IB 
Union Calendar No. 790 
118TH CONGRESS 
2D SESSION 
H. R. 4552 
[Report No. 118–939, Part I] 
To improve the cybersecurity of the Federal Government, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 11, 2023 
Ms. MACE (for herself, Mr. RASKIN, Mr. COMER, and Mr. CONNOLLY) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Accountability, and in addition to the Committees on Science, 
Space, and Technology, Homeland Security, and Armed Services, for a 
period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
DECEMBER 19, 2024 
Additional sponsor: Mr. DAVIS of North Carolina 
DECEMBER 19, 2024 
Reported from the Committee on Oversight and Accountability with an 
amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
DECEMBER 19, 2024 
Committees on Science, Space, and Technology, Homeland Security, and 
Armed Services discharged; committed to the Committee of the Whole 
House on the State of the Union and ordered to be printed 
[For text of introduced bill, see copy of bill as introduced on July 11, 2023] 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Federal Information Security Modernization Act of 2024’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
Sec. 3. Amendments to title 44. 
Sec. 4. Amendments to subtitle III of title 40. 
Sec. 5. Actions to enhance Federal incident transparency. 
Sec. 6. Agency requirements to notify private sector entities impacted by inci-
dents. 
Sec. 7. Federal penetration testing policy. 
Sec. 8. Vulnerability disclosure policies. 
Sec. 9. Implementing zero trust architecture. 
Sec. 10. Automation and artificial intelligence. 
Sec. 11. Federal cybersecurity requirements. 
Sec. 12. Federal Chief Information Security Officer. 
Sec. 13. Renaming Office of the Federal Chief Information Officer. 
Sec. 14. Rules of construction. 
SEC. 2. DEFINITIONS. 
In this Act, unless otherwise specified: 
(1) AGENCY.—The term ‘‘agency’’ has the mean-
ing given the term in section 3502 of title 44, United 
States Code. 
(2) 
APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional commit-
tees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(B) the Committee on Oversight and Ac-
countability of the House of Representatives; and 
(C) the Committee on Homeland Security of 
the House of Representatives. 
(3) AWARDEE.—The term ‘‘awardee’’ has the 
meaning given the term in section 3591 of title 44, 
United States Code, as added by this Act. 
(4) CONTRACTOR.—The term ‘‘contractor’’ has 
the meaning given the term in section 3591 of title 
44, United States Code, as added by this Act. 
(5) DIRECTOR.—The term ‘‘Director’’ means the 
Director of the Office of Management and Budget. 
(6) FEDERAL INFORMATION SYSTEM.—The term 
‘‘Federal information system’’ has the meaning given 
the term in section 3591 of title 44, United States 
Code, as added by this Act. 
(7) INCIDENT.—The term ‘‘incident’’ has the 
meaning given the term in section 3552(b) of title 44, 
United States Code. 
(8) NATIONAL
SECURITY
SYSTEM.—The term 
‘‘national security system’’ has the meaning given the 
term in section 3552(b) of title 44, United States 
Code. 
(9) PENETRATION TEST.—The term ‘‘penetration 
test’’ has the meaning given the term in section 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
3552(b) of title 44, United States Code, as amended 
by this Act. 
(10) THREAT HUNTING.—The term ‘‘threat hunt-
ing’’ means proactively and iteratively searching sys-
tems for threats and vulnerabilities, including threats 
or vulnerabilities that may evade detection by auto-
mated threat detection systems. 
(11) ZERO
TRUST
ARCHITECTURE.—The term 
‘‘zero trust architecture’’ has the meaning given the 
term in Special Publication 800–207 of the National 
Institute of Standards and Technology, or any suc-
cessor document. 
SEC. 3. AMENDMENTS TO TITLE 44. 
(a) SUBCHAPTER I AMENDMENTS.—Subchapter I of 
chapter 35 of title 44, United States Code, is amended— 
(1) in section 3504— 
(A) in subsection (a)(1)(B)— 
(i) by striking clause (v) and inserting 
the following: 
‘‘(v) privacy, confidentiality, disclosure, 
and sharing of information;’’; 
(ii) by redesignating clause (vi) as 
clause (vii); and 
(iii) by inserting after clause (v) the 
following: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(vi) in consultation with the National 
Cyber Director, security of information; and’’; 
and 
(B) in subsection (g)— 
(i) by redesignating paragraph (2) as 
paragraph (3); and 
(ii) by striking paragraph (1) and in-
serting the following: 
‘‘(1) develop and oversee the implementation of 
policies, principles, standards, and guidelines on pri-
vacy, confidentiality, disclosure, and sharing of infor-
mation collected or maintained by or for agencies; 
‘‘(2) in consultation with the National Cyber Di-
rector, oversee the implementation of policies, prin-
ciples, standards, and guidelines on security, of infor-
mation collected or maintained by or for agencies; 
and’’; 
(2) in section 3505— 
(A) by striking the first subsection des-
ignated as subsection (c); 
(B) in paragraph (2) of the second sub-
section designated as subsection (c), by inserting 
‘‘an identification of internet accessible informa-
tion systems and’’ after ‘‘an inventory under this 
subsection shall include’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(C) in paragraph (3) of the second sub-
section designated as subsection (c)— 
(i) in subparagraph (B)— 
(I) by inserting ‘‘the Director of 
the Cybersecurity and Infrastructure 
Security Agency, the National Cyber 
Director, and’’ before ‘‘the Comptroller 
General’’; and 
(II) by striking ‘‘and’’ at the end; 
(ii) in subparagraph (C)(v), by strik-
ing the period at the end and inserting ‘‘; 
and’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(D) maintained on a continual basis 
through the use of automation, machine-readable 
data, and scanning, wherever practicable.’’; 
(3) in section 3506— 
(A) in subsection (a)(3), by inserting ‘‘In 
carrying out these duties, the Chief Information 
Officer shall consult, as appropriate, with the 
Chief Data Officer in accordance with the des-
ignated functions under section 3520(c).’’ after 
‘‘reduction of information collection burdens on 
the public.’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(B) in subsection (b)(1)(C), by inserting 
‘‘availability,’’ after ‘‘integrity,’’; 
(C) in subsection (h)(3), by inserting ‘‘secu-
rity,’’ after ‘‘efficiency,’’; and 
(D) by adding at the end the following: 
‘‘(j)(1) Notwithstanding paragraphs (2) and (3) of 
subsection (a), the head of each agency shall, in accordance 
with section 522(a) of division H of the Consolidated Ap-
propriations Act, 2005 (42 U.S.C. 2000ee–2), designate a 
Chief Privacy Officer with the necessary skills, knowledge, 
and expertise, who shall have the authority and responsi-
bility to— 
‘‘(A) lead the privacy program of the agency; 
and 
‘‘(B) carry out the privacy responsibilities of the 
agency under this chapter, section 552a of title 5, and 
guidance issued by the Director. 
‘‘(2) The Chief Privacy Officer of each agency shall— 
‘‘(A) serve in a central leadership position with-
in the agency; 
‘‘(B) have visibility into relevant agency oper-
ations; and 
‘‘(C) be positioned highly enough within the 
agency to regularly engage with other agency leaders 
and officials, including the head of the agency. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(3) A privacy officer of an agency established under 
a statute enacted before the date of enactment of the Federal 
Information Security Modernization Act of 2024 may carry 
out the responsibilities under this subsection for the agen-
cy.’’; and 
(4) in section 3513— 
(A) by redesignating subsection (c) as sub-
section (d); and 
(B) by inserting after subsection (b) the fol-
lowing: 
‘‘(c) Each agency providing a written plan under sub-
section (b) shall provide any portion of the written plan 
addressing information security to the Secretary of Home-
land Security and the National Cyber Director.’’. 
(b) SUBCHAPTER II DEFINITIONS.— 
(1) IN GENERAL.—Section 3552(b) of title 44, 
United States Code, is amended— 
(A) by redesignating paragraphs (2), (3), 
(4), (5), (6), and (7) as paragraphs (3), (4), (5), 
(6), (8), and (10), respectively; 
(B) by inserting after paragraph (1) the fol-
lowing: 
‘‘(2) The term ‘high value asset’ means informa-
tion or an information system that the head of an 
agency, using policies, principles, standards, or 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
guidelines issued by the Director under section 
3553(a), determines to be so critical to the agency 
that the loss or degradation of the confidentiality, in-
tegrity, or availability of such information or infor-
mation system would have a serious impact on the 
ability of the agency to perform the mission of the 
agency or conduct business.’’; 
(C) by inserting after paragraph (6), as so 
redesignated, the following: 
‘‘(7) The term ‘major incident’ has the meaning 
given the term in guidance issued by the Director 
under section 3598(a).’’; 
(D) in paragraph (8)(A), as so redesig-
nated, in the matter preceding clause (i), by 
striking ‘‘used’’ and inserting ‘‘owned, man-
aged,’’; 
(E) by inserting after paragraph (8), as so 
redesignated, the following: 
‘‘(9) The term ‘penetration test’— 
‘‘(A) means an authorized assessment that 
emulates attempts to gain unauthorized access 
to, or disrupt the operations of, an information 
system or component of an information system; 
and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) includes any additional meaning 
given the term in policies, principles, standards, 
or guidelines issued by the Director under section 
3553(a).’’; and 
(F) by inserting after paragraph (10), as so 
redesignated, the following: 
‘‘(11) The term ‘shared service’ means a central-
ized mission capability or consolidated business func-
tion that is provided to multiple organizations within 
an agency or to multiple agencies. 
‘‘(12) The term ‘zero trust architecture’ has the 
meaning given the term in Special Publication 800– 
207 of the National Institute of Standards and Tech-
nology, or any successor document.’’. 
(2) CONFORMING AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Section 1001(c)(1)(A) of the Homeland Security 
Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended 
by striking ‘‘section 3552(b)(5)’’ and inserting 
‘‘section 3552(b)’’. 
(B) TITLE 10.— 
(i) SECTION 2222.—Section 2222(i)(8) 
of title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)(A)’’ and in-
serting ‘‘section 3552(b)(8)(A)’’. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(ii) SECTION 2223.—Section 2223(c)(3) 
of title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)’’ and insert-
ing ‘‘section 3552(b)’’. 
(iii) SECTION 3068.—Section 3068(b) of 
title 10, United States Code, is amended by 
striking ‘‘section 3552(b)(6)’’ and inserting 
‘‘section 3552(b)’’. 
(iv) SECTION 3252.—Section 3252(e)(5) 
of title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)’’ and insert-
ing ‘‘section 3552(b)’’. 
(C) HIGH-PERFORMANCE
COMPUTING
ACT 
OF 1991.—Section 207(a) of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5527(a)) 
is 
amended 
by 
striking 
‘‘section 
3552(b)(6)(A)(i)’’ 
and 
inserting 
‘‘section 
3552(b)(8)(A)(i)’’. 
(D) INTERNET OF THINGS CYBERSECURITY 
IMPROVEMENT ACT OF 2020.—Section 3(5) of the 
Internet of Things Cybersecurity Improvement 
Act of 2020 (15 U.S.C. 278g–3a(5)) is amended 
by striking ‘‘section 3552(b)(6)’’ and inserting 
‘‘section 3552(b)’’. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(E) NATIONAL
DEFENSE
AUTHORIZATION 
ACT
FOR
FISCAL
YEAR
2013.—Section 
933(e)(1)(B) of the National Defense Authoriza-
tion Act for Fiscal Year 2013 (10 U.S.C. 2224 
note) 
is 
amended 
by 
striking 
‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552(b)’’. 
(F) IKE SKELTON NATIONAL DEFENSE AU-
THORIZATION ACT FOR FISCAL YEAR 2011.—The 
Ike Skelton National Defense Authorization Act 
for Fiscal Year 2011 (Public Law 111–383) is 
amended— 
(i) in section 931(b)(3) (10 U.S.C. 
2223 note), by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’; and 
(ii) in section 932(b)(2) (10 U.S.C. 
2224 note), by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(G) E–GOVERNMENT ACT OF 2002.—Section 
301(c)(1)(A) of the E–Government Act of 2002 
(44 U.S.C. 3501 note) is amended by striking 
‘‘section 3542(b)(2)’’ and inserting ‘‘section 
3552(b)’’. 
(H) NATIONAL
INSTITUTE
OF
STANDARDS 
AND TECHNOLOGY ACT.—Section 20 of the Na-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
tional Institute of Standards and Technology Act 
(15 U.S.C. 278g–3) is amended— 
(i) in subsection (a)(2), by striking 
‘‘section 3552(b)(6)’’ and inserting ‘‘section 
3552(b)’’; and 
(ii) in subsection (f)— 
(I) in paragraph (2), by striking 
‘‘section 3532(1)’’ and inserting ‘‘sec-
tion 3552(b)’’; and 
(II) in paragraph (5), by striking 
‘‘section 3532(b)(2)’’ and inserting 
‘‘section 3552(b)’’. 
(c) SUBCHAPTER II AMENDMENTS.—Subchapter II of 
chapter 35 of title 44, United States Code, is amended— 
(1) in section 3551— 
(A) in paragraph (4), by striking ‘‘diagnose 
and improve’’ and inserting ‘‘integrate, deliver, 
diagnose, and improve’’; 
(B) in paragraph (5), by striking ‘‘and’’ at 
the end; 
(C) in paragraph (6), by striking the period 
at the end and inserting a semicolon; and 
(D) by adding at the end the following: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(7) recognize that each agency has specific mis-
sion requirements and, at times, unique cybersecurity 
requirements to meet the mission of the agency; 
‘‘(8) recognize that each agency does not have the 
same resources to secure agency systems, and an agen-
cy should not be expected to have the capability to se-
cure the systems of the agency from advanced adver-
saries alone; and 
‘‘(9) recognize that a holistic Federal cybersecu-
rity model is necessary to account for differences be-
tween the missions and capabilities of agencies.’’; 
(2) in section 3553— 
(A) in subsection (a)— 
(i) in paragraph (5), by striking 
‘‘and’’ at the end; 
(ii) in paragraph (6), by striking the 
period at the end and inserting ‘‘; and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
‘‘(7) promoting, in consultation with the Direc-
tor of the Cybersecurity and Infrastructure Security 
Agency, the National Cyber Director, and the Director 
of the National Institute of Standards and Tech-
nology— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(A) the use of automation to improve Fed-
eral cybersecurity and visibility with respect to 
the implementation of Federal cybersecurity; and 
‘‘(B) the use of presumption of compromise 
and least privilege principles, such as zero trust 
architecture, to improve resiliency and timely re-
sponse actions to incidents on Federal systems.’’; 
(B) in subsection (b)— 
(i) in the matter preceding paragraph 
(1), by inserting ‘‘and the National Cyber 
Director’’ after ‘‘Director’’; 
(ii) in paragraph (2)(A), by inserting 
‘‘and reporting requirements under sub-
chapter IV of this chapter’’ after ‘‘section 
3556’’; 
(iii) by redesignating paragraphs (8) 
and (9) as paragraphs (10) and (11), re-
spectively; and 
(iv) by inserting after paragraph (7) 
the following: 
‘‘(8) expeditiously seeking opportunities to re-
duce costs, administrative burdens, and other barriers 
to information technology security and modernization 
for agencies, including through shared services (and 
appropriate commercial off the shelf options for such 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
shared services) for cybersecurity capabilities identi-
fied as appropriate by the Director, in coordination 
with the Director of the Cybersecurity and Infrastruc-
ture Security Agency and other agencies as appro-
priate;’’; 
(C) in subsection (c)— 
(i) in the matter preceding paragraph 
(1)— 
(I) by striking ‘‘each year’’ and 
inserting ‘‘each year during which 
agencies are required to submit reports 
under section 3554(c)’’; 
(II) by inserting ‘‘, which shall be 
unclassified but may include 1 or more 
annexes that contain classified or other 
sensitive information, as appropriate’’ 
after ‘‘a report’’; and 
(III) by striking ‘‘preceding year’’ 
and inserting ‘‘preceding 2 years’’; 
(ii) by striking paragraph (1); 
(iii) by redesignating paragraphs (2), 
(3), and (4) as paragraphs (1), (2), and (3), 
respectively; 
(iv) in paragraph (3), as so redesig-
nated, by striking ‘‘and’’ at the end; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(v) by inserting after paragraph (3), 
as so redesignated, the following: 
‘‘(4) a summary of the risks and trends identi-
fied in the Federal risk assessment required under 
subsection (i); and’’; 
(D) in subsection (h)— 
(i) in paragraph (2)— 
(I) in subparagraph (A), by in-
serting ‘‘and the National Cyber Direc-
tor’’ after ‘‘in coordination with the 
Director’’; 
(II) in subparagraph (B), by in-
serting ‘‘, the scope of the required ac-
tion (such as applicable software, 
firmware, or hardware versions),’’ after 
‘‘reasons for the required action’’; and 
(III) in subparagraph (D), by in-
serting ‘‘, the National Cyber Direc-
tor,’’ after ‘‘notify the Director’’; and 
(ii) in paragraph (3)(A)(iv), by insert-
ing ‘‘, the National Cyber Director’’ after 
‘‘the Secretary provides prior notice to the 
Director’’; 
(E) by amending subsection (i) to read as 
follows: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(i) FEDERAL RISK ASSESSMENT.—On an ongoing 
and continual basis, the Director of the Cybersecurity and 
Infrastructure Security Agency shall assess the Federal risk 
posture using any available information on the cybersecu-
rity posture of agencies, and brief the Director and National 
Cyber Director on the findings of such assessment, includ-
ing— 
‘‘(1) the status of agency cybersecurity remedial 
actions for high value assets described in section 
3554(b)(7); 
‘‘(2) any vulnerability information relating to 
the systems of an agency that is known by the agency; 
‘‘(3) analysis of incident information under sec-
tion 3597; 
‘‘(4) evaluation of penetration testing performed 
under section 3559A; 
‘‘(5) evaluation of vulnerability disclosure pro-
gram information under section 3559B; 
‘‘(6) evaluation of agency threat hunting results; 
‘‘(7) evaluation of Federal and non-Federal cyber 
threat intelligence; 
‘‘(8) data on agency compliance with standards 
issued under section 11331 of title 40; 
‘‘(9) agency system risk assessments required 
under section 3554(a)(1)(A); 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(10) relevant reports from inspectors general of 
agencies and the Government Accountability Office; 
and 
‘‘(11) any other information the Director of the 
Cybersecurity and Infrastructure Security Agency de-
termines relevant.’’; and 
(F) by adding at the end the following: 
‘‘(m) DIRECTIVES.— 
‘‘(1) EMERGENCY DIRECTIVE UPDATES.—If the 
Secretary issues an emergency directive under this 
section, the Director of the Cybersecurity and Infra-
structure Security Agency shall submit to the Direc-
tor, the National Cyber Director, the Committee on 
Homeland Security and Governmental Affairs of the 
Senate, and the Committees on Oversight and Ac-
countability and Homeland Security of the House of 
Representatives an update on the status of the imple-
mentation of the emergency directive at agencies not 
later than 7 days after the date on which the emer-
gency directive requires an agency to complete a re-
quirement specified by the emergency directive, and 
every 30 days thereafter until— 
‘‘(A) the date on which every agency has 
fully implemented the emergency directive; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) the Secretary determines that an emer-
gency directive no longer requires active report-
ing from agencies or additional implementation; 
or 
‘‘(C) the date that is 1 year after the 
issuance of the directive. 
‘‘(2) BINDING
OPERATIONAL
DIRECTIVE
UP-
DATES.—If the Secretary issues a binding operational 
directive under this section, the Director of the Cyber-
security and Infrastructure Security Agency shall 
submit to the Director, the National Cyber Director, 
the Committee on Homeland Security and Govern-
mental Affairs of the Senate, and the Committees on 
Oversight and Accountability and Homeland Security 
of the House of Representatives an update on the sta-
tus of the implementation of the binding operational 
directive at agencies not later than 30 days after the 
issuance of the binding operational directive, and 
every 90 days thereafter until— 
‘‘(A) the date on which every agency has 
fully implemented the binding operational direc-
tive; 
‘‘(B) the Secretary determines that a bind-
ing operational directive no longer requires ac-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
tive reporting from agencies or additional imple-
mentation; or 
‘‘(C) the date that is 1 year after the 
issuance or substantive update of the directive. 
‘‘(3) REPORT.—If the Director of the Cybersecu-
rity and Infrastructure Security Agency ceases sub-
mitting updates required under paragraphs (1) or (2) 
on the date described in paragraph (1)(C) or (2)(C), 
the Director of the Cybersecurity and Infrastructure 
Security Agency shall submit to the Director, the Na-
tional Cyber Director, the Committee on Homeland 
Security and Governmental Affairs of the Senate, and 
the Committees on Oversight and Accountability and 
Homeland Security of the House of Representatives a 
list of every agency that, at the time of the report— 
‘‘(A) has not completed a requirement speci-
fied by an emergency directive; or 
‘‘(B) has not implemented a binding oper-
ational directive. 
‘‘(n) REVIEW OF OFFICE OF MANAGEMENT AND BUDG-
ET GUIDANCE AND POLICY.— 
‘‘(1) CONDUCT OF REVIEW.—Not less frequently 
than once every 3 years, the Director of the Office of 
Management and Budget shall review the efficacy of 
the guidance and policy promulgated by the Director 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
in reducing cybersecurity risks, including a consider-
ation of reporting and compliance burden on agen-
cies. 
‘‘(2) CONGRESSIONAL
NOTIFICATION.—The Di-
rector of the Office of Management and Budget shall 
notify the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Com-
mittee on Oversight and Accountability of the House 
of Representatives of the results of the review under 
paragraph (1). 
‘‘(3) GAO REVIEW.—The Government Account-
ability Office shall review guidance and policy pro-
mulgated by the Director to assess its efficacy in risk 
reduction and burden on agencies. 
‘‘(o) 
AUTOMATED
STANDARD
IMPLEMENTATION 
VERIFICATION.—When the Director of the National Insti-
tute of Standards and Technology issues a proposed stand-
ard or guideline pursuant to paragraphs (2) or (3) of sec-
tion 20(a) of the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3(a)), the Director of the Na-
tional Institute of Standards and Technology shall consider 
developing and, if appropriate and practical, develop speci-
fications to enable the automated verification of the imple-
mentation of the controls. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(p) INSPECTORS GENERAL ACCESS
TO FEDERAL 
RISK ASSESSMENTS.—The Director of the Cybersecurity 
and Infrastructure Security Agency shall, upon request, 
make available Federal risk assessment information under 
subsection (i) to the Inspector General of the Department 
of Homeland Security and the inspector general of any 
agency that was included in the Federal risk assessment.’’; 
(3) in section 3554— 
(A) in subsection (a)— 
(i) in paragraph (1)— 
(I) by redesignating subpara-
graphs (A), (B), and (C) as subpara-
graphs (B), (C), and (D), respectively; 
(II) by inserting before subpara-
graph (B), as so redesignated, the fol-
lowing: 
‘‘(A) on an ongoing and continual basis, as-
sessing agency system risk, as applicable, by— 
‘‘(i) identifying and documenting the 
high value assets of the agency using guid-
ance from the Director; 
‘‘(ii) evaluating the data assets inven-
toried under section 3511 for sensitivity to 
compromises in confidentiality, integrity, 
and availability; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(iii) identifying whether the agency is 
participating in federally offered cybersecu-
rity shared services programs; 
‘‘(iv) identifying agency systems that 
have access to or hold the data assets inven-
toried under section 3511; 
‘‘(v) evaluating the threats facing agen-
cy systems and data, including high value 
assets, based on Federal and non-Federal 
cyber threat intelligence products, where 
available; 
‘‘(vi) evaluating the vulnerability of 
agency systems and data, including high 
value assets, including by analyzing— 
‘‘(I) the results of penetration test-
ing performed by the Department of 
Homeland 
Security 
under 
section 
3553(b)(9); 
‘‘(II) the results of penetration 
testing performed under section 3559A; 
‘‘(III) information provided to the 
agency through the vulnerability dis-
closure program of the agency under 
section 3559B; 
‘‘(IV) incidents; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(V) any other vulnerability in-
formation relating to agency systems 
that is known to the agency; 
‘‘(vii) assessing the impacts of poten-
tial agency incidents to agency systems, 
data, and operations based on the evalua-
tions described in clauses (ii) and (v) and 
the agency systems identified under clause 
(iv); and 
‘‘(viii) assessing the consequences of po-
tential incidents occurring on agency sys-
tems that would impact systems at other 
agencies, including due to interconnectivity 
between different agency systems or oper-
ational reliance on the operations of the sys-
tem or data in the system;’’; 
(III) in subparagraph (B), as so 
redesignated, in the matter preceding 
clause (i), by striking ‘‘providing in-
formation’’ and inserting ‘‘using infor-
mation from the assessment required 
under subparagraph (A), providing in-
formation’’; 
(IV) in subparagraph (C), as so 
redesignated— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(aa) in clause (ii) by insert-
ing 
‘‘binding’’ 
before 
‘‘oper-
ational’’; and 
(bb) in clause (vi), by strik-
ing ‘‘and’’ at the end; 
(V) in subparagraph (D), as so 
redesignated, by inserting ‘‘and’’ after 
the semicolon at the end; and 
(VI) by adding at the end the fol-
lowing: 
‘‘(E) providing an update on the ongoing 
and continual assessment required under sub-
paragraph (A)— 
‘‘(i) upon request, to the inspector gen-
eral of the agency or the Comptroller Gen-
eral of the United States; and 
‘‘(ii) at intervals determined by guid-
ance issued by the Director, and to the ex-
tent appropriate and practicable using au-
tomation, to— 
‘‘(I) the Director; 
‘‘(II) the Director of the Cyberse-
curity and Infrastructure Security 
Agency; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(III) the National Cyber Direc-
tor;’’; 
(ii) in paragraph (2)— 
(I) in subparagraph (A), by in-
serting ‘‘in accordance with the agency 
system risk assessment required under 
paragraph (1)(A)’’ after ‘‘information 
systems’’; and 
(II) in subparagraph (D), by in-
serting ‘‘, through the use of penetra-
tion testing, the vulnerability disclo-
sure program established under section 
3559B, and other means,’’ after ‘‘peri-
odically’’; 
(iii) in paragraph (3)(A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘senior agency infor-
mation security officer’’ and inserting 
‘‘Chief Information Security Officer’’; 
(II) in clause (i), by striking ‘‘this 
section’’ and inserting ‘‘subsections (a) 
through (c)’’; 
(III) in clause (ii), by striking 
‘‘training and’’ and inserting ‘‘skills, 
training, and’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(IV) by redesignating clauses (iii) 
and (iv) as clauses (iv) and (v), respec-
tively; 
(V) by inserting after clause (ii) 
the following: 
‘‘(iii) manage information security, cy-
bersecurity budgets, and risk and compli-
ance activities and explain those concepts to 
the head of the agency and the executive 
team of the agency;’’; and 
(VI) in clause (iv), as so redesig-
nated, by striking ‘‘information secu-
rity duties as that official’s primary 
duty’’ and inserting ‘‘information, 
computer network, and technology se-
curity duties as the Chief Information 
Security Officers’ primary duty’’; 
(iv) in paragraph (5), by striking ‘‘an-
nually’’ and inserting ‘‘not less frequently 
than quarterly’’; and 
(v) in paragraph (6), by striking ‘‘offi-
cial delegated’’ and inserting ‘‘Chief Infor-
mation Security Officer delegated’’; 
(B) in subsection (b)— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(ii) notifying and consulting with the 
Federal information security incident center 
established under section 3556 pursuant to 
the requirements of section 3594;’’; 
(II) by redesignating clause (iii) 
as clause (iv); 
(III) by inserting after clause (ii) 
the following: 
‘‘(iii) performing the notifications and 
other activities required under subchapter 
IV of this chapter; and’’; and 
(IV) in clause (iv), as so redesig-
nated— 
(aa) in subclause (II), by 
adding ‘‘and’’ at the end; 
(bb) by striking subclause 
(III); and 
(cc) by redesignating sub-
clause (IV) as subclause (III); and 
(C) in subsection (c)— 
(i) by redesignating paragraph (2) as 
paragraph (4); 
(ii) by striking paragraph (1) and in-
serting the following: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(1) BIENNIAL REPORT.—Not later than 2 years 
after the date of enactment of the Federal Information 
Security Modernization Act of 2024 and not less fre-
quently than once every 2 years thereafter, using the 
ongoing and continual agency system risk assessment 
required under subsection (a)(1)(A), the head of each 
agency shall submit to the Director, the National 
Cyber Director, the Director of the Cybersecurity and 
Infrastructure Security Agency, the Comptroller Gen-
eral of the United States, the majority and minority 
leaders of the Senate, the Speaker and minority lead-
er of the House of Representatives, the Committee on 
Homeland Security and Governmental Affairs of the 
Senate, the Committee on Oversight and Account-
ability of the House of Representatives, the Committee 
on Homeland Security of the House of Representa-
tives, the Committee on Commerce, Science, and 
Transportation of the Senate, the Committee on 
Science, Space, and Technology of the House of Rep-
resentatives, and the appropriate authorization and 
appropriations committees of Congress a report 
that— 
‘‘(A) summarizes the agency system risk as-
sessment required under subsection (a)(1)(A); 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) evaluates the adequacy and effective-
ness of information security policies, procedures, 
and practices of the agency to address the risks 
identified in the agency system risk assessment 
required under subsection (a)(1)(A), including 
an analysis of the agency’s cybersecurity and in-
cident response capabilities using the metrics es-
tablished under section 224(c) of the Cybersecu-
rity Act of 2015 (6 U.S.C. 1522(c)); 
‘‘(C) summarizes the status of remedial ac-
tions identified by inspector general of the agen-
cy, the Comptroller General of the United States, 
and any other source determined appropriate by 
the head of the agency; and 
‘‘(D) includes the cybersecurity shared serv-
ices offered by the Cybersecurity and Infrastruc-
ture Security Agency that the agency partici-
pates in, if any, and explanations for any non- 
participation in such services. 
‘‘(2) UNCLASSIFIED REPORTS.—Each report sub-
mitted under paragraph (1)— 
‘‘(A) shall be, to the greatest extent prac-
ticable, in an unclassified and otherwise uncon-
trolled form; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) may include 1 or more annexes that 
contain classified or other sensitive information, 
as appropriate. 
‘‘(3) BRIEFINGS.—During each year during 
which a report is not required to be submitted under 
paragraph (1), the Director shall provide to the con-
gressional committees described in paragraph (1) a 
briefing summarizing current agency and Federal 
risk postures.’’; and 
(iii) in paragraph (4), as so redesig-
nated, by striking the period at the end and 
inserting ‘‘, including the reporting proce-
dures established under section 11315(d) of 
title 40 and subsection (a)(3)(A)(v) of this 
section.’’; 
(4) in section 3555— 
(A) in the section heading, by striking 
‘‘Annual 
independent’’ 
and 
inserting 
‘‘Independent’’; 
(B) in subsection (a)— 
(i) in paragraph (1), by inserting 
‘‘during which a report is required to be 
submitted under section 3553(c),’’ after 
‘‘Each year’’; 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(ii) in paragraph (2)(A), by inserting 
‘‘, including by performing, or reviewing 
the results of, agency penetration testing 
and analyzing the vulnerability disclosure 
program of the agency’’ after ‘‘information 
systems’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(3) An evaluation under this section may include rec-
ommendations for improving the cybersecurity posture of 
the agency.’’; 
(C) in subsection (b)(1), by striking ‘‘an-
nual’’; 
(D) in subsection (e)(1), by inserting ‘‘dur-
ing which a report is required to be submitted 
under section 3553(c)’’ after ‘‘Each year’’; 
(E) in subsection (g)(2)— 
(i) by striking ‘‘this subsection shall’’ 
and inserting ‘‘this subsection— 
‘‘(A) shall’’; 
(ii) in subparagraph (A), as so des-
ignated, by striking the period at the end 
and inserting ‘‘; and’’; and 
(iii) by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(B) identify any entity that performs an inde-
pendent evaluation under subsection (b).’’; 
(F) by striking subsection (j) and inserting 
the following: 
‘‘(j) GUIDANCE.— 
‘‘(1) IN GENERAL.—The Director, in consultation 
with the Director of the Cybersecurity and Infrastruc-
ture Security Agency, the Chief Information Officers 
Council, the Council of the Inspectors General on In-
tegrity and Efficiency, and other interested parties as 
appropriate, shall ensure the development of risk- 
based guidance for evaluating the effectiveness of an 
information security program and practices. 
‘‘(2) PRIORITIES.—The risk-based guidance de-
veloped under paragraph (1) shall include— 
‘‘(A) the identification of the most common 
successful threat patterns; 
‘‘(B) the identification of security controls 
that address the threat patterns described in sub-
paragraph (A); 
‘‘(C) any other security risks unique to Fed-
eral systems; and 
‘‘(D) any other element the Director deter-
mines appropriate.’’; and 
(G) by adding at the end the following: 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB