H. R. 1668 
One Hundred Sixteenth Congress 
of the 
United States of America 
AT THE SECOND SESSION 
Begun and held at the City of Washington on Friday, 
the third day of January, two thousand and twenty 
An Act 
To establish minimum security standards for Internet of Things devices owned 
or controlled by the Federal Government, and for other purposes. 
Be it enacted by the Senate and House of Representatives of 
the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Things Cybersecurity 
Improvement Act of 2020’’ or the ‘‘IoT Cybersecurity Improvement 
Act of 2020’’. 
SEC. 2. SENSE OF CONGRESS. 
It is the sense of Congress that— 
(1) ensuring the highest level of cybersecurity at agencies 
in the executive branch is the responsibility of the President, 
followed by the Director of the Office of Management and 
Budget, the Secretary of Homeland Security, and the head 
of each such agency; 
(2) this responsibility is to be carried out by working 
collaboratively within and among agencies in the executive 
branch, industry, and academia; 
(3) the strength of the cybersecurity of the Federal Govern-
ment and the positive benefits of digital technology trans-
formation depend on proactively addressing cybersecurity 
throughout the acquisition and operation of Internet of Things 
devices by the Federal Government; and 
(4) consistent with the second draft National Institute for 
Standards and Technology Interagency or Internal Report 8259 
titled ‘‘Recommendations for IoT Device Manufacturers: 
Foundational Activities and Core Device Cybersecurity Capa-
bility Baseline’’, published in January 2020, Internet of Things 
devices are devices that— 
(A) have at least one transducer (sensor or actuator) 
for interacting directly with the physical world, have at 
least one network interface, and are not conventional 
Information Technology devices, such as smartphones and 
laptops, for which the identification and implementation 
of cybersecurity features is already well understood; and 
(B) can function on their own and are not only able 
to function when acting as a component of another device, 
such as a processor. 
SEC. 3. DEFINITIONS. 
In this Act:
H. R. 1668—2 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given 
that term in section 3502 of title 44, United States Code. 
(2) DIRECTOR OF OMB.—The term ‘‘Director of OMB’’ means 
the Director of the Office of Management and Budget. 
(3) DIRECTOR OF THE INSTITUTE.—The term ‘‘Director of 
the Institute’’ means the Director of the National Institute 
of Standards and Technology. 
(4) INFORMATION SYSTEM.—The term ‘‘information system’’ 
has the meaning given that term in section 3502 of title 44, 
United States Code. 
(5) NATIONAL SECURITY SYSTEM.—The term ‘‘national secu-
rity system’’ has the meaning given that term in section 
3552(b)(6) of title 44, United States Code. 
(6) OPERATIONAL
TECHNOLOGY.—The term ‘‘operational 
technology’’ means hardware and software that detects or 
causes a change through the direct monitoring or control of 
physical devices, processes, and events in the enterprise. 
(7) SECRETARY.—The term ‘‘Secretary’’ means the Secretary 
of Homeland Security. 
(8) SECURITY VULNERABILITY.—The term ‘‘security vulner-
ability’’ has the meaning given that term in section 102(17) 
of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 
1501(17)). 
SEC. 4. SECURITY STANDARDS AND GUIDELINES FOR AGENCIES ON 
USE AND MANAGEMENT OF INTERNET OF THINGS DEVICES. 
(a) NATIONAL INSTITUTE
OF STANDARDS
AND TECHNOLOGY 
DEVELOPMENT OF STANDARDS AND GUIDELINES FOR USE OF INTER-
NET OF THINGS DEVICES BY AGENCIES.— 
(1) IN GENERAL.—Not later than 90 days after the date 
of the enactment of this Act, the Director of the Institute 
shall develop and publish under section 20 of the National 
Institute of Standards and Technology Act (15 U.S.C. 278g– 
3) standards and guidelines for the Federal Government on 
the appropriate use and management by agencies of Internet 
of Things devices owned or controlled by an agency and con-
nected to information systems owned or controlled by an agency, 
including minimum information security requirements for man-
aging cybersecurity risks associated with such devices. 
(2) CONSISTENCY
WITH
ONGOING
EFFORTS.—The Director 
of the Institute shall ensure that the standards and guidelines 
developed under paragraph (1) are consistent with the efforts 
of the National Institute of Standards and Technology in effect 
on the date of the enactment of this Act— 
(A) regarding— 
(i) examples of possible security vulnerabilities of 
Internet of Things devices; and 
(ii) considerations for managing the security 
vulnerabilities of Internet of Things devices; and 
(B) with respect to the following considerations for 
Internet of Things devices: 
(i) Secure Development. 
(ii) Identity management. 
(iii) Patching. 
(iv) Configuration management. 
(3) CONSIDERING RELEVANT STANDARDS.—In developing the 
standards and guidelines under paragraph (1), the Director
H. R. 1668—3 
of the Institute shall consider relevant standards, guidelines, 
and best practices developed by the private sector, agencies, 
and public-private partnerships. 
(b) REVIEW OF AGENCY INFORMATION SECURITY POLICIES AND 
PRINCIPLES.— 
(1) REQUIREMENT.—Not later than 180 days after the date 
on which the Director of the Institute completes the develop-
ment of the standards and guidelines required under subsection 
(a), the Director of OMB shall review agency information secu-
rity policies and principles on the basis of the standards and 
guidelines published under subsection (a) pertaining to Internet 
of Things devices owned or controlled by agencies (excluding 
agency information security policies and principles pertaining 
to Internet of Things of devices owned or controlled by agencies 
that are or comprise a national security system) for consistency 
with the standards and guidelines submitted under subsection 
(a) and issue such policies and principles as may be necessary 
to ensure those policies and principles are consistent with such 
standards and guidelines. 
(2) REVIEW.—In reviewing agency information security poli-
cies and principles under paragraph (1) and issuing policies 
and principles under such paragraph, as may be necessary, 
the Director of OMB shall— 
(A) consult with the Director of the Cybersecurity and 
Infrastructure Security Agency of the Department of Home-
land Security; and 
(B) ensure such policies and principles are consistent 
with the information security requirements under sub-
chapter II of chapter 35 of title 44, United States Code. 
(3) NATIONAL SECURITY SYSTEMS.—Any policy or principle 
issued by the Director of OMB under paragraph (1) shall not 
apply to national security systems. 
(c) QUINQUENNIAL REVIEW AND REVISION.— 
(1) REVIEW AND REVISION OF NIST STANDARDS AND GUIDE-
LINES.—Not later than 5 years after the date on which the 
Director of the Institute publishes the standards and guidelines 
under subsection (a), and not less frequently than once every 
5 years thereafter, the Director of the Institute, shall— 
(A) review such standards and guidelines; and 
(B) revise such standards and guidelines as appro-
priate. 
(2) UPDATED
OMB
POLICIES
AND
PRINCIPLES
FOR
AGEN-
CIES.—Not later than 180 days after the Director of the 
Institute makes a revision pursuant to paragraph (1), the 
Director of OMB, in consultation with the Director of the Cyber-
security and Infrastructure Security Agency of the Department 
of Homeland Security, shall update any policy or principle 
issued under subsection (b)(1) as necessary to ensure those 
policies and principles are consistent with the review and any 
revision under paragraph (1) under this subsection and para-
graphs (2) and (3) of subsection (b). 
(d) REVISION OF FEDERAL ACQUISITION REGULATION.—The Fed-
eral Acquisition Regulation shall be revised as necessary to imple-
ment any standards and guidelines promulgated in this section.