SEC. 2. STUDY ON CYBERSECURITY STANDARDS FOR 
MOTOR VEHICLES. 
(a) STUDY REQUIRED.—The Administrator of the 
National Highway Traffic Safety Administration, in con-
sultation with the Federal Trade Commission, the Direc-
tor of the National Institute of Standards and Technology, 
the Secretary of Defense, the Automotive Information 
Sharing and Analysis Center, SAE International, manu-
facturers of motor vehicles, manufacturers of original 
motor vehicle equipment, and relevant academic institu-
tions, shall conduct a study to determine appropriate 
standards for the regulation of the cybersecurity of motor 
vehicles manufactured or imported for sale in the United 
States that should be adopted by the Administration and 
any other appropriate Federal agencies. The study shall 
include an identification of— 
(1) the isolation measures that are necessary to 
separate critical software systems from other soft-
ware systems; 
(2) the measures that are necessary to detect 
and prevent or minimize in the software systems of 
motor vehicles anomalous codes associated with ma-
licious behavior; 
(3) the techniques that are necessary to detect 
and prevent, discourage, or mitigate intrusions into 
the software systems of motor vehicles and other cy-
VerDate Sep 11 2014 
04:51 Feb 01, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H701.IH
H701
SSpencer on DSK4SPTVN1PROD with BILLS
bersecurity risks in motor vehicles, such as contin-
uous penetration testing and on-demand risk assess-
ments; 
(4) best practices to secure driving data col-
lected by the electronic systems of motor vehicles 
while such data are stored onboard the vehicle, in 
transit from the vehicle to another location, in 
offboard storage, and in long-term storage (whether 
onboard or offboard the vehicle); and 
(5) a timeline for implementing systems and 
software that reflect the measures, techniques, and 
best practices identified under paragraphs (1) 
through (4). 
(b) REPORTS TO CONGRESS.— 
(1) PRELIMINARY REPORT.—Not later than 1 
year after the date of the enactment of this Act, the 
Administrator shall submit to the Committee on En-
ergy and Commerce of the House of Representatives 
and the Committee on Commerce, Science, and 
Transportation of the Senate a report containing the 
preliminary findings of the study conducted under 
subsection (a). 
(2) FINAL REPORT.—Not later than 6 months 
after the submission of the report under paragraph 
(1), the Administrator shall submit to the commit-
VerDate Sep 11 2014 
04:51 Feb 01, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H701.IH
H701
SSpencer on DSK4SPTVN1PROD with BILLS
tees described in such paragraph a report containing 
the complete findings of the study conducted under 
subsection (a), including recommended dates for the 
adoption and effectiveness of the standards deter-
mined to be appropriate in such study and rec-
ommendations for any legislation that may be nec-
essary to authorize the adoption of such standards. 
(3) FORM OF REPORT.—The report required by 
paragraph (2) shall be submitted in unclassified 
form but may contain a classified annex. 
(c) DEFINITIONS.—In this section: 
(1) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the National 
Highway Traffic Safety Administration. 
(2) CRITICAL SOFTWARE SYSTEM.—The term 
‘‘critical software system’’ means a software system 
of a motor vehicle that can affect the driver’s control 
of the movement of the vehicle. 
(3) DRIVING DATA.—The term ‘‘driving data’’ 
includes any electronic information collected about— 
(A) a vehicle’s status, including its location 
or speed; or 
(B) any owner, lessee, driver, or passenger 
of a vehicle. 
Æ 
VerDate Sep 11 2014 
04:51 Feb 01, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H701.IH
H701
SSpencer on DSK4SPTVN1PROD with BILLS