105 
SEC. 9. IMPLEMENTING ZERO TRUST ARCHITECTURE. 
(a) BRIEFINGS.—Not later than 1 year after the date 
of enactment of this Act, the Director shall provide to the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate and the Committees on Oversight and 
Accountability and Homeland Security of the House of 
Representatives a briefing on progress in increasing the in-
ternal defenses of agency systems, including— 
(1) shifting away from trusted networks to im-
plement security controls based on a presumption of 
compromise, including through the transition to zero 
trust architecture; 
(2) implementing principles of least privilege in 
administering information security programs; 
(3) limiting the ability of entities that cause in-
cidents to move laterally through or between agency 
systems; 
(4) identifying incidents quickly; 
(5) isolating and removing unauthorized entities 
from agency systems as quickly as practicable, ac-
counting for intelligence or law enforcement purposes; 
and 
(6) otherwise increasing the resource costs for en-
tities that cause incidents to be successful. 
(b) PROGRESS REPORT.—As a part of each report re-
quired to be submitted under section 3553(c) of title 44, 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
106 
United States Code, during the period beginning on the date 
that is 4 years after the date of enactment of this Act and 
ending on the date that is 10 years after the date of enact-
ment of this Act, the Director shall include an update on 
agency implementation of zero trust architecture, which 
shall include— 
(1) a description of steps agencies have com-
pleted, including progress toward achieving any re-
quirements issued by the Director, including the 
adoption of any models or reference architecture; 
(2) an identification of activities that have not 
yet been completed and that would have the most im-
mediate security impact; and 
(3) a schedule to implement any planned activi-
ties. 
(c) CLASSIFIED ANNEX.—Each update required under 
subsection (b) may include 1 or more annexes that contain 
classified or other sensitive information, as appropriate. 
(d) NATIONAL SECURITY SYSTEMS.— 
(1) BRIEFING.—Not later than 1 year after the 
date of enactment of this Act, the Secretary of Defense 
shall provide to the Committee on Homeland Security 
and Governmental Affairs of the Senate, the Com-
mittee on Oversight and Accountability of the House 
of Representatives, the Committee on Armed Services 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
107 
of the Senate, the Committee on Armed Services of the 
House of Representatives, the Select Committee on In-
telligence of the Senate, and the Permanent Select 
Committee on Intelligence of the House of Representa-
tives a briefing on the implementation of zero trust 
architecture with respect to national security systems. 
(2) PROGRESS REPORT.—Not later than the date 
on which each update is required to be submitted 
under subsection (b), the Secretary of Defense shall 
submit to the congressional committees described in 
paragraph (1) a progress report on the implementa-
tion of zero trust architecture with respect to national 
security systems. 
SEC. 10. AUTOMATION AND ARTIFICIAL INTELLIGENCE. 
(a) DEFINITION.—In this section, the term ‘‘informa-
tion system’’ has the meaning given the term in section 
3502 of title 44, United States Code. 
(b) USE OF ARTIFICIAL INTELLIGENCE.— 
(1) IN GENERAL.—As appropriate, the Director 
shall issue guidance on the use of artificial intel-
ligence by agencies to improve the cybersecurity of in-
formation systems. 
(2) CONSIDERATIONS.—The Director and head of 
each agency shall consider the use and capabilities of 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
108 
artificial intelligence systems in furtherance of the cy-
bersecurity of information systems. 
(3) REPORT.—Not later than 1 year after the 
date of enactment of this Act, and annually thereafter 
until the date that is 5 years after the date of enact-
ment of this Act, the Director shall submit to the ap-
propriate congressional committees a report on the 
use of artificial intelligence to further the cybersecu-
rity of information systems. 
(c) COMPTROLLER GENERAL REPORTS.— 
(1) IN GENERAL.—Not later than 2 years after 
the date of enactment of this Act, the Comptroller 
General of the United States shall submit to the ap-
propriate congressional committees a report on the 
risks to the privacy of individuals and the cybersecu-
rity of information systems associated with the use by 
Federal agencies of artificial intelligence systems or 
capabilities. 
(2) STUDY.—Not later than 2 years after the 
date of enactment of this Act, the Comptroller General 
of the United States shall perform a study, and sub-
mit to the Committees on Homeland Security and 
Governmental Affairs and Commerce, Science, and 
Transportation of the Senate and the Committees on 
Oversight and Accountability, Homeland Security, 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
109 
and Science, Space, and Technology of the House of 
Representatives a report, on the use of automation, 
artificial intelligence, including generative artificial 
intelligence, and machine-readable data across the 
Federal Government for cybersecurity purposes, in-
cluding— 
(A) the automated updating of cybersecurity 
tools, sensors, or processes employed by agencies 
under paragraphs (1), (5)(C), and (8)(B) of sec-
tion 3554(b) of title 44, United States Code, as 
amended by this Act; and 
(B) to combat social engineering attacks. 
SEC. 11. FEDERAL CYBERSECURITY REQUIREMENTS. 
(a) CODIFYING FEDERAL CYBERSECURITY REQUIRE-
MENTS IN TITLE 44.— 
(1) AMENDMENT TO FEDERAL CYBERSECURITY 
ENHANCEMENT ACT OF 2015.—Section 225 of the Fed-
eral Cybersecurity Enhancement Act of 2015 (6 
U.S.C. 1523) is amended by striking subsections (b) 
and (c). 
(2) TITLE 44.—Section 3554 of title 44, United 
States Code, as amended by this Act, is further 
amended by adding at the end the following: 
‘‘(f) SPECIFIC CYBERSECURITY REQUIREMENTS
AT 
AGENCIES.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
110 
‘‘(1) IN
GENERAL.—Consistent with policies, 
standards, guidelines, and directives on information 
security under this subchapter, and except as pro-
vided under paragraph (3), the head of each agency 
shall— 
‘‘(A) identify sensitive and mission critical 
data stored by the agency consistent with the in-
ventory required under section 3505(c); 
‘‘(B) assess access controls to the data de-
scribed in subparagraph (A), the need for readily 
accessible storage of the data, and the need of in-
dividuals to access the data; 
‘‘(C) encrypt or otherwise render indeci-
pherable to unauthorized users the data described 
in subparagraph (A) that is stored on or 
transiting agency information systems; 
‘‘(D) implement identity and access man-
agement systems to ensure the security of Federal 
information systems and protect agency records 
and data from fraud resulting from the mis-
representation of identity or identity theft, in-
cluding— 
‘‘(i) a single sign-on trusted identity 
platform for individuals accessing each pub-
lic website of the agency that requires, at a 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
111 
minimum, 
user 
authentication 
and 
verification services consistent with applica-
ble law and guidance issued by the Director 
of the Office of Management and Budget 
who shall consider any applicable standard 
or guideline developed by the National In-
stitute of Standards and Technology, which 
may be one developed by the Administrator 
of General Services in consultation with the 
Director of the Office of Management and 
Budget; and 
‘‘(ii) multi-factor authentication, con-
sistent with guidance issued by the Director 
of the Office of Management and Budget 
who shall consider any applicable standard 
or guideline developed by the National In-
stitute of Standards and Technology, for— 
‘‘(I) remote access to an informa-
tion system; and 
‘‘(II) each user account with ele-
vated privileges on an information sys-
tem. 
‘‘(2) PROHIBITION.— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
112 
‘‘(A) DEFINITION.—In this paragraph, the 
term ‘internet of things’ has the meaning given 
the term in section 3559B. 
‘‘(B) PROHIBITION.—Consistent with poli-
cies, standards, guidelines, and directives on in-
formation security under this subchapter, and 
except as provided under paragraph (3), the 
head of an agency may not procure, obtain, 
renew a contract to procure or obtain in any 
amount, notwithstanding section 1905 of title 41, 
or use an internet of things device if the Chief 
Information Officer of the agency determines 
during 
a 
review 
required 
under 
section 
11319(b)(1)(C) of title 40 of a contract for an 
internet of things device that the use of the device 
prevents compliance with the standards and 
guidelines developed under section 4 of the IoT 
Cybersecurity Improvement Act (15 U.S.C. 
278g–3b) with respect to the device. 
‘‘(3) EXCEPTIONS.— 
‘‘(A) IN GENERAL.—The requirements under 
subparagraphs (A), (B), (C), and (D)(ii) of 
paragraph (1) shall not apply to an information 
system for which the head of the agency, without 
delegation, has— 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
113 
‘‘(i) certified to the Director with par-
ticularity that— 
‘‘(I) operational requirements ar-
ticulated in the certification and re-
lated to the information system would 
make it excessively burdensome to im-
plement the cybersecurity requirement; 
‘‘(II) the cybersecurity require-
ment is not necessary to secure the in-
formation system or agency informa-
tion stored on or transiting it; and 
‘‘(III) the agency has taken all 
necessary steps to secure the informa-
tion system and agency information 
stored on or transiting it; and 
‘‘(ii) submitted the certification de-
scribed in clause (i) to the appropriate con-
gressional committees and the authorizing 
committees of the agency. 
‘‘(B) IDENTITY
MANAGEMENT
PLATFORM 
WAIVER.—The head of an agency shall be in 
compliance with the requirement under para-
graph (1)(D)(i) with respect to implementing a 
single-sign on trusted identity system or plat-
form other than one developed by the Adminis-
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
114 
trator of General Services as described under 
paragraph (1)(D)(i) if the head of the agency— 
‘‘(i) without delegation— 
‘‘(I) has certified to the Director 
that the alternative system or platform, 
including a procured system or plat-
form, conforms with applicable secu-
rity and privacy requirements of this 
subchapter and guidance issued by the 
Director, at least 30 days before use of 
the system or platform; or 
‘‘(II) with regard to a system or 
platform in use as of the date of enact-
ment of this subsection, the head of the 
agency provides such certification to 
the Director within 60 days after the 
date of enactment of this subsection; 
‘‘(ii) has received a written waiver 
from the Director in response to the request 
submitted under clause (i); and 
‘‘(iii) has submitted the certification 
described in clause (i) and the waiver de-
scribed clause (ii) to the appropriate con-
gressional committees and the authorizing 
committees of the agency. 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
115 
‘‘(4) DURATION OF CERTIFICATION.— 
‘‘(A) IN GENERAL.—A certification and cor-
responding exemption of an agency under para-
graph (3) shall expire on the date that is 4 years 
after the date on which the head of the agency 
submits the certification under paragraph (3). 
‘‘(B) RENEWAL.—Upon the expiration of a 
certification of an agency under paragraph (3), 
the head of the agency may submit an additional 
certification in accordance with that paragraph. 
‘‘(5) 
PRESUMPTION
OF
ADEQUACY.—A 
FedRAMP authorization issued pursuant to chapter 
36 of title 44 shall be presumed adequate to fulfill the 
requirements under subparagraphs (A) through (C) of 
paragraph (1) with respect to an agency authoriza-
tion to operate cloud computing products and services 
if such presumption of adequacy does not alter or 
modify— 
‘‘(A) the responsibility of any agency to en-
sure compliance with this subchapter for any 
cloud computing product or service used by the 
agency; or 
‘‘(B) the authority of the head of any agen-
cy to make a determination that there is a de-
monstrable need to include additional security 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB
121 
‘‘(1) the Office of the Federal Chief Information 
Officer of the Office of Management and Budget; and 
‘‘(2) the Office of the National Cyber Director. 
‘‘(b) APPOINTMENT.—The Federal Chief Information 
Security Officer shall be appointed by the President. 
‘‘(c) OMB DUTIES.—The Federal Chief Information 
Security Officer shall report to the Federal Chief Informa-
tion Officer and assist the Federal Chief Information Offi-
cer in carrying out— 
‘‘(1) every function under this chapter; 
‘‘(2) every function assigned to the Director 
under title II of the E–Government Act of 2002 (44 
U.S.C. 3501 note; Public Law 107–347); 
‘‘(3) other electronic government initiatives con-
sistent with other statutes; and 
‘‘(4) other Federal cybersecurity initiatives deter-
mined by the Federal Chief Information Officer. 
‘‘(d) ADDITIONAL DUTIES.—The Federal Chief Infor-
mation Security Officer shall— 
‘‘(1) support the Federal Chief Information Offi-
cer in overseeing and implementing Federal cyberse-
curity under the E–Government Act of 2002 (Public 
Law 107–347; 116 Stat. 2899) and other relevant 
statutes in a manner consistent with law; and 
VerDate Sep 11 2014 
06:39 Dec 20, 2024
Jkt 059200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6203
E:\BILLS\H4552.RH
H4552
kjohnson on DSK7ZCZBW3PROD with $$_JOB