promise or an identified software or hardware 
vulnerability; or 
‘‘(D) the contractor or awardee has re-
ceived information from the agency that the 
contractor or awardee is not authorized to re-
ceive in connection with the contract, grant, co-
operative agreement, or other transaction agree-
ment of the contractor or awardee. 
‘‘(2) PROCEDURES.— 
‘‘(A) MAJOR INCIDENT.—Following a re-
port of a breach or major incident by a con-
tractor or awardee under paragraph (1), the 
agency, in consultation with the contractor or 
awardee, shall carry out the requirements under 
sections 3592, 3593, and 3594 with respect to 
the major incident. 
‘‘(B) INCIDENT.—Following a report of an 
incident by a contractor or awardee under para-
graph (1), an agency, in consultation with the 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
contractor or awardee, shall carry out the re-
quirements under section 3594 with respect to 
the incident. 
‘‘(b) EFFECTIVE DATE.—This section shall apply on 
and after the date that is 1 year after the date of the 
enactment of the Federal Information Security Mod-
ernization Act of 2022 and shall apply with respect to any 
contract entered into on or after such effective date. 
‘‘§ 3596. Training 
‘‘(a) COVERED INDIVIDUAL DEFINED.—In this sec-
tion, the term ‘covered individual’ means an individual 
who obtains access to Federal information or Federal in-
formation systems because of the status of the individual 
as an employee, contractor, awardee, volunteer, or intern 
of an agency. 
‘‘(b) REQUIREMENT.—The head of each agency shall 
develop training for covered individuals on how to identify 
and respond to an incident, including— 
‘‘(1) the internal process of the agency for re-
porting an incident; and 
‘‘(2) the obligation of a covered individual to re-
port to the agency a confirmed major incident and 
any suspected incident involving information in any 
medium or form, including paper, oral, and elec-
tronic. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(c) INCLUSION IN ANNUAL TRAINING.—The train-
ing developed under subsection (b) may be included as 
part of an annual privacy or security awareness training 
of an agency. 
‘‘§ 3597. Analysis and report on Federal incidents 
‘‘(a) ANALYSIS OF FEDERAL INCIDENTS.— 
‘‘(1) QUANTITATIVE AND QUALITATIVE ANAL-
YSES.—The Director of the Cybersecurity and Infra-
structure Security Agency shall develop, in consulta-
tion with the Director and the National Cyber Direc-
tor, and perform continuous monitoring and quan-
titative and qualitative analyses of incidents at agen-
cies, including major incidents, including— 
‘‘(A) the causes of incidents, including— 
‘‘(i) attacker tactics, techniques, and 
procedures; and 
‘‘(ii) system vulnerabilities, including 
previously unknown zero day exploitations, 
unpatched systems, and information sys-
tem misconfigurations; 
‘‘(B) the scope and scale of incidents at 
agencies; 
‘‘(C) common root causes of incidents 
across multiple agencies; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(D) agency incident response, recovery, 
and remediation actions and the effectiveness of 
those actions, as applicable; 
‘‘(E) lessons learned and recommendations 
in responding to, recovering from, remediating, 
and mitigating future incidents; and 
‘‘(F) trends across multiple Federal agen-
cies to address intrusion detection and incident 
response capabilities using the metrics estab-
lished under section 224(c) of the Cybersecurity 
Act of 2015 (6 U.S.C. 1522(c)). 
‘‘(2) AUTOMATED ANALYSIS.—The analyses de-
veloped under paragraph (1) shall, to the greatest 
extent practicable, use machine readable data, auto-
mation, and machine learning processes. 
‘‘(3) SHARING OF DATA AND ANALYSIS.— 
‘‘(A) IN
GENERAL.—The Director shall 
share on an ongoing basis the analyses required 
under this subsection with agencies and the Na-
tional Cyber Director to— 
‘‘(i) improve the understanding of cy-
bersecurity risk of agencies; and 
‘‘(ii) support the cybersecurity im-
provement efforts of agencies. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS