116 
controls beyond those included in a FedRAMP 
authorization package for a particular cloud 
computing product or service. 
‘‘(6) RULES OF CONSTRUCTION.—Nothing in this 
subsection shall be construed— 
‘‘(A) to alter the authority of the Secretary, 
the Director, or the Director of the National In-
stitute of Standards and Technology in imple-
menting subchapter II of this title; 
‘‘(B) to affect the standards or process of the 
National Institute of Standards and Technology; 
‘‘(C) to affect the requirement under section 
3553(a)(4); 
‘‘(D) to discourage continued improvements 
and advancements in the technology, standards, 
policies, and guidelines used to promote Federal 
information security; or 
‘‘(E) to affect the requirements under sub-
chapter III. 
‘‘(g) EXCEPTION.— 
‘‘(1) NATIONAL
SECURITY
SYSTEM
REQUIRE-
MENTS.—The requirements under subsection (f)(1) 
shall not apply to— 
‘‘(A) a national security system; or 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
117 
‘‘(B) an information system described in 
paragraph (2) or (3) of section 3553(e)(2). 
‘‘(2) PROHIBITION.—The prohibition under sub-
section (f)(2) shall not apply to— 
‘‘(A) necessary in the interest of national 
security; 
‘‘(B) national security systems; or 
‘‘(C) a procured internet of things device de-
scribed in subsection (f)(2)(B) that the Chief In-
formation Officer of an agency determines is— 
‘‘(i) necessary for research purposes; 
‘‘(ii) necessary in the interest of na-
tional security; or 
‘‘(iii) secured using alternative and ef-
fective methods appropriate to the function 
of the internet of things device.’’. 
(b) REPORT ON EXEMPTIONS.—Section 3554(c)(1) of 
title 44, United States Code, as amended by this Act, is 
further amended— 
(1) in subparagraph (C), by striking ‘‘and’’ at 
the end; 
(2) in subparagraph (D), by striking the period 
at the end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
118 
‘‘(E) with respect to any exemption from 
the requirements of subsection (f)(3) that is effec-
tive on the date of submission of the report, in-
cludes the number of information systems that 
have received an exemption from those require-
ments.’’. 
(c) GUIDANCE FOR IDENTITY MANAGEMENT SYSTEMS 
USED BY AGENCIES.—Not later than 1 year after the date 
of enactment of this Act, the Director of the Office of Man-
agement and Budget, in consultation with the Director of 
the National Institute of Standards and Technology, shall 
issue, and routinely update thereafter, guidance for agencies 
to implement identity management systems and a single 
sign-on trusted identity platform as required under section 
3554(f)(1)(D)(i) of title 44, United States Code, as amended 
by this Act, which shall at a minimum, include the fol-
lowing: 
(1) Requirements for agencies to routinely certify 
that such systems are in compliance with this guid-
ance. 
(2) Requirements for agencies to routinely verify 
and certify that information stored on or transiting 
through a commercially available product (as defined 
in section 103 of title 41, United States Code) or com-
mercial service (as defined in section 103a of title 41, 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
119 
United States Code) used to fulfil such requirements 
is appropriately secured in conformity with sub-
chapter II of chapter 35 of title 44, United States 
Code. 
(3) Address national security concerns and re-
quirements to ensure the protection of sensitive per-
sonal records and biometric data of United States 
persons from malign foreign ownership, control, or 
influence and fraud actors. 
(4) Requirements or guidelines to comply with 
section 3 of the 21st Century Idea Act (44 U.S.C. 
3501 note). 
(5) Requirements to prevent discrimination in 
violation of title VI of the Civil Rights Act of 1964 
(42 U.S.C. 2000d et seq.). 
(6) A description of the information necessary to 
be submitted under the exception described in section 
3554(f)(3)(B) of title 44, United States Code, as 
amended by this Act. 
(d) GAO EVALUATION OF TECHNICAL CAPABILITY OF 
IDENTITY MANAGEMENT SYSTEMS AND PLATFORMS.—Not 
less frequently than every 3 years for the next 6 years, the 
Comptroller General shall submit to the appropriate con-
gressional committees a report on whether the single sign- 
on trusted identity systems and platforms used by agencies 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
120 
or the one developed by the General Services Administration 
under section 3554(f)(D)(i) of title 44, United States Code, 
as amended by this Act, adhere to the information security 
requirements of chapter 35 of title 44, United States Code, 
guidance issued under subsection (c), and relevant identity 
management technical standards promulgated by the Na-
tional Institute of Standards and Technology, as appro-
priate, including section 504 of the Cybersecurity Enhance-
ment Act of 2014 (15 U.S.C. 7464). 
(e) DURATION OF CERTIFICATION EFFECTIVE DATE.— 
Paragraph (3) of section 3554(f) of title 44, United States 
Code, as added by this Act, shall take effect on the date 
that is 1 year after the date of enactment of this Act. 
(f) FEDERAL CYBERSECURITY ENHANCEMENT ACT OF 
2015 UPDATE.—Section 222(3)(B) of the Federal Cyberse-
curity Enhancement Act of 2015 (6 U.S.C. 1521(3)(B)) is 
amended by inserting ‘‘and the Committee on Oversight and 
Accountability’’ before ‘‘of the House of Representatives’’. 
SEC. 12. FEDERAL CHIEF INFORMATION SECURITY OFFI-
CER. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by adding at the end the following: 
‘‘§ 3617. Federal Chief Information Security Officer 
‘‘(a) ESTABLISHMENT.—There is established a Federal 
Chief Information Security Officer, who shall serve in— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
122 
‘‘(2) perform every function assigned to the Di-
rector under sections 1321 through 1328 of title 41, 
United States Code. 
‘‘(e) COORDINATION WITH ONCD.—The Federal Chief 
Information Security Officer shall support initiatives deter-
mined by the Federal Chief Information Officer necessary 
to coordinate with the Office of the National Cyber Direc-
tor.’’. 
(b) NATIONAL CYBER DIRECTOR DUTIES.—Section 
1752 of the William M. (Mac) Thornberry National Defense 
Authorization Act for Fiscal Year 2021 (6 U.S.C. 1500) is 
amended— 
(1) by redesignating subsection (g) as subsection 
(h); and 
(2) by inserting after subsection (f) the following: 
‘‘(g) SENIOR FEDERAL CYBERSECURITY OFFICER.— 
The Federal Chief Information Security Officer appointed 
by the President under section 3617 of title 44, United 
States Code, shall be a senior official within the Office and 
carry out duties applicable to the protection of information 
technology (as defined in section 11101 of title 40, United 
States Code), including initiatives determined by the Direc-
tor necessary to coordinate with the Office of the Federal 
Chief Information Officer.’’. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
123 
(c) TREATMENT OF INCUMBENT.—The individual serv-
ing as the Federal Chief Information Security Officer ap-
pointed by the President as of the date of enactment of this 
Act may serve as the Federal Chief Information Security 
Officer under section 3617 of title 44, United States Code, 
as added by this Act, beginning on the date of enactment 
of this Act, without need for a further or additional ap-
pointment under such section. 
(d) CLERICAL AMENDMENT.—The table of sections for 
chapter 36 of title 44, United States Code, is amended by 
adding at the end the following: 
‘‘3617. Federal Chief Information Security Officer.’’. 
SEC. 13. RENAMING OFFICE OF THE FEDERAL CHIEF INFOR-
MATION OFFICER. 
(a) DEFINITIONS.— 
(1) IN
GENERAL.—Section 3601 of title 44, 
United States Code, is amended— 
(A) by striking paragraph (1); and 
(B) 
by 
redesignating 
paragraphs 
(2) 
through (8) as paragraphs (1) through (7), re-
spectively. 
(2) CONFORMING AMENDMENTS.— 
(A) TITLE 10.—Section 2222(i)(6) of title 
10, United States Code, is amended by striking 
‘‘section 3601(4)’’ and inserting ‘‘section 3601’’. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
124 
(B) NATIONAL SECURITY ACT OF 1947.—Sec-
tion 506D(k)(1) of the National Security Act of 
1947 (50 U.S.C. 3100(k)(1)) is amended by 
striking ‘‘section 3601(4)’’ and inserting ‘‘section 
3601’’. 
(b) OFFICE OF ELECTRONIC GOVERNMENT.—Section 
3602 of title 44, United States Code, is amended— 
(1) in the heading, by striking ‘‘Office of 
Electronic Government’’ and inserting ‘‘Office 
of the Federal Chief Information Officer’’; 
(2) in subsection (a), by striking ‘‘Office of Elec-
tronic Government’’ and inserting ‘‘Office of the Fed-
eral Chief Information Officer’’; 
(3) in subsection (b), by striking ‘‘an Adminis-
trator’’ and inserting ‘‘a Federal Chief Information 
Officer’’; 
(4) in subsection (c), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(5) in subsection (d), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(6) in subsection (e), in the matter preceding 
paragraph (1), by striking ‘‘The Administrator’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
125 
(7) in subsection (f)— 
(A) in the matter preceding paragraph (1), 
by striking ‘‘the Administrator’’ and inserting 
‘‘the Federal Chief Information Officer’’; 
(B) in paragraph (16), by striking ‘‘the Of-
fice of Electronic Government’’ and inserting 
‘‘the Office of the Federal Chief Information Offi-
cer’’; and 
(C) in paragraph (17), by striking ‘‘E–Gov-
ernment’’ and inserting ‘‘annual’’; and 
(8) in subsection (g), by striking ‘‘the Office of 
Electronic Government’’ and inserting ‘‘the Office of 
the Federal Chief Information Officer’’. 
(c) CHIEF INFORMATION OFFICERS COUNCIL.—Sec-
tion 3603 of title 44, United States Code, is amended— 
(1) in subsection (b)(2), by striking ‘‘The Admin-
istrator of the Office of Electronic Government’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
(2) in subsection (c)(1), by striking ‘‘The Admin-
istrator of the Office of Electronic Government’’ and 
inserting ‘‘The Federal Chief Information Officer’’; 
and 
(3) in subsection (f)— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
126 
(A) in paragraph (3), by striking ‘‘the Ad-
ministrator’’ and inserting ‘‘the Federal Chief 
Information Officer’’; and 
(B) in paragraph (5), by striking ‘‘the Ad-
ministrator’’ and inserting ‘‘the Federal Chief 
Information Officer’’. 
(d) E–GOVERNMENT FUND.—Section 3604 of title 44, 
United States Code, is amended— 
(1) in subsection (a)(2), by striking ‘‘the Admin-
istrator of the Office of Electronic Government’’ and 
inserting ‘‘the Federal Chief Information Officer’’; 
(2) in subsection (b), by striking ‘‘Adminis-
trator’’ each place it appears and inserting ‘‘Federal 
Chief Information Officer’’; and 
(3) in subsection (c), in the matter preceding 
paragraph (1), by striking ‘‘the Administrator’’ and 
inserting ‘‘the Federal Chief Information Officer’’. 
(e) PROGRAM TO ENCOURAGE INNOVATIVE SOLUTIONS 
TO ENHANCE ELECTRONIC GOVERNMENT SERVICES AND 
PROCESSES.—Section 3605 of title 44, United States Code, 
is amended— 
(1) in subsection (a), by striking ‘‘The Adminis-
trator’’ and inserting ‘‘The Federal Chief Information 
Officer’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB