IB 
Union Calendar No. 293 
114TH CONGRESS 
2D SESSION 
H. R. 451 
[Report No. 114–390] 
To ensure the functionality and security of new Federal websites that collect 
personally identifiable information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 21, 2015 
Mr. FLEISCHMANN introduced the following bill; which was referred to the 
Committee on Oversight and Government Reform 
JANUARY 6, 2016 
Additional sponsors: Mr. DESJARLAIS, Mr. ROHRABACHER, Mr. WESTMORE-
LAND, Mr. KELLY of Pennsylvania, Mrs. LUMMIS, Mr. SENSENBRENNER, 
Mrs. BLACKBURN, Mr. GUTHRIE, Mr. HURT of Virginia, Mr. BENISHEK, 
Mr. POSEY, Mr. KLINE, Mr. WILSON of South Carolina, Mr. LATTA, Mr. 
FARENTHOLD, Mr. COLE, Mr. ROKITA, Mr. CALVERT, Mr. ROSKAM, Mr. 
GRIFFITH, Mr. KING of Iowa, Mr. THOMPSON of Pennsylvania, Ms. JEN-
KINS of Kansas, Mr. ROSS, Mr. SCHOCK, Mr. COFFMAN, Mr. FRELING-
HUYSEN, Mr. LUCAS, Mr. JOHNSON of Ohio, Mr. AMODEI, Mr. CRAMER, 
Mr. ROE of Tennessee, Mr. CARTER of Texas, Mr. SANFORD, Mr. COL-
LINS of New York, Mr. PITTENGER, Mr. SCHWEIKERT, and Mr. 
BARLETTA 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
JANUARY 6, 2016 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on January 21, 2015] 
A BILL 
To ensure the functionality and security of new Federal 
websites that collect personally identifiable information, 
and for other purposes. 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Safe and Secure Federal 
Websites Act of 2015’’. 
SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 
FEDERAL WEBSITES THAT COLLECT PERSON-
ALLY IDENTIFIABLE INFORMATION. 
(a) CERTIFICATION REQUIREMENT.— 
(1) IN GENERAL.—Except as otherwise provided 
under this subsection, an agency may not deploy or 
make available to the public a new Federal PII 
website until the date on which the chief information 
officer of the agency submits a certification to Con-
gress that the website is fully functional and secure. 
(2) TRANSITION.—In the case of a new Federal 
PII website that is operational on the date of the en-
actment of this Act, paragraph (1) shall not apply 
until the end of the 90-day period beginning on such 
date of enactment. If the certification required under 
paragraph (1) for such website has not been submitted 
to Congress before the end of such period, the head of 
the responsible agency shall render the website inac-
cessible to the public until such certification is sub-
mitted to Congress. 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
(3) EXCEPTION FOR BETA WEBSITE WITH EX-
PLICIT PERMISSION.—Paragraph (1) shall not apply 
to a website (or portion thereof) that is in a develop-
ment or testing phase, if the following conditions are 
met: 
(A) A member of the public may access PII- 
related portions of the website only after exe-
cuting an agreement that acknowledges the risks 
involved. 
(B) No agency compelled, enjoined, or other-
wise provided incentives for such a member to 
access the website for such purposes. 
(4) CONSTRUCTION.—Nothing in this section 
shall be construed as applying to a website that is op-
erated entirely by an entity (such as a State or local-
ity) that is independent of the Federal Government, 
regardless of the receipt of funding in support of such 
website from the Federal Government. 
(b) DEFINITIONS.—In this section: 
(1) AGENCY.—The term ‘‘agency’’ has the mean-
ing given that term under section 551 of title 5, 
United States Code. 
(2) FULLY FUNCTIONAL.—The term ‘‘fully func-
tional’’ means, with respect to a new Federal PII 
website, that the website can fully support the activi-
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
ties for which it is designed or intended with regard 
to the eliciting, collection, storage, or maintenance of 
personally identifiable information, including han-
dling a volume of queries relating to such information 
commensurate with the purpose for which the website 
is designed. 
(3) NEW FEDERAL PERSONALLY IDENTIFIABLE 
INFORMATION
WEBSITE
(NEW
FEDERAL
PII 
WEBSITE).—The terms ‘‘new Federal personally iden-
tifiable information website’’ and ‘‘new Federal PII 
website’’ mean a website that— 
(A) is operated by (or under a contract 
with) an agency; 
(B) elicits, collects, stores, or maintains per-
sonally identifiable information of individuals 
and is accessible to the public; and 
(C) is first made accessible to the public 
and collects or stores personally identifiable in-
formation of individuals, on or after October 1, 
2012. 
(4) OPERATIONAL.—The term ‘‘operational’’ 
means, with respect to a website, that such website 
elicits, collects, stores, or maintains personally identi-
fiable information of members of the public and is ac-
cessible to the public. 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
(5) PERSONALLY
IDENTIFIABLE
INFORMATION 
(PII).—The terms ‘‘personally identifiable informa-
tion’’ and ‘‘PII’’ mean any information about an in-
dividual elicited, collected, stored, or maintained by 
an agency, including— 
(A) any information that can be used to 
distinguish or trace the identity of an indi-
vidual, such as a name, a social security num-
ber, a date and place of birth, a mother’s maiden 
name, or biometric records; and 
(B) any other information that is linked or 
linkable to an individual, such as medical, edu-
cational, financial, and employment informa-
tion. 
(6) RESPONSIBLE AGENCY.—The term ‘‘respon-
sible agency’’ means, with respect to a new Federal 
PII website, the agency that is responsible for the op-
eration (whether directly or through contracts with 
other entities) of the website. 
(7) SECURE.—The term ‘‘secure’’ means, with re-
spect to a new Federal PII website, that the following 
requirements are met: 
(A) The website is in compliance with sub-
chapter II of chapter 35 of title 44, United 
States Code. 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
(B) The website ensures that personally 
identifiable information elicited, collected, stored, 
or maintained in connection with the website is 
captured at the latest possible step in a user 
input sequence. 
(C) The responsible agency for the website 
has encrypted, masked, or taken other similar 
actions to protect personally identifiable infor-
mation elicited, collected, stored, or maintained 
in connection with the website. 
(D) The responsible agency for the website 
has taken reasonable efforts to minimize domain 
name confusion, including through additional 
domain registrations. 
(E) The responsible agency requires all per-
sonnel who have access to personally identifiable 
information in connection with the website to 
have completed a Standard Form 85P and 
signed a non-disclosure agreement with respect to 
personally identifiable information, and the 
agency takes proper precautions to ensure that 
only the fewest reasonable number of trustworthy 
persons may access such information. 
(F) The responsible agency maintains (ei-
ther directly or through contract) sufficient per-
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
sonnel to respond in a timely manner to issues 
relating to the proper functioning and security 
of the website, and to monitor on an ongoing 
basis existing and emerging security threats to 
the website. 
(8) STATE.—The term ‘‘State’’ means each State 
of the United States, the District of Columbia, each 
territory or possession of the United States, and each 
federally recognized Indian tribe. 
SEC. 3. PRIVACY BREACH REQUIREMENTS. 
(a) INFORMATION
SECURITY
AMENDMENT.—Sub-
chapter II of chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘§ 3559. Privacy breach requirements 
‘‘(a) POLICIES AND PROCEDURES.—The Director of 
the Office of Management and Budget shall establish and 
oversee policies and procedures for agencies to follow in the 
event of a breach of information security involving the dis-
closure of personally identifiable information, including re-
quirements for— 
‘‘(1) not later than 72 hours after the agency dis-
covers such a breach, or discovers evidence that rea-
sonably indicates such a breach has occurred, notice 
to the individuals whose personally identifiable infor-
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
mation could be compromised as a result of such 
breach; 
‘‘(2) timely reporting to a Federal cybersecurity 
center, as designated by the Director of the Office of 
Management and Budget; and 
‘‘(3) any additional actions that the Director 
finds necessary and appropriate, including data 
breach analysis, fraud resolution services, identity 
theft insurance, and credit protection or monitoring 
services. 
‘‘(b) REQUIRED AGENCY ACTION.—The head of each 
agency shall ensure that actions taken in response to a 
breach of information security involving the disclosure of 
personally identifiable information under the authority or 
control of the agency comply with policies and procedures 
established by the Director of the Office of Management and 
Budget under subsection (a). 
‘‘(c) REPORT.—Not later than March 1 of each year, 
the Director of the Office of Management and Budget shall 
report to Congress on agency compliance with the policies 
and procedures established under subsection (a). 
‘‘(d) FEDERAL CYBERSECURITY CENTER DEFINED.— 
The term ‘Federal cybersecurity center’ means any of the 
following: 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
‘‘(1) The Department of Defense Cyber Crime 
Center. 
‘‘(2) The Intelligence Community Incident Re-
sponse Center. 
‘‘(3) The United States Cyber Command Joint 
Operations Center. 
‘‘(4) The National Cyber Investigative Joint 
Task Force. 
‘‘(5) Central Security Service Threat Operations 
Center of the National Security Agency. 
‘‘(6) The United States Computer Emergency 
Readiness Team. 
‘‘(7) Any successor to a center, team, or task 
force described in paragraphs (1) through (6). 
‘‘(8) Any center that the Director of the Office of 
Management and Budget determines is appropriate to 
carry out the requirements of this section.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The 
table of sections for subchapter II of chapter 35 of title 44, 
United States Code, is amended by adding at the end the 
following: 
‘‘3559. Privacy breach requirements.’’. 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6213
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6213
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS
Union Calendar No. 293 
114TH CONGRESS 
2D SESSION 
H. R. 451 
[Report No. 114–390] 
A BILL 
To ensure the functionality and security of new 
Federal websites that collect personally identifi-
able information, and for other purposes. 
JANUARY 6, 2016 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
23:18 Jan 06, 2016
Jkt 059200
PO 00000
Frm 00012
Fmt 6651
Sfmt 6651
E:\BILLS\H451.RH
H451
asabaliauskas on DSK5VPTVN1PROD with BILLS