(8) STATE.—The term ‘‘State’’ means each State 
of the United States, the District of Columbia, each 
territory or possession of the United States, and each 
federally recognized Indian tribe. 
SEC. 3. PRIVACY BREACH REQUIREMENTS. 
(a) INFORMATION
SECURITY
AMENDMENT.—Sub-
chapter III of chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘§ 3550. Privacy breach requirements 
‘‘(a) POLICIES AND PROCEDURES.—The Director of 
the Office of Management and Budget shall establish and 
oversee policies and procedures for agencies to follow in the 
event of a breach of information security involving the dis-
closure of personally identifiable information, including re-
quirements for— 
‘‘(1) not later than 72 hours after the agency dis-
covers such a breach, or discovers evidence that rea-
sonably indicates such a breach has occurred, notice 
to the individuals whose personally identifiable infor-
mation could be compromised as a result of such 
breach; 
‘‘(2) timely reporting to a Federal cybersecurity 
center, as designated by the Director of the Office of 
Management and Budget; and 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(3) any additional actions that the Director 
finds necessary and appropriate, including data 
breach analysis, fraud resolution services, identity 
theft insurance, and credit protection or monitoring 
services. 
‘‘(b) REQUIRED AGENCY ACTION.—The head of each 
agency shall ensure that actions taken in response to a 
breach of information security involving the disclosure of 
personally identifiable information under the authority or 
control of the agency comply with policies and procedures 
established by the Director of the Office of Management and 
Budget under subsection (a). 
‘‘(c) REPORT.—Not later than March 1 of each year, 
the Director of the Office of Management and Budget shall 
report to Congress on agency compliance with the policies 
and procedures established under subsection (a). 
‘‘(d) FEDERAL CYBERSECURITY CENTER DEFINED.— 
The term ‘Federal cybersecurity center’ means any of the 
following: 
‘‘(1) The Department of Defense Cyber Crime 
Center. 
‘‘(2) The Intelligence Community Incident Re-
sponse Center. 
‘‘(3) The United States Cyber Command Joint 
Operations Center. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(4) The National Cyber Investigative Joint 
Task Force. 
‘‘(5) Central Security Service Threat Operations 
Center of the National Security Agency. 
‘‘(6) The United States Computer Emergency 
Readiness Team. 
‘‘(7) Any successor to a center, team, or task 
force described in paragraphs (1) through (6). 
‘‘(8) Any center that the Director of the Office of 
Management and Budget determines is appropriate to 
carry out the requirements of this section.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The 
table of sections for subchapter III of chapter 35 of title 
44, United States Code, is amended by adding at the end 
the following: 
‘‘3550. Privacy breach requirements.’’. 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6213
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6213
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS
Union Calendar No. 421 
113TH CONGRESS 
2D SESSION 
H. R. 3635 
[Report No. 113–562] 
A BILL 
To ensure the functionality and security of new 
Federal websites that collect personally identifi-
able information, and for other purposes. 
JULY 28, 2014 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
23:23 Jul 28, 2014
Jkt 039200
PO 00000
Frm 00012
Fmt 6651
Sfmt 6651
E:\BILLS\H3635.RH
H3635
tkelley on DSK3SPTVN1PROD with BILLS