I 
116TH CONGRESS 
2D SESSION 
H. R. 8779 
To amend the Federal Cybersecurity Enhancement Act of 2015 to require 
Federal agencies to obtain exemptions from certain cybersecurity require-
ments in order to avoid compliance with those requirements, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 18, 2020 
Ms. UNDERWOOD introduced the following bill; which was referred to the 
Committee on Oversight and Reform 
A BILL 
To amend the Federal Cybersecurity Enhancement Act of 
2015 to require Federal agencies to obtain exemptions 
from certain cybersecurity requirements in order to avoid 
compliance with those requirements, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Cybersecurity 
Oversight Act of 2020’’. 
VerDate Sep 11 2014 
06:06 Nov 30, 2020
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8779.IH
H8779
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 2. FEDERAL CYBERSECURITY REQUIREMENTS. 
(a) EXEMPTION FROM FEDERAL REQUIREMENTS.— 
Section 225(b)(2) of the Federal Cybersecurity Enhance-
ment Act of 2015 (6 U.S.C. 1523(b)(2)) is amended to 
read as follows: 
‘‘(2) EXCEPTION.— 
‘‘(A) IN GENERAL.—A particular require-
ment under paragraph (1) shall not apply to an 
agency information system of an agency if— 
‘‘(i) with respect to the agency infor-
mation system, the head of the agency sub-
mits to the Director an application for an 
exemption from the particular requirement, 
in which the head of the agency personally 
certifies to the Director with particularity 
that— 
‘‘(I) operational requirements ar-
ticulated in the certification and re-
lated to the agency information sys-
tem would make it excessively burden-
some to implement the particular re-
quirement; 
‘‘(II) the particular requirement 
is not necessary to secure the agency 
information system or agency infor-
VerDate Sep 11 2014 
06:06 Nov 30, 2020
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8779.IH
H8779
pbinns on DSKJLVW7X2PROD with BILLS
mation stored on or transiting the 
agency information system; and 
‘‘(III) the agency has taken all 
necessary steps to secure the agency 
information system and agency infor-
mation stored on or transiting the 
agency information system; 
‘‘(ii) the head of the agency or the 
designee of the head of the agency has 
submitted the certification described in 
clause (i) to the appropriate congressional 
committees and any other congressional 
committee with jurisdiction over the agen-
cy; and 
‘‘(iii) the Director grants the exemp-
tion from the particular requirement. 
‘‘(B) DURATION OF EXEMPTION.— 
‘‘(i) IN
GENERAL.—An exemption 
granted under subparagraph (A) shall ex-
pire on the date that is 1 year after the 
date on which the Director grants the ex-
emption. 
‘‘(ii) RENEWAL.—Upon the expiration 
of an exemption granted to an agency 
under subparagraph (A), the head of the 
VerDate Sep 11 2014 
06:06 Nov 30, 2020
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8779.IH
H8779
pbinns on DSKJLVW7X2PROD with BILLS
agency may apply for an additional exemp-
tion.’’. 
(b) 
REPORT
ON
EXEMPTIONS.—Section 
3554(c)(1)(A) of title 44, United States Code, is amend-
ed— 
(1) in clause (iii), by striking ‘‘and’’ at the end; 
(2) by redesignating clause (iv) as clause (v); 
and 
(3) by inserting after clause (iii) the following: 
‘‘(iv) with respect to any exemptions 
the agency is granted by the Director of 
the Office of Management and Budget 
under section 225(b)(2) of the Federal Cy-
bersecurity Enhancement Act of 2015 (6 
U.S.C. 1523(b)(2)) that is effective on the 
date of submission of the report— 
‘‘(I) an identification of the par-
ticular requirements from which any 
agency information system (as defined 
in section 2210 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 660)) is 
exempted; and 
‘‘(II) for each requirement identi-
fied under subclause (I)— 
VerDate Sep 11 2014 
06:06 Nov 30, 2020
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8779.IH
H8779
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(aa) an identification of the 
agency information system de-
scribed in subclause (I) exempted 
from the requirement; and 
‘‘(bb) an estimate of the 
date on which the agency will be 
able to comply with the require-
ment; and’’. 
(c) EFFECTIVE DATE.—This Act and the amend-
ments made by this Act shall take effect on the date that 
is 1 year after the date of enactment of this Act. 
Æ 
VerDate Sep 11 2014 
06:06 Nov 30, 2020
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H8779.IH
H8779
pbinns on DSKJLVW7X2PROD with BILLS