IB 
Union Calendar No. 421 
113TH CONGRESS 
2D SESSION 
H. R. 3635 
[Report No. 113–562] 
To ensure the functionality and security of new Federal websites that collect 
personally identifiable information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 3, 2013 
Mr. BENTIVOLIO introduced the following bill; which was referred to the 
Committee on Oversight and Government Reform 
JULY 28, 2014 
Additional sponsors: Mr. COLE, Mr. WILSON of South Carolina, Mr. BROOKS 
of Alabama, Mrs. BACHMANN, Mr. WESTMORELAND, Mr. DUNCAN of 
South Carolina, Mrs. LUMMIS, Mr. YOHO, Mr. WALBERG, Mr. HUIZENGA 
of Michigan, Mr. MEADOWS, Mrs. BLACKBURN, Mr. BENISHEK, Mr. 
KINGSTON, Mr. WEBER
of Texas, Mr. FRANKS
of Arizona, Mr. 
LAMALFA, Mr. ROHRABACHER, Mr. MICA, Mr. KELLY of Pennsylvania, 
Mr. BARR, Mr. LUCAS, Mr. MILLER of Florida, Mr. SAM JOHNSON of 
Texas, Mr. MESSER, Mr. MULVANEY, Mr. HUDSON, Mr. RICE of South 
Carolina, Mr. POSEY, Mr. CRAMER, Mr. WILLIAMS, Mr. STOCKMAN, Mr. 
FARENTHOLD, Mr. JORDAN, Mr. MULLIN, Mr. BRIDENSTINE, Mr. 
FINCHER, 
Mr. 
HULTGREN, 
Mr. 
COLLINS
of 
New 
York, 
Mr. 
FLEISCHMANN, Mr. GIBBS, Mr. WENSTRUP, Mr. LANKFORD, Mr. BROUN 
of Georgia, Mr. RODNEY DAVIS of Illinois, Mr. YOUNG of Alaska, Mr. 
ROKITA, Mr. MCHENRY, Mr. GOSAR, Mr. CARTER, Mr. DIAZ-BALART, 
Mr. COLLINS of Georgia, Mr. DESANTIS, Mr. GOWDY, Mr. AMASH, Mr. 
GINGREY of Georgia, Mr. AMODEI, Mr. HALL, Mr. HUNTER, Mr. PRICE 
of Georgia, Mrs. WAGNER, Mr. JOYCE, Mr. BURGESS, Mr. CASSIDY, Mr. 
SCHWEIKERT, Mr. STEWART, Ms. JENKINS, Mr. SCALISE, Mr. LATHAM, 
Mr. HURT, Mr. DESJARLAIS, Mr. ADERHOLT, Mr. COOK, Mr. 
CRAWFORD, Mr. KING of Iowa, Mr. THOMPSON of Pennsylvania, Mr. 
GRIFFIN of Arkansas, Mr. DUNCAN of Tennessee, Mrs. ROBY, Mr. 
CHABOT, Mr. PITTENGER, Mr. SANFORD, Mr. GRAVES of Georgia, Mr. 
CRENSHAW, Mr. GRIFFITH of Virginia, Mr. NUNNELEE, Mr. DUFFY, Mr. 
SHUSTER, Mr. HASTINGS of Washington, Mr. ROSKAM, Mr. LATTA, Mr. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Safe and Secure Federal 
Websites Act of 2014’’. 
SEC. 2. ENSURING FUNCTIONALITY AND SECURITY OF NEW 
FEDERAL WEBSITES THAT COLLECT PERSON-
ALLY IDENTIFIABLE INFORMATION. 
(a) CERTIFICATION REQUIREMENT.— 
(1) IN GENERAL.—Except as otherwise provided 
under this subsection, an agency may not deploy or 
make available to the public a new Federal PII 
website until the date on which the chief information 
officer of the agency submits a certification to Con-
gress that the website is fully functional and secure. 
(2) TRANSITION.—In the case of a new Federal 
PII website that is operational on the date of the en-
actment of this Act, paragraph (1) shall not apply 
until the end of the 90-day period beginning on such 
date of enactment. If the certification required under 
paragraph (1) for such website has not been submitted 
to Congress before the end of such period, the head of 
the responsible agency shall render the website inac-
cessible to the public until such certification is sub-
mitted to Congress. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
(3) EXCEPTION FOR BETA WEBSITE WITH EX-
PLICIT PERMISSION.—Paragraph (1) shall not apply 
to a website (or portion thereof) that is in a develop-
ment or testing phase, if the following conditions are 
met: 
(A) A member of the public may access PII- 
related portions of the website only after exe-
cuting an agreement that acknowledges the risks 
involved. 
(B) No agency compelled, enjoined, or other-
wise provided incentives for such a member to 
access the website for such purposes. 
(4) CONSTRUCTION.—Nothing in this section 
shall be construed as applying to a website that is op-
erated entirely by an entity (such as a State or local-
ity) that is independent of the Federal Government, 
regardless of the receipt of funding in support of such 
website from the Federal Government. 
(b) DEFINITIONS.—In this section: 
(1) AGENCY.—The term ‘‘agency’’ has the mean-
ing given that term under section 551 of title 5, 
United States Code. 
(2) FULLY FUNCTIONAL.—The term ‘‘fully func-
tional’’ means, with respect to a new Federal PII 
website, that the website can fully support the activi-
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
ties for which it is designed or intended with regard 
to the eliciting, collection, storage, or maintenance of 
personally identifiable information, including han-
dling a volume of queries relating to such information 
commensurate with the purpose for which the website 
is designed. 
(3) NEW FEDERAL PERSONALLY IDENTIFIABLE 
INFORMATION
WEBSITE
(NEW
FEDERAL
PII 
WEBSITE).—The terms ‘‘new Federal personally iden-
tifiable information website’’ and ‘‘new Federal PII 
website’’ mean a website that— 
(A) is operated by (or under a contract 
with) an agency; 
(B) elicits, collects, stores, or maintains per-
sonally identifiable information of individuals 
and is accessible to the public; and 
(C) is first made accessible to the public 
and collects or stores personally identifiable in-
formation of individuals, on or after October 1, 
2012. 
(4) OPERATIONAL.—The term ‘‘operational’’ 
means, with respect to a website, that such website 
elicits, collects, stores, or maintains personally identi-
fiable information of members of the public and is ac-
cessible to the public. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
(5) PERSONALLY
IDENTIFIABLE
INFORMATION 
(PII).—The terms ‘‘personally identifiable informa-
tion’’ and ‘‘PII’’ mean any information about an in-
dividual elicited, collected, stored, or maintained by 
an agency, including— 
(A) any information that can be used to 
distinguish or trace the identity of an indi-
vidual, such as a name, a social security num-
ber, a date and place of birth, a mother’s maiden 
name, or biometric records; and 
(B) any other information that is linked or 
linkable to an individual, such as medical, edu-
cational, financial, and employment informa-
tion. 
(6) RESPONSIBLE AGENCY.—The term ‘‘respon-
sible agency’’ means, with respect to a new Federal 
PII website, the agency that is responsible for the op-
eration (whether directly or through contracts with 
other entities) of the website. 
(7) SECURE.—The term ‘‘secure’’ means, with re-
spect to a new Federal PII website, that the following 
requirements are met: 
(A) The website is in compliance with sub-
chapter III of chapter 35 of title 44, United 
States Code. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
(B) The website ensures that personally 
identifiable information elicited, collected, stored, 
or maintained in connection with the website is 
captured at the latest possible step in a user 
input sequence. 
(C) The responsible agency for the website 
has taken reasonable efforts to minimize domain 
name confusion, including through additional 
domain registrations. 
(D) The responsible agency requires all per-
sonnel who have access to personally identifiable 
information in connection with the website to 
have completed a Standard Form 85P and 
signed a non-disclosure agreement with respect to 
personally identifiable information, and the 
agency takes proper precautions to ensure only 
trustworthy persons may access such informa-
tion. 
(E) The responsible agency maintains (ei-
ther directly or through contract) sufficient per-
sonnel to respond in a timely manner to issues 
relating to the proper functioning and security 
of the website, and to monitor on an ongoing 
basis existing and emerging security threats to 
the website. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS