HR 3635 RFS
each territory or possession of the United States, 
and each federally recognized Indian tribe. 
SEC. 3. PRIVACY BREACH REQUIREMENTS. 
(a) INFORMATION SECURITY AMENDMENT.—Sub-
chapter III of chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘§ 3550. Privacy breach requirements 
‘‘(a) POLICIES AND PROCEDURES.—The Director of 
the Office of Management and Budget shall establish and 
oversee policies and procedures for agencies to follow in 
the event of a breach of information security involving the 
disclosure of personally identifiable information, including 
requirements for— 
‘‘(1) not later than 72 hours after the agency 
discovers such a breach, or discovers evidence that 
reasonably indicates such a breach has occurred, no-
tice to the individuals whose personally identifiable 
information could be compromised as a result of 
such breach; 
‘‘(2) timely reporting to a Federal cybersecurity 
center, as designated by the Director of the Office 
of Management and Budget; and 
‘‘(3) any additional actions that the Director 
finds necessary and appropriate, including data 
breach analysis, fraud resolution services, identity 
VerDate Mar 15 2010 
02:50 Jul 30, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.RFS
H3635
jbell on DSK4SPTVN1PROD with BILLS
HR 3635 RFS
theft insurance, and credit protection or monitoring 
services. 
‘‘(b) REQUIRED AGENCY ACTION.—The head of each 
agency shall ensure that actions taken in response to a 
breach of information security involving the disclosure of 
personally identifiable information under the authority or 
control of the agency comply with policies and procedures 
established by the Director of the Office of Management 
and Budget under subsection (a). 
‘‘(c) REPORT.—Not later than March 1 of each year, 
the Director of the Office of Management and Budget 
shall report to Congress on agency compliance with the 
policies and procedures established under subsection (a). 
‘‘(d) 
FEDERAL
CYBERSECURITY
CENTER
DE-
FINED.—The term ‘Federal cybersecurity center’ means 
any of the following: 
‘‘(1) The Department of Defense Cyber Crime 
Center. 
‘‘(2) The Intelligence Community Incident Re-
sponse Center. 
‘‘(3) The United States Cyber Command Joint 
Operations Center. 
‘‘(4) The National Cyber Investigative Joint 
Task Force. 
VerDate Mar 15 2010 
02:50 Jul 30, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.RFS
H3635
jbell on DSK4SPTVN1PROD with BILLS
HR 3635 RFS
‘‘(5) Central Security Service Threat Oper-
ations Center of the National Security Agency. 
‘‘(6) The United States Computer Emergency 
Readiness Team. 
‘‘(7) Any successor to a center, team, or task 
force described in paragraphs (1) through (6). 
‘‘(8) Any center that the Director of the Office 
of Management and Budget determines is appro-
priate to carry out the requirements of this sec-
tion.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for subchapter III of chapter 35 of 
title 44, United States Code, is amended by adding at the 
end the following: 
‘‘3550. Privacy breach requirements.’’. 
Passed the House of Representatives July 28, 2014. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Mar 15 2010 
02:50 Jul 30, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3635.RFS
H3635
jbell on DSK4SPTVN1PROD with BILLS