tem shall share information about an incident 
that occurs exclusively on a national security 
system with the Secretary of Defense, the Di-
rector, the National Cyber Director, and the 
Director of the Cybersecurity and Infrastruc-
ture Security Agency to the extent consistent 
with standards and guidelines for national secu-
rity systems issued in accordance with law and 
as directed by the President. 
‘‘(B) 
PROTECTIONS.—Any 
information 
sharing and handling of information under this 
paragraph shall be appropriately protected con-
sistent with procedures authorized for the pro-
tection of sensitive sources and methods or by 
procedures established for information that 
have been specifically authorized under criteria 
established by an Executive order or an Act of 
Congress to be kept classified in the interest of 
national defense or foreign policy. 
‘‘(b) AUTOMATION.—In providing information and 
selecting a method to provide information under sub-
section (a), the head of each agency shall implement sub-
section (a)(1) in a manner that provides such information 
to the Cybersecurity and Infrastructure Security Agency 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
in an automated and machine-readable format, to the 
greatest extent practicable. 
‘‘(c) INCIDENT RESPONSE.—Each agency that has a 
reasonable basis to suspect or conclude that a major inci-
dent occurred involving Federal information in electronic 
medium or form that does not exclusively involve a na-
tional security system shall coordinate with— 
‘‘(1) the Cybersecurity and Infrastructure Secu-
rity Agency to facilitate asset response activities and 
provide recommendations for mitigating future inci-
dents; and 
‘‘(2) consistent with relevant policies, appro-
priate Federal law enforcement agencies to facilitate 
threat response activities. 
‘‘§ 3595. Responsibilities of contractors and awardees 
‘‘(a) REPORTING.— 
‘‘(1) IN GENERAL.—Any contractor or awardee 
of an agency shall report to the agency if the con-
tractor or awardee has a reasonable basis to con-
clude that— 
‘‘(A) an incident or breach has occurred 
with respect to Federal information the con-
tractor or awardee collected, used, or main-
tained on behalf of an agency; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) an incident or breach has occurred 
with respect to a Federal information system 
used, operated, managed, or maintained on be-
half of an agency by the contractor or awardee; 
‘‘(C) a component of any Federal informa-
tion system operated, managed, or maintained 
by a contractor or awardee contains a security 
vulnerability, including a supply chain com-
promise or an identified software or hardware 
vulnerability, for which there is reliable evidence 
of attempted or successful exploitation of the 
vulnerability by an actor without authorization 
of the Federal information system owner; or 
‘‘(D) the contractor or awardee has re-
ceived personally identifiable information, per-
sonal health information, or other clearly sen-
sitive information that is beyond the scope of 
the contract or agreement with the agency from 
the agency that the contractor or awardee is 
not authorized to receive. 
‘‘(2) 
THIRD-PARTY
REPORTS
OF 
VULNERABILITIES.—Subject to the guidance issued 
by the Director pursuant to paragraph (4), any con-
tractor or awardee of an agency shall report to the 
agency and the Cybersecurity and Infrastructure Se-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
curity Agency if the contractor or awardee has a 
reasonable basis to suspect or conclude that a com-
ponent of any Federal information system operated, 
managed, or maintained on behalf of an agency by 
the contractor or awardee on behalf of the agency 
contains a security vulnerability, including a supply 
chain compromise or an identified software or hard-
ware vulnerability, that has been reported to the 
contractor or awardee by a third party, including 
through a vulnerability disclosure program. 
‘‘(3) PROCEDURES.— 
‘‘(A) SHARING
WITH
CISA.—As soon as 
practicable following a report of an incident to 
an agency by a contractor or awardee under 
paragraph (1), the head of the agency shall pro-
vide, pursuant to section 3594, information 
about the incident to the Director of the Cyber-
security and Infrastructure Security Agency. 
‘‘(B) TIME
FOR
REPORTING.—Unless a 
different time for reporting is specified in a 
contract, grant, cooperative agreement, or other 
transaction agreement, a contractor or awardee 
shall— 
‘‘(i) make a report required under 
paragraph (1) not later than 1 day after 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
the date on which the contractor or award-
ee has reasonable basis to suspect or con-
clude that the criteria under paragraph (1) 
have been met; and 
‘‘(ii) make a report required under 
paragraph (2) within a reasonable time, 
but not later than 90 days after the date 
on which the contractor or awardee has 
reasonable basis to suspect or conclude 
that the criteria under paragraph (2) have 
been met. 
‘‘(C) PROCEDURES.—Following a report of 
a breach or incident to an agency by a con-
tractor or awardee under paragraph (1), the 
head of the agency, in consultation with the 
contractor or awardee, shall carry out the appli-
cable requirements under sections 3592, 3593, 
and 3594 with respect to the breach or inci-
dent. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in subparagraph (B) shall be construed to allow 
the negation of the requirements to report 
vulnerabilities under paragraph (1) or (2) 
through a contract, grant, cooperative agree-
ment, or other transaction agreement. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(4) GUIDANCE.—The Director shall issue 
guidance to agencies relating to the scope of 
vulnerabilities to be reported under paragraph (2), 
such as the minimum severity of a vulnerability re-
quired to be reported or whether vulnerabilities that 
are already publicly disclosed must be reported. 
‘‘(b) REGULATIONS; MODIFICATIONS.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Federal Information 
Security Modernization Act of 2023— 
‘‘(A) the Federal Acquisition Regulatory 
Council shall promulgate regulations, as appro-
priate, relating to the responsibilities of con-
tractors and recipients of other transaction 
agreements and cooperative agreements to com-
ply with this section; and 
‘‘(B) the Office of Federal Financial Man-
agement shall promulgate regulations under 
title 2, Code of Federal Regulations, as appro-
priate, relating to the responsibilities of grant-
ees to comply with this section. 
‘‘(2) IMPLEMENTATION.—Not later than 1 year 
after the date on which the Federal Acquisition Reg-
ulatory Council and the Office of Federal Financial 
Management promulgates regulations under para-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
graph (1), the head of each agency shall implement 
policies and procedures, as appropriate, necessary to 
implement those regulations. 
‘‘(3) CONGRESSIONAL NOTIFICATION.— 
‘‘(A) IN
GENERAL.—The head of each 
agency head shall notify the Director upon im-
plementation of policies and procedures nec-
essary to implement the regulations promul-
gated under paragraph (1). 
‘‘(B) OMB NOTIFICATION.— Not later 
than 30 days after the date described in para-
graph (2), the Director shall notify the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate and the Commit-
tees on Oversight and Accountability and 
Homeland Security of the House of Representa-
tives on the status of the implementation by 
each agency of the regulations promulgated 
under paragraph (1). 
‘‘(c) NATIONAL SECURITY SYSTEMS EXEMPTION.— 
Notwithstanding any other provision of this section, a con-
tractor or awardee of an agency that would be required 
to report an incident or vulnerability pursuant to this sec-
tion that occurs exclusively on a national security system 
shall— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(1) report the incident or vulnerability to the 
head of the agency and the Secretary of Defense; 
and 
‘‘(2) comply with applicable laws and policies 
relating to national security systems. 
‘‘§ 3596. Training 
‘‘(a) COVERED INDIVIDUAL DEFINED.—In this sec-
tion, the term ‘covered individual’ means an individual 
who obtains access to a Federal information system be-
cause of the status of the individual as— 
‘‘(1) an employee, contractor, awardee, volun-
teer, or intern of an agency; or 
‘‘(2) an employee of a contractor or awardee of 
an agency. 
‘‘(b) BEST PRACTICES AND CONSISTENCY.—The Di-
rector of the Cybersecurity and Infrastructure Security 
Agency, in consultation with the Director, the National 
Cyber Director, and the Director of the National Institute 
of Standards and Technology, shall develop best practices 
to support consistency across agencies in cybersecurity in-
cident response training, including— 
‘‘(1) information to be collected and shared 
with the Cybersecurity and Infrastructure Security 
Agency pursuant to section 3594(a) and processes 
for sharing such information; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(2) appropriate training and qualifications for 
cyber incident responders. 
‘‘(c) AGENCY TRAINING.—The head of each agency 
shall develop training for covered individuals on how to 
identify and respond to an incident, including— 
‘‘(1) the internal process of the agency for re-
porting an incident; and 
‘‘(2) the obligation of a covered individual to re-
port to the agency any suspected or confirmed inci-
dent involving Federal information in any medium 
or form, including paper, oral, and electronic. 
‘‘(d) INCLUSION IN ANNUAL TRAINING.—The train-
ing developed under subsection (c) may be included as 
part of an annual privacy, security awareness, or other 
appropriate training of an agency. 
‘‘§ 3597. Analysis and report on Federal incidents 
‘‘(a) ANALYSIS OF FEDERAL INCIDENTS.— 
‘‘(1) QUANTITATIVE AND QUALITATIVE ANAL-
YSES.—The Director of the Cybersecurity and Infra-
structure Security Agency shall perform and, in co-
ordination with the Director and the National Cyber 
Director, develop, continuous monitoring and quan-
titative and qualitative analyses of incidents at agen-
cies, including major incidents, including— 
‘‘(A) the causes of incidents, including— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) attacker tactics, techniques, and 
procedures; and 
‘‘(ii) system vulnerabilities, including 
zero days, unpatched systems, and infor-
mation system misconfigurations; 
‘‘(B) the scope and scale of incidents at 
agencies; 
‘‘(C) common root causes of incidents 
across multiple agencies; 
‘‘(D) agency incident response, recovery, 
and remediation actions and the effectiveness of 
those actions, as applicable; 
‘‘(E) lessons learned and recommendations 
in responding to, recovering from, remediating, 
and mitigating future incidents; and 
‘‘(F) trends across multiple agencies to ad-
dress intrusion detection and incident response 
capabilities using the metrics established under 
section 224(c) of the Cybersecurity Act of 2015 
(6 U.S.C. 1522(c)). 
‘‘(2) AUTOMATED ANALYSIS.—The analyses de-
veloped under paragraph (1) shall, to the greatest 
extent practicable, use machine-readable data, auto-
mation, and machine learning processes. 
‘‘(3) SHARING OF DATA AND ANALYSIS.— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) IN GENERAL.—The Director of the 
Cybersecurity 
and 
Infrastructure 
Security 
Agency shall share on an ongoing basis the 
analyses and underlying data required under 
this subsection with agencies, the Director, and 
the National Cyber Director to— 
‘‘(i) improve the understanding of cy-
bersecurity risk of agencies; and 
‘‘(ii) support the cybersecurity im-
provement efforts of agencies. 
‘‘(B) FORMAT.—In carrying out subpara-
graph (A), the Director of the Cybersecurity 
and Infrastructure Security Agency shall share 
the analyses— 
‘‘(i) in human-readable written prod-
ucts; and 
‘‘(ii) to the greatest extent practicable, 
in machine-readable formats in order to 
enable automated intake and use by agen-
cies. 
‘‘(C) EXEMPTION.—This subsection shall 
not apply to incidents that occur exclusively on 
national security systems. 
‘‘(b) ANNUAL REPORT ON FEDERAL INCIDENTS.— 
Not later than 2 years after the date of enactment of this 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
section, and not less frequently than annually thereafter, 
the Director of the Cybersecurity and Infrastructure Secu-
rity Agency, in consultation with the Director, the Na-
tional Cyber Director and the heads of other agencies, as 
appropriate, shall submit to the appropriate reporting en-
tities a report that includes— 
‘‘(1) a summary of causes of incidents from 
across the Federal Government that categorizes 
those incidents as incidents or major incidents; 
‘‘(2) the quantitative and qualitative analyses of 
incidents developed under subsection (a)(1) on an 
agency-by-agency basis and comprehensively across 
the Federal Government, including— 
‘‘(A) a specific analysis of breaches; and 
‘‘(B) an analysis of the Federal Govern-
ment’s performance against the metrics estab-
lished under section 224(c) of the Cybersecurity 
Act of 2015 (6 U.S.C. 1522(c)); and 
‘‘(3) an annex for each agency that includes— 
‘‘(A) a description of each major incident; 
‘‘(B) the total number of incidents of the 
agency; and 
‘‘(C) an analysis of the agency’s perform-
ance against the metrics established under sec-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
Federal Information Security Modernization Act of 2023, 
the Director shall develop, in coordination with the Na-
tional Cyber Director, and promulgate guidance on the 
definition of the term ‘major incident’ for the purposes 
of subchapter II and this subchapter. 
‘‘(b) REQUIREMENTS.—With respect to the guidance 
issued under subsection (a), the definition of the term 
‘major incident’ shall— 
‘‘(1) include, with respect to any information 
collected or maintained by or on behalf of an agency 
or a Federal information system— 
‘‘(A) any incident the head of the agency 
determines is likely to result in demonstrable 
harm to— 
‘‘(i) the national security interests, 
foreign relations, homeland security, or 
economic security of the United States; or 
‘‘(ii) the civil liberties, public con-
fidence, privacy, or public health and safe-
ty of the people of the United States; 
‘‘(B) any incident the head of the agency 
determines likely to result in an inability or 
substantial disruption for the agency, a compo-
nent of the agency, or the Federal Government, 
to provide 1 or more critical services; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(C) any incident the head of the agency 
determines substantially disrupts or substan-
tially degrades the operations of a high value 
asset owned or operated by the agency; 
‘‘(D) any incident involving the exposure to 
a foreign entity of sensitive agency information, 
such as the communications of the head of the 
agency, the head of a component of the agency, 
or the direct reports of the head of the agency 
or the head of a component of the agency; and 
‘‘(E) any other type of incident determined 
appropriate by the Director; 
‘‘(2) stipulate that the National Cyber Director, 
in consultation with the Director and the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy, may declare a major incident at any agency, and 
such a declaration shall be considered if it is deter-
mined that an incident— 
‘‘(A) occurs at not less than 2 agencies; 
and 
‘‘(B) is enabled by— 
‘‘(i) a common technical root cause, 
such as a supply chain compromise, or a 
common software or hardware vulner-
ability; or 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(ii) the related activities of a com-
mon threat actor; 
‘‘(3) stipulate that, in determining whether an 
incident constitutes a major incident under the 
standards described in paragraph (1), the head of 
the agency shall consult with the National Cyber Di-
rector; and 
‘‘(4) stipulate that the mere report of a vulner-
ability discovered or disclosed without a loss of con-
fidentiality, integrity, or availability shall not on its 
own constitute a major incident. 
‘‘(c) EVALUATION AND UPDATES.—Not later than 60 
days after the date on which the Director first promul-
gates the guidance required under subsection (a), and not 
less frequently than once during the first 90 days of each 
evenly numbered Congress thereafter, the Director shall 
provide to the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate and the Committees on 
Oversight and Accountability and Homeland Security of 
the House of Representatives a briefing that includes— 
‘‘(1) an evaluation of any necessary updates to 
the guidance; 
‘‘(2) an evaluation of any necessary updates to 
the definition of the term ‘major incident’ included 
in the guidance; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(3) an explanation of, and the analysis that 
led to, the definition described in paragraph (2).’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions for chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT RESPONSE 
‘‘3591. Definitions. 
‘‘3592. Notification of breach. 
‘‘3593. Congressional and executive branch reports on major incidents. 
‘‘3594. Government information sharing and incident response. 
‘‘3595. Responsibilities of contractors and awardees. 
‘‘3596. Training. 
‘‘3597. Analysis and report on Federal incidents. 
‘‘3598. Major incident definition.’’. 
SEC. 4. AMENDMENTS TO SUBTITLE III OF TITLE 40. 
(a) MODERNIZING GOVERNMENT TECHNOLOGY.— 
Subtitle G of title X of division A of the National Defense 
Authorization Act for Fiscal Year 2018 (40 U.S.C. 11301 
note) is amended in section 1078— 
(1) by striking subsection (a) and inserting the 
following: 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) AGENCY.—The term ‘agency’ has the 
meaning given the term in section 551 of title 5, 
United States Code. 
‘‘(2) HIGH
VALUE
ASSET.—The term ‘high 
value asset’ has the meaning given the term in sec-
tion 3552 of title 44, United States Code.’’; 
(2) in subsection (b), by adding at the end the 
following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(8) PROPOSAL
EVALUATION.—The Director 
shall— 
‘‘(A) give consideration for the use of 
amounts in the Fund to improve the security of 
high value assets; and 
‘‘(B) require that any proposal for the use 
of amounts in the Fund includes, as appro-
priate— 
‘‘(i) a cybersecurity risk management 
plan; and 
‘‘(ii) a supply chain risk assessment in 
accordance with section 1326 of title 41.’’; 
and 
(3) in subsection (c)— 
(A) in paragraph (2)(A)(i), by inserting ‘‘, 
including a consideration of the impact on high 
value assets’’ after ‘‘operational risks’’; 
(B) in paragraph (5)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(C) a senior official from the Cybersecu-
rity and Infrastructure Security Agency of the 
Department of Homeland Security, appointed 
by the Director.’’; and 
(C) in paragraph (6)(A), by striking ‘‘shall 
be—’’ and all that follows through ‘‘4 employ-
ees’’ and inserting ‘‘shall be 4 employees’’. 
(b) SUBCHAPTER I.—Subchapter I of chapter 113 of 
subtitle III of title 40, United States Code, is amended— 
(1) in section 11302— 
(A) in subsection (b), by striking ‘‘use, se-
curity, and disposal of’’ and inserting ‘‘use, and 
disposal of, and, in consultation with the Direc-
tor of the Cybersecurity and Infrastructure Se-
curity Agency and the National Cyber Director, 
promote and improve the security of,’’; and 
(B) in subsection (h), by inserting ‘‘, in-
cluding cybersecurity performances,’’ after ‘‘the 
performances’’; and 
(2) in section 11303(b)(2)(B)— 
(A) in clause (i), by striking ‘‘or’’ at the 
end; 
(B) in clause (ii), by adding ‘‘or’’ at the 
end; and 
(C) by adding at the end the following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(iii) whether the function should be 
performed by a shared service offered by 
another executive agency;’’. 
(c) SUBCHAPTER II.—Subchapter II of chapter 113 
of subtitle III of title 40, United States Code, is amend-
ed— 
(1) in section 11312(a), by inserting ‘‘, includ-
ing security risks’’ after ‘‘managing the risks’’; 
(2) in section 11313(1), by striking ‘‘efficiency 
and effectiveness’’ and inserting ‘‘efficiency, security, 
and effectiveness’’; 
(3) in section 11317, by inserting ‘‘security,’’ 
before ‘‘or schedule’’; and 
(4) in section 11319(b)(1), in the paragraph 
heading, by striking ‘‘CIOS’’ and inserting ‘‘CHIEF 
INFORMATION OFFICERS’’. 
SEC. 5. ACTIONS TO ENHANCE FEDERAL INCIDENT TRANS-
PARENCY. 
(a) RESPONSIBILITIES OF THE CYBERSECURITY AND 
INFRASTRUCTURE SECURITY AGENCY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security 
Agency shall— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(A) develop a plan for the development of 
the analysis required under section 3597(a) of 
title 44, United States Code, as added by this 
Act, and the report required under subsection 
(b) of that section that includes— 
(i) a description of any challenges the 
Director of the Cybersecurity and Infra-
structure Security Agency anticipates en-
countering; and 
(ii) the use of automation and ma-
chine-readable formats for collecting, com-
piling, monitoring, and analyzing data; and 
(B) provide to the appropriate congres-
sional committees a briefing on the plan devel-
oped under subparagraph (A). 
(2) BRIEFING.—Not later than 1 year after the 
date of enactment of this Act, the Director of the 
Cybersecurity and Infrastructure Security Agency 
shall provide to the appropriate congressional com-
mittees a briefing on— 
(A) the execution of the plan required 
under paragraph (1)(A); and 
(B) the development of the report required 
under section 3597(b) of title 44, United States 
Code, as added by this Act. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
OFFICE OF MANAGEMENT AND BUDGET.— 
(1) UPDATING FISMA 2014.—Section 2 of the 
Federal Information Security Modernization Act of 
2014 (Public Law 113–283; 128 Stat. 3073) is 
amended— 
(A) by striking subsections (b) and (d); 
and 
(B) by redesignating subsections (c), (e), 
and (f) as subsections (b), (c), and (d), respec-
tively. 
(2) INCIDENT DATA SHARING.— 
(A) IN GENERAL.—The Director, in coordi-
nation with the Director of the Cybersecurity 
and Infrastructure Security Agency, shall de-
velop, and as appropriate update, guidance, on 
the content, timeliness, and format of the infor-
mation provided by agencies under section 
3594(a) of title 44, United States Code, as 
added by this Act. 
(B) REQUIREMENTS.—The guidance devel-
oped under subparagraph (A) shall— 
(i) enable the efficient development 
of— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(I) lessons learned and rec-
ommendations in responding to, recov-
ering from, remediating, and miti-
gating future incidents; and 
(II) the report on Federal inci-
dents required under section 3597(b) 
of title 44, United States Code, as 
added by this Act; and 
(ii) include requirements for the time-
liness of data production. 
(C) AUTOMATION.—The Director, in co-
ordination with the Director of the Cybersecu-
rity and Infrastructure Security Agency, shall 
promote, as feasible, the use of automation and 
machine-readable data for data sharing under 
section 3594(a) of title 44, United States Code, 
as added by this Act. 
(3) CONTRACTOR AND AWARDEE GUIDANCE.— 
(A) IN GENERAL.—Not later than 1 year 
after the date of enactment of this Act, the Di-
rector shall issue guidance to agencies on how 
to deconflict, to the greatest extent practicable, 
existing regulations, policies, and procedures re-
lating to the responsibilities of contractors and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
awardees established under section 3595 of title 
44, United States Code, as added by this Act. 
(B) EXISTING PROCESSES.—To the great-
est extent practicable, the guidance issued 
under subparagraph (A) shall allow contractors 
and awardees to use existing processes for noti-
fying agencies of incidents involving information 
of the Federal Government. 
(c) UPDATE TO THE PRIVACY ACT OF 1974.—Sec-
tion 552a(b) of title 5, United States Code (commonly 
known as the ‘‘Privacy Act of 1974’’) is amended— 
(1) in paragraph (11), by striking ‘‘or’’ at the 
end; 
(2) in paragraph (12), by striking the period at 
the end and inserting ‘‘; or’’; and 
(3) by adding at the end the following: 
‘‘(13) to another agency, to the extent nec-
essary, to assist the recipient agency in responding 
to an incident (as defined in section 3552 of title 
44) or breach (as defined in section 3591 of title 44) 
or to fulfill the information sharing requirements 
under section 3594 of title 44.’’. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 6. ADDITIONAL GUIDANCE TO AGENCIES ON FISMA 
UPDATES. 
(a) IN GENERAL.—Not later than 1 year after the 
date of enactment of this Act, the Director shall issue 
guidance for agencies on— 
(1) performing the ongoing and continuous 
agency system risk assessment required under sec-
tion 3554(a)(1)(A) of title 44, United States Code, 
as amended by this Act; and 
(2) establishing a process for securely providing 
the status of each remedial action for high value as-
sets under section 3554(b)(7) of title 44, United 
States Code, as amended by this Act, to the Director 
and the Director of the Cybersecurity and Infra-
structure Security Agency using automation and ma-
chine-readable data, as practicable, which shall in-
clude— 
(A) specific guidance for the use of auto-
mation and machine-readable data; and 
(B) templates for providing the status of 
the remedial action. 
(b) COORDINATION.—The head of each agency shall 
coordinate with the inspector general of the agency, as ap-
plicable, to ensure consistent understanding of agency 
policies for the purpose of evaluations conducted by the 
inspector general. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 7. AGENCY REQUIREMENTS TO NOTIFY PRIVATE SEC-
TOR ENTITIES IMPACTED BY INCIDENTS. 
(a) DEFINITIONS.—In this section: 
(1) REPORTING ENTITY.—The term ‘‘reporting 
entity’’ means private organization or governmental 
unit that is required by statute or regulation to sub-
mit sensitive information to an agency. 
(2) SENSITIVE INFORMATION.—The term ‘‘sen-
sitive information’’ has the meaning given the term 
by the Director in guidance issued under subsection 
(b). 
(b) GUIDANCE ON NOTIFICATION OF REPORTING EN-
TITIES.—Not later than 1 year after the date of enact-
ment of this Act, the Director shall develop, in consulta-
tion with the National Cyber Director, and issue guidance 
requiring the head of each agency to notify a reporting 
entity, and take into consideration the need to coordinate 
with Sector Risk Management Agencies (as defined in sec-
tion 2200 of the Homeland Security Act of 2002 (6 U.S.C. 
650)), as appropriate, of an incident at the agency that 
is likely to substantially affect— 
(1) the confidentiality or integrity of sensitive 
information submitted by the reporting entity to the 
agency pursuant to a statutory or regulatory re-
quirement; or 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) any information system (as defined in sec-
tion 3502 of title 44, United States Code) used in 
the transmission or storage of the sensitive informa-
tion described in paragraph (1). 
SEC. 8. MOBILE SECURITY BRIEFINGS. 
(a) IN GENERAL.—Not later than 180 days after the 
date of enactment of this Act, the Director shall provide 
to the appropriate congressional committees— 
(1) a briefing on the compliance of agencies 
with the No TikTok on Government Devices Act (44 
U.S.C. 3553 note; Public Law 117–328); and 
(2) as a component of the briefing required 
under paragraph (1), a list of each exception of an 
agency from the No TikTok on Government Devices 
Act (44 U.S.C. 3553 note; Public Law 117–328), 
which may include a classified annex. 
(b) ADDITIONAL BRIEFING.—Not later than 1 year 
after the date of the briefing required under subsection 
(a)(1), the Director shall provide to the appropriate con-
gressional committees— 
(1) a briefing on the compliance of any agency 
that was not compliant with the No TikTok on Gov-
ernment Devices Act (44 U.S.C. 3553 note; Public 
Law 117–328) at the time of the briefing required 
under subsection (a)(1); and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) as a component of the briefing required 
under paragraph (1), an update to the list required 
under subsection (a)(2). 
SEC. 9. DATA AND LOGGING RETENTION FOR INCIDENT RE-
SPONSE. 
(a) GUIDANCE.—Not later than 2 years after the date 
of enactment of this Act the Director, in consultation with 
the National Cyber Director and the Director of the Cy-
bersecurity and Infrastructure Security Agency, shall up-
date guidance to agencies regarding requirements for log-
ging, log retention, log management, sharing of log data 
with other appropriate agencies, or any other logging ac-
tivity determined to be appropriate by the Director. 
(b) NATIONAL SECURITY SYSTEMS.—The Secretary 
of Defense shall issue guidance that meets or exceeds the 
standards required in guidance issued under subsection 
(a) for National Security Systems. 
SEC. 10. CISA AGENCY LIAISONS. 
(a) IN GENERAL.—Not later than 120 days after the 
date of enactment of this Act, the Director of the Cyberse-
curity and Infrastructure Security Agency shall assign not 
less than 1 cybersecurity professional employed by the Cy-
bersecurity and Infrastructure Security Agency to be the 
Cybersecurity and Infrastructure Security Agency liaison 
to the Chief Information Security Officer of each agency. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(b) QUALIFICATIONS.—Each liaison assigned under 
subsection (a) shall have knowledge of— 
(1) cybersecurity threats facing agencies, in-
cluding any specific threats to the assigned agency; 
(2) risk assessments of agency systems; and 
(3) other Federal cybersecurity initiatives. 
(c) DUTIES.—The duties of each liaison assigned 
under subsection (a) shall include— 
(1) providing, as requested, assistance and ad-
vice to the agency Chief Information Security Offi-
cer; 
(2) supporting, as requested, incident response 
coordination between the assigned agency and the 
Cybersecurity and Infrastructure Security Agency; 
(3) becoming familiar with assigned agency sys-
tems, processes, and procedures to better facilitate 
support to the agency; and 
(4) other liaison duties to the assigned agency 
solely in furtherance of Federal cybersecurity or sup-
port to the assigned agency as a Sector Risk Man-
agement Agency, as assigned by the Director of the 
Cybersecurity and Infrastructure Security Agency in 
consultation with the head of the assigned agency. 
(d) LIMITATION.—A liaison assigned under sub-
section (a) shall not be a contractor. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(e) MULTIPLE ASSIGNMENTS.—One individual liai-
son may be assigned to multiple agency Chief Information 
Security Officers under subsection (a). 
(f) COORDINATION OF ACTIVITIES.—The Director of 
the Cybersecurity and Infrastructure Security Agency 
shall consult with the Director on the execution of the du-
ties of the Cybersecurity and Infrastructure Security 
Agency liaisons to ensure that there is no inappropriate 
duplication of activities among— 
(1) Federal cybersecurity support to agencies of 
the Office of Management and Budget; and 
(2) the Cybersecurity and Infrastructure Secu-
rity Agency liaison. 
(g) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to impact the ability of the Director 
to support agency implementation of Federal cybersecurity 
requirements pursuant to subchapter II of chapter 35 of 
title 44, United States Code, as amended by this Act. 
SEC. 11. FEDERAL PENETRATION TESTING POLICY. 
(a) IN GENERAL.—Subchapter II of chapter 35 of 
title 44, United States Code, is amended by adding at the 
end the following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘§ 3559A. Federal penetration testing 
‘‘(a) GUIDANCE.—The Director, in consultation with 
the Director of the Cybersecurity and Infrastructure Secu-
rity Agency, shall issue guidance to agencies that— 
‘‘(1) requires agencies to perform penetration 
testing on information systems, as appropriate, in-
cluding on high value assets; 
‘‘(2) provides policies governing the develop-
ment of— 
‘‘(A) rules of engagement for using pene-
tration testing; and 
‘‘(B) procedures to use the results of pene-
tration testing to improve the cybersecurity and 
risk management of the agency; 
‘‘(3) ensures that operational support or a 
shared service is available; and 
‘‘(4) in no manner restricts the authority of the 
Secretary of Homeland Security or the Director of 
the Cybersecurity and Infrastructure Agency to con-
duct threat hunting pursuant to section 3553 of title 
44, United States Code, or penetration testing under 
this chapter. 
‘‘(b) EXCEPTION
FOR NATIONAL SECURITY SYS-
TEMS.—The guidance issued under subsection (a) shall 
not apply to national security systems. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(c) CLERICAL AMENDMENT.—The table of sections 
for chapter 35 of title 44, United States Code, is amended 
by adding after the item relating to section 3559 the fol-
lowing: 
‘‘3559A. Federal penetration testing.’’. 
(d) PENETRATION TESTING BY THE SECRETARY OF 
HOMELAND SECURITY.—Section 3553(b) of title 44, 
United States Code, as amended by this Act, is further 
amended by inserting after paragraph (8) the following: 
‘‘(9) performing penetration testing that may 
leverage manual expert analysis to identify threats 
and vulnerabilities within information systems— 
‘‘(A) without consent or authorization from 
agencies; and 
‘‘(B) with prior notification to the head of 
the agency;’’. 
SEC. 12. VULNERABILITY DISCLOSURE POLICIES. 
(a) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by inserting after section 3559A, 
as added by this Act, the following: 
‘‘§ 3559B. Federal vulnerability disclosure policies 
‘‘(a) PURPOSE; SENSE OF CONGRESS.— 
‘‘(1) PURPOSE.—The purpose of Federal vul-
nerability disclosure policies is to create a mecha-
nism to enable the public to inform agencies of 
vulnerabilities in Federal information systems. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(2) SENSE OF CONGRESS.—It is the sense of 
Congress that, in implementing the requirements of 
this section, the Federal Government should take 
appropriate steps to reduce real and perceived bur-
dens in communications between agencies and secu-
rity researchers. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) CONTRACTOR.—The term ‘contractor’ has 
the meaning given the term in section 3591. 
‘‘(2) INTERNET OF THINGS.—The term ‘inter-
net of things’ has the meaning given the term in 
Special Publication 800–213 of the National Insti-
tute of Standards and Technology, entitled ‘IoT De-
vice Cybersecurity Guidance for the Federal Govern-
ment: Establishing IoT Device Cybersecurity Re-
quirements’, or any successor document. 
‘‘(3) SECURITY
VULNERABILITY.—The term 
‘security vulnerability’ has the meaning given the 
term in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501). 
‘‘(4) SUBMITTER.—The term ‘submitter’ means 
an individual that submits a vulnerability disclosure 
report pursuant to the vulnerability disclosure proc-
ess of an agency. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(5) VULNERABILITY DISCLOSURE REPORT.— 
The term ‘vulnerability disclosure report’ means a 
disclosure of a security vulnerability made to an 
agency by a submitter. 
‘‘(c) GUIDANCE.—The Director shall issue guidance 
to agencies that includes— 
‘‘(1) use of the information system security 
vulnerabilities disclosure process guidelines estab-
lished under section 4(a)(1) of the IoT Cybersecurity 
Improvement Act of 2020 (15 U.S.C. 278g– 
3b(a)(1)); 
‘‘(2) direction to not recommend or pursue legal 
action against a submitter or an individual that con-
ducts a security research activity that— 
‘‘(A) represents a good faith effort to iden-
tify and report security vulnerabilities in infor-
mation systems; or 
‘‘(B) otherwise represents a good faith ef-
fort to follow the vulnerability disclosure policy 
of the agency developed under subsection (f)(2); 
‘‘(3) direction on sharing relevant information 
in a consistent, automated, and machine-readable 
manner with the Director of the Cybersecurity and 
Infrastructure Security Agency; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
100 
‘‘(4) the minimum scope of agency systems re-
quired to be covered by the vulnerability disclosure 
policy of an agency required under subsection (f)(2), 
including exemptions under subsection (g); 
‘‘(5) requirements for providing information to 
the submitter of a vulnerability disclosure report on 
the resolution of the vulnerability disclosure report; 
‘‘(6) a stipulation that the mere identification 
by a submitter of a security vulnerability, without a 
significant compromise of confidentiality, integrity, 
or availability, does not constitute a major incident; 
and 
‘‘(7) the applicability of the guidance to inter-
net of things devices owned or controlled by an 
agency. 
‘‘(d) CONSULTATION.—In developing the guidance re-
quired under subsection (c)(3), the Director shall consult 
with the Director of the Cybersecurity and Infrastructure 
Security Agency. 
‘‘(e) RESPONSIBILITIES OF CISA.—The Director of 
the Cybersecurity and Infrastructure Security Agency 
shall— 
‘‘(1) provide support to agencies with respect to 
the implementation of the requirements of this sec-
tion; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
101 
‘‘(2) develop tools, processes, and other mecha-
nisms determined appropriate to offer agencies capa-
bilities to implement the requirements of this sec-
tion; 
‘‘(3) upon a request by an agency, assist the 
agency in the disclosure to vendors of newly identi-
fied security vulnerabilities in vendor products and 
services; and 
‘‘(4) as appropriate, implement the require-
ments of this section, in accordance with the author-
ity under section 3553(b)(8), as a shared service 
available to agencies. 
‘‘(f) RESPONSIBILITIES OF AGENCIES.— 
‘‘(1) PUBLIC INFORMATION.—The head of each 
agency shall make publicly available, with respect to 
each internet domain under the control of the agen-
cy that is not a national security system and to the 
extent consistent with the security of information 
systems but with the presumption of disclosure— 
‘‘(A) an appropriate security contact; and 
‘‘(B) the component of the agency that is 
responsible for the internet accessible services 
offered at the domain. 
‘‘(2) VULNERABILITY
DISCLOSURE
POLICY.— 
The head of each agency shall develop and make 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
102 
publicly available a vulnerability disclosure policy for 
the agency, which shall— 
‘‘(A) describe— 
‘‘(i) the scope of the systems of the 
agency included in the vulnerability disclo-
sure policy, including for internet of things 
devices owned or controlled by the agency; 
‘‘(ii) the type of information system 
testing that is authorized by the agency; 
‘‘(iii) the type of information system 
testing that is not authorized by the agen-
cy; 
‘‘(iv) the disclosure policy for a con-
tractor; and 
‘‘(v) the disclosure policy of the agen-
cy for sensitive information; 
‘‘(B) with respect to a vulnerability disclo-
sure report to an agency, describe— 
‘‘(i) how the submitter should submit 
the vulnerability disclosure report; and 
‘‘(ii) if the report is not anonymous, 
when the reporter should anticipate an ac-
knowledgment of receipt of the report by 
the agency; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
103 
‘‘(C) include any other relevant informa-
tion; and 
‘‘(D) be mature in scope and cover every 
internet accessible information system used or 
operated by that agency or on behalf of that 
agency. 
‘‘(3) 
IDENTIFIED
SECURITY 
VULNERABILITIES.—The 
head 
of 
each 
agency 
shall— 
‘‘(A) consider security vulnerabilities re-
ported in accordance with paragraph (2); 
‘‘(B) commensurate with the risk posed by 
the security vulnerability, address such security 
vulnerability using the security vulnerability 
management process of the agency; and 
‘‘(C) in accordance with subsection (c)(5), 
provide information to the submitter of a vul-
nerability disclosure report. 
‘‘(g) EXEMPTIONS.— 
‘‘(1) IN GENERAL.—The Director and the head 
of each agency shall carry out this section in a man-
ner consistent with the protection of national secu-
rity information. 
‘‘(2) LIMITATION.—The Director and the head 
of each agency may not publish under subsection 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
104 
(f)(1) or include in a vulnerability disclosure policy 
under subsection (f)(2) host names, services, infor-
mation systems, or other information that the Direc-
tor or the head of an agency, in coordination with 
the Director and other appropriate heads of agen-
cies, determines would— 
‘‘(A) disrupt a law enforcement investiga-
tion; 
‘‘(B) endanger national security or intel-
ligence activities; or 
‘‘(C) impede national defense activities or 
military operations. 
‘‘(3) NATIONAL SECURITY SYSTEMS.—This sec-
tion shall not apply to national security systems. 
‘‘(h) DELEGATION
OF AUTHORITY
FOR CERTAIN 
SYSTEMS.—The authorities of the Director and the Direc-
tor of the Cybersecurity and Infrastructure Security Agen-
cy described in this section shall be delegated— 
‘‘(1) to the Secretary of Defense in the case of 
systems described in section 3553(e)(2); and 
‘‘(2) to the Director of National Intelligence in 
the case of systems described in section 3553(e)(3). 
‘‘(i) REVISION OF FEDERAL ACQUISITION REGULA-
TION.—The Federal Acquisition Regulation shall be re-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
105 
vised as necessary to implement the provisions under this 
section.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
for chapter 35 of title 44, United States Code, is amended 
by adding after the item relating to section 3559A, as 
added by this Act, the following: 
‘‘3559B. Federal vulnerability disclosure policies.’’. 
(c) CONFORMING UPDATE AND REPEAL.— 
(1) GUIDELINES ON THE DISCLOSURE PROCESS 
FOR SECURITY VULNERABILITIES RELATING TO IN-
FORMATION
SYSTEMS, INCLUDING
INTERNET
OF 
THINGS DEVICES.—Section 5 of the IoT Cybersecu-
rity Improvement Act of 2020 (15 U.S.C. 278g–3c) 
is amended by striking subsections (d) and (e). 
(2) IMPLEMENTATION AND CONTRACTOR COM-
PLIANCE.—The IoT Cybersecurity Improvement Act 
of 2020 (15 U.S.C. 278g–3a et seq.) is amended— 
(A) by striking section 6 (15 U.S.C. 278g– 
3d); and 
(B) by striking section 7 (15 U.S.C. 278g– 
3e). 
SEC. 13. IMPLEMENTING ZERO TRUST ARCHITECTURE. 
(a) BRIEFINGS.—Not later than 1 year after the date 
of enactment of this Act, the Director shall provide to the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate and the Committees on Oversight and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
106 
Accountability and Homeland Security of the House of 
Representatives a briefing on progress in increasing the 
internal defenses of agency systems, including— 
(1) shifting away from trusted networks to im-
plement security controls based on a presumption of 
compromise, including through the transition to zero 
trust architecture; 
(2) implementing principles of least privilege in 
administering information security programs; 
(3) limiting the ability of entities that cause in-
cidents to move laterally through or between agency 
systems; 
(4) identifying incidents quickly; 
(5) isolating and removing unauthorized entities 
from agency systems as quickly as practicable, ac-
counting for intelligence or law enforcement pur-
poses; and 
(6) otherwise increasing the resource costs for 
entities that cause incidents to be successful. 
(b) PROGRESS REPORT.—As a part of each report 
required to be submitted under section 3553(c) of title 44, 
United States Code, during the period beginning on the 
date that is 4 years after the date of enactment of this 
Act and ending on the date that is 10 years after the date 
of enactment of this Act, the Director shall include an up-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
107 
date on agency implementation of zero trust architecture, 
which shall include— 
(1) a description of steps agencies have com-
pleted, including progress toward achieving any re-
quirements issued by the Director, including the 
adoption of any models or reference architecture; 
(2) an identification of activities that have not 
yet been completed and that would have the most 
immediate security impact; and 
(3) a schedule to implement any planned activi-
ties. 
(c) CLASSIFIED
ANNEX.—Each update required 
under subsection (b) may include 1 or more annexes that 
contain classified or other sensitive information, as appro-
priate. 
(d) NATIONAL SECURITY SYSTEMS.— 
(1) BRIEFING.—Not later than 1 year after the 
date of enactment of this Act, the Secretary of De-
fense shall provide to the Committee on Homeland 
Security and Governmental Affairs of the Senate, 
the Committee on Oversight and Accountability of 
the House of Representatives, the Committee on 
Armed Services of the Senate, the Committee on 
Armed Services of the House of Representatives, the 
Select Committee on Intelligence of the Senate, and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB