H. R. 7776—1264 
‘‘(A) furnishing cybersecurity technical assistance to 
entities affected by cybersecurity risks to protect assets, 
mitigate vulnerabilities, and reduce impacts of cyber 
incidents; 
‘‘(B) identifying other entities that may be at risk of 
an incident and assessing risk to the same or similar 
vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks to a sector 
or region, including potential cascading effects, and devel-
oping courses of action to mitigate such risks; 
‘‘(D) facilitating information sharing and operational 
coordination with threat response; and 
‘‘(E) providing guidance on how best to utilize Federal 
resources and capabilities in a timely, effective manner 
to speed recovery from cybersecurity risks. 
‘‘(21) NATIONAL
SECURITY
SYSTEM.—The term ‘national 
security system’ has the meaning given the term in section 
11103 of title 40, United States Code. 
‘‘(22) 
RANSOMWARE
ATTACK.—The 
term 
‘ransomware 
attack’— 
‘‘(A) means an incident that includes the use or threat 
of use of unauthorized or malicious code on an information 
system, or the use or threat of use of another digital 
mechanism such as a denial of service attack, to interrupt 
or disrupt the operations of an information system or com-
promise the confidentiality, availability, or integrity of elec-
tronic data stored on, processed by, or transiting an 
information system to extort a demand for a ransom pay-
ment; and 
‘‘(B) does not include any such event in which the 
demand for payment is— 
‘‘(i) not genuine; or 
‘‘(ii) made in good faith by an entity in response 
to a specific request by the owner or operator of the 
information system. 
‘‘(23) SECTOR RISK MANAGEMENT AGENCY.—The term ‘Sector 
Risk Management Agency’ means a Federal department or 
agency, designated by law or Presidential directive, with 
responsibility for providing institutional knowledge and special-
ized expertise of a sector, as well as leading, facilitating, or 
supporting programs and associated activities of its designated 
critical infrastructure sector in the all hazards environment 
in coordination with the Department. 
‘‘(24) SECURITY
CONTROL.—The term ‘security control’ 
means the management, operational, and technical controls 
used to protect against an unauthorized effort to adversely 
affect the confidentiality, integrity, and availability of an 
information system or its information. 
‘‘(25) SECURITY VULNERABILITY.—The term ‘security vulner-
ability’ means any attribute of hardware, software, process, 
or procedure that could enable or facilitate the defeat of a 
security control. 
‘‘(26) SHARING.—The term ‘sharing’ (including all conjuga-
tions thereof) means providing, receiving, and disseminating 
(including all conjugations of each such terms). 
‘‘(27) SLTT ENTITY.—The term ‘SLTT entity’ means a 
domestic government entity that is a State government, local
H. R. 7776—1265 
government, Tribal government, territorial government, or any 
subdivision thereof. 
‘‘(28) SUPPLY CHAIN COMPROMISE.—The term ‘supply chain 
compromise’ means an incident within the supply chain of 
an information system that an adversary can leverage, or does 
leverage, to jeopardize the confidentiality, integrity, or avail-
ability of the information system or the information the system 
processes, stores, or transmits, and can occur at any point 
during the life cycle.’’. 
(2) 
TECHNICAL
AND
CONFORMING
AMENDMENTS.—The 
Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is 
amended— 
(A) in section 320(d)(3)(C) (6 U.S.C. 195f(d)(3)(C)), by 
striking ‘‘section 2201’’ and inserting ‘‘section 2200’’; 
(B) by amending section 2201 (6 U.S.C. 651) to read 
as follows: 
‘‘SEC. 2201. DEFINITION. 
‘‘In this subtitle, the term ‘Cybersecurity Advisory Committee’ 
means the advisory committee established under section 2219(a).’’; 
(C) in section 2202 (6 U.S.C. 652)— 
(i) in subsection (a)(1), by striking ‘‘(in this subtitle 
referred to as the Agency)’’; 
(ii) in subsection (b)(1), by striking ‘‘a Director 
of Cybersecurity and Infrastructure Security (in this 
subtitle referred to as the ‘Director’)’’ and inserting 
‘‘the Director’’; and 
(iii) in subsection (f)— 
(I) in paragraph (1), by inserting ‘‘Executive’’ 
before ‘‘Assistant Director’’; 
(II) in paragraph (2), by inserting ‘‘Executive’’ 
before ‘‘Assistant Director’’; and 
(III) in paragraph (3), by inserting ‘‘Executive’’ 
before ‘‘Assistant Director’’; 
(D) in section 2209 (6 U.S.C. 659)— 
(i) by striking subsection (a) and inserting the 
following: 
‘‘(a) DEFINITION.—The term ‘cybersecurity vulnerability’ has the 
meaning given the term ‘security vulnerability’ in section 2200.’’; 
(ii) in subsection (b), by inserting ‘‘Executive’’ 
before ‘‘Assistant Director for Cybersecurity’’; 
(iii) in subsection (d)(1)— 
(I) in subparagraph (A)(iii), by striking ‘‘, as 
that term is defined under section 3(4) of the 
National Security Act of 1947 (50 U.S.C. 3003(4))’’; 
and 
(II) in subparagraph (B)(ii), by striking 
‘‘information sharing and analysis organizations’’ 
and inserting ‘‘Information Sharing and Analysis 
Organizations’’; 
(iv) in subsection (e)(1)(E)(ii)(II), by striking 
‘‘information sharing and analysis organizations’’ and 
inserting ‘‘Information Sharing and Analysis Organiza-
tions’’;
H. R. 7776—1266 
(v) in the second subsection (p), by striking ‘‘(p) 
COORDINATION
ON CYBERSECURITY
FOR SLTT ENTI-
TIES.—’’ and inserting ‘‘(r) COORDINATION ON CYBERSE-
CURITY FOR SLTT ENTITIES.—’’; and 
(vi) in the second subsection (q), by striking ‘‘(q) 
REPORT.—’’ and inserting ‘‘(s) REPORT.—’’; 
(E) in section 2210 (6 U.S.C. 660)— 
(i) in subsection (a), by striking ‘‘section—’’ and 
all that follows and inserting ‘‘section, the term ‘agency 
information system’ means an information system used 
or operated by an agency or by another entity on 
behalf of an agency.’’; 
(ii) in subsection (c)— 
(I) by striking ‘‘information sharing and anal-
ysis organizations (as defined in section 2222(5))’’ 
and inserting ‘‘Information Sharing and Analysis 
Organizations’’; and 
(II) by striking ‘‘(as defined in section 2209)’’; 
and 
(iii) in subsection (e)— 
(I) in paragraph (1)(B), by striking ‘‘(as such 
term is defined in section 2209)’’; and 
(II) in paragraph (3)(C), by striking ‘‘(as such 
term is defined in section 102 of the Cybersecurity 
Information Sharing Act of 2015 (6 U.S.C. 1501))’’; 
(F) in section 2211 (6 U.S.C. 661), by striking sub-
section (h); 
(G) in section 2212 (6 U.S.C. 662), by striking ‘‘informa-
tion sharing and analysis organizations (as defined in sec-
tion 2222(5))’’ and inserting ‘‘Information Sharing and Anal-
ysis Organizations’’; 
(H) in section 2213(a) (6 U.S.C. 663(a)), by striking 
paragraph (4); and 
(I) in section 2216 (6 U.S.C. 665b)— 
(i) in subsection (d)(2), by striking ‘‘information 
sharing and analysis organizations’’ and inserting 
‘‘Information Sharing and Analysis Organizations’’; and 
(ii) in subsection (f), by striking ‘‘section:’’ and all 
that follows and inserting ‘‘section, the term ‘cyber 
defense operation’ means the defensive activities per-
formed for a cybersecurity purpose.’’; 
(J) in section 2218(c)(4)(A) (6 U.S.C. 665d(4)(A)), by 
striking ‘‘information sharing and analysis organizations’’ 
and inserting ‘‘Information Sharing and Analysis Organiza-
tions’’; 
(K) in section 2220A (6 U.S.C. 665g)— 
(i) in subsection (a)— 
(I) by striking paragraphs (1), (2), (5), (6), and 
(7); and 
(II) by redesignating paragraphs (3), (4), (8), 
(9), (10), (11), and (12) as paragraphs (1) through 
(7), respectively; 
(ii) in subsection (e)(2)(B)(xiv)(II)(aa), by striking 
‘‘information sharing and analysis organization’’ and 
inserting ‘‘Information Sharing and Analysis Organiza-
tion’’;
H. R. 7776—1267 
(iii) in subsection (p), by striking ‘‘appropriate 
committees of Congress’’ and inserting ‘‘appropriate 
congressional committees’’; and 
(iv) in subsection (q)(4), in the matter preceding 
clause (i), by striking ‘‘appropriate committees of Con-
gress’’ 
and 
inserting 
‘‘appropriate 
congressional 
committees’’; 
(L) in section 2220C (6 U.S.C. 665i), by striking sub-
section (f) and inserting the following: 
‘‘(f) DEFINITION.—In this section, the term ‘industrial control 
system’ means an information system used to monitor and/or control 
industrial processes such as manufacturing, product handling, 
production, and distribution, including supervisory control and data 
acquisition (SCADA) systems used to monitor and/or control geo-
graphically dispersed assets, distributed control systems (DCSs), 
Human-Machine Interfaces (HMIs), and programmable logic 
controllers that control localized processes.’’; 
(M) in section 2222 (6 U.S.C. 671)— 
(i) by striking paragraph (3) and inserting the 
following: 
‘‘(3) CRITICAL
INFRASTRUCTURE
INFORMATION.—The term 
‘critical infrastructure information’ has the meaning given the 
term in section 2200.’’; 
(ii) by striking paragraphs (5) and (8); and 
(iii) by redesignating paragraphs (6) and (7) as 
paragraphs (5) and (6), respectively; and 
(N) in section 2240 (6 U.S.C. 681)— 
(i) by striking paragraph (2); 
(ii) by redesignating paragraphs (3) through (7) 
as paragraphs (2) through (6); 
(iii) in paragraph (6), as so redesignated, by 
striking ‘‘section 2201’’ and inserting ‘‘section 2200’’; 
(iv) by striking paragraph (8), and inserting the 
following: 
‘‘(7) FEDERAL ENTITY.—The term ‘Federal entity’ has the 
meaning given the term in section 102 of the Cybersecurity 
Information Sharing Act of 2015 (6 U.S.C. 1501).’’; 
(v) by striking paragraphs (9) through (12), (14), 
(15), and (17); and 
(vi) by redesignating paragraphs (13), (16), (18), 
and (19) as paragraphs (8), (9), (10), and (11), respec-
tively. 
(3) TABLE OF CONTENTS AMENDMENTS.—The table of con-
tents in section 1(b) of the Homeland Security Act of 2002 
(Public Law 107–296; 116 Stat. 2135) is amended— 
(A) by inserting before the item relating to subtitle 
A of title XXII the following: 
‘‘Sec. 2200. Definitions.’’; 
(B) by striking the item relating to section 2201 and 
insert the following: 
‘‘Sec. 2201. Definition.’’; and 
(C) by moving the item relating to section 2220D to 
appear after the item relating to section 2220C. 
(4) CYBERSECURITY
INFORMATION
SHARING
ACT
OF
2015 
DEFINITIONS.—Section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501) is amended—
H. R. 7776—1268 
(A) by striking paragraphs (4) through (7) and inserting 
the following: 
‘‘(4) CYBERSECURITY
PURPOSE.—The term ‘cybersecurity 
purpose’ has the meaning given the term in section 2200 of 
the Homeland Security Act of 2002. 
‘‘(5) CYBERSECURITY
THREAT.—The term ‘cybersecurity 
threat’ has the meaning given the term in section 2200 of 
the Homeland Security Act of 2002. 
‘‘(6) CYBER
THREAT
INDICATOR.—The term ‘cyber threat 
indicator’ has the meaning given the term in section 2200 
of the Homeland Security Act of 2002. 
‘‘(7) DEFENSIVE MEASURE.—The term ‘defensive measure’ 
has the meaning given the term in section 2200 of the Home-
land Security Act of 2002.’’; 
(B) by striking paragraph (9) and inserting the fol-
lowing: 
‘‘(9) INFORMATION SYSTEM.—The term ‘information system’ 
has the meaning given the term in section 2200 of the Home-
land Security Act of 2002.’’. 
(C) by striking paragraphs (11), (12), and (13) and 
inserting the following: 
‘‘(11) MALICIOUS CYBER COMMAND AND CONTROL.—The term 
‘malicious cyber command and control’ has the meaning given 
the term in section 2200 of the Homeland Security Act of 
2002. 
‘‘(12) MALICIOUS
RECONNAISSANCE.—The term ‘malicious 
reconnaissance’ has the meaning given the term in section 
2200 of the Homeland Security Act of 2002. 
‘‘(13) MONITOR.— The term ‘monitor’ has the meaning given 
the term in section 2200 of the Homeland Security Act of 
2002.’’; and 
(D) by striking paragraphs (16) and (17) and inserting 
the following: 
‘‘(16) SECURITY CONTROL.—The term ‘security control’ has 
the meaning given the term in section 2200 of the Homeland 
Security Act of 2002. 
‘‘(17) SECURITY VULNERABILITY.—The term ‘security vulner-
ability’ has the meaning given the term in section 2200 of 
the Homeland Security Act of 2002.’’. 
(c) CORRECTION TO THE TITLE OF THE DIRECTOR OF THE CYBER-
SECURITY AND INFRASTRUCTURE SECURITY AGENCY.—The Homeland 
Security Act of 2002 (6 U.S.C. 101 et seq.) is amended— 
(1) in section 523 (6 U.S.C. 3211)— 
(A) in subsection (a), in the matter preceding paragraph 
(1), by striking ‘‘Director of Cybersecurity and Infrastruc-
ture Security’’ and inserting ‘‘Director of the Cybersecurity 
and Infrastructure Security Agency’’; and 
(B) in subsection (c), by striking ‘‘Director of Cybersecu-
rity and Infrastructure Security’’ and inserting ‘‘Director 
of the Cybersecurity and Infrastructure Security Agency’’; 
(2) in section 884(d)(4)(A)(ii) (6 U.S.C. 464(d)(4)(A)(ii)), by 
striking ‘‘Director of Cybersecurity and Infrastructure Security’’ 
and inserting ‘‘Director of the Cybersecurity and Infrastructure 
Security Agency’’; 
(3) in section 1801(b) (6 U.S.C. 571(b)), in the second and 
third sentences, by striking ‘‘Director of Cybersecurity and
H. R. 7776—1269 
Infrastructure Security’’ and inserting ‘‘Director of the Cyberse-
curity and Infrastructure Security Agency’’; 
(4) in section 2104(c)(2) (6 U.S.C. 624(c)(2)), by striking 
‘‘Director of Cybersecurity and Infrastructure Security’’ and 
inserting ‘‘Director of the Cybersecurity and Infrastructure 
Security Agency’’; 
(5) in section 2202 (6 U.S.C. 652)— 
(A) in subsection (b)(3), by striking ‘‘Director of Cyber-
security and Infrastructure Security of the Department’’ 
and inserting ‘‘Director of the Cybersecurity and Infrastruc-
ture Security Agency’’; and 
(B) in subsection (d), in the matter preceding para-
graph (1), by striking ‘‘Director of Cybersecurity and Infra-
structure Security’’ and inserting ‘‘Director of the Cyberse-
curity and Infrastructure Security Agency’’; 
(6) in section 2205, in the matter preceding paragraph 
(1), by striking ‘‘Director of Cybersecurity and Infrastructure 
Security’’ and inserting ‘‘Director of the Cybersecurity and 
Infrastructure Security Agency’’; 
(7) in section 2206, by striking ‘‘Director of Cybersecurity 
and Infrastructure Security’’ and inserting ‘‘Director of the 
Cybersecurity and Infrastructure Security Agency’’; and 
(8) in section 2210(c), by striking ‘‘Director of Cybersecurity 
and Infrastructure Security’’ and inserting ‘‘Director of the 
Cybersecurity and Infrastructure Security Agency’’. 
(d) ADDITIONAL TECHNICAL AND CONFORMING AMENDMENTS.— 
(1) FEDERAL CYBERSECURITY ENHANCEMENT ACT OF 2015.— 
The Federal Cybersecurity Enhancement Act of 2015 (6 U.S.C. 
1521 et seq.) is amended— 
(A) in section 222(4) (6 U.S.C. 1521(4)), by striking 
‘‘section 2209’’ and inserting ‘‘section 2200’’; and 
(B) in section 226(a)(2) (6 U.S.C. 1524(a)(2)), by striking 
‘‘section 102’’ and inserting ‘‘section 2200 of the Homeland 
Security Act of 2002’’. 
(2) FEDERAL POWER ACT.—Section 219A(a)(1) of the Federal 
Power Act (16 U.S.C. 824s–1(a)(1)) is amended by striking 
‘‘section 102 of the Cybersecurity Act of 2015 (6 U.S.C. 1501)’’ 
and inserting ‘‘section 2200 of the Homeland Security Act of 
2002’’. 
(3) INFRASTRUCTURE INVESTMENT AND JOBS ACT.—Section 
40124(a)(1) of the Infrastructure Investment and Jobs Act (42 
U.S.C. 18723(a)(1)) is amended by striking ‘‘section 102 of the 
Cybersecurity Act of 2015 (6 U.S.C. 1051)’’ and inserting ‘‘sec-
tion 2200 of the Homeland Security Act of 2002)’’. 
(4) PUBLIC HEALTH SERVICE ACT.—Section 2811(b)(4)(D) of 
the Public Health Service Act (42 U.S.C. 300hh–10(b)(4)(D)) 
is amended by striking ‘‘section 228(c) of the Homeland Security 
Act of 2002 (6 U.S.C. 149(c))’’ and inserting ‘‘section 2210(b) 
of the Homeland Security Act of 2002 (6 U.S.C. 660(b))’’. 
(5) WILLIAM
M. (MAC)
THORNBERRY
NATIONAL
DEFENSE 
AUTHORIZATION ACT OF FISCAL YEAR 2021.—Section 9002 of the 
William M. (Mac) Thornberry National Defense Authorization 
Act for Fiscal Year 2021 (6 U.S.C. 652a) is amended— 
(A) in subsection (a)— 
(i) by striking paragraph (5); 
(ii) by redesignating paragraphs (6) and (7) as 
paragraphs (5) and (6), respectively; and
H. R. 7776—1270 
(iii) by amending paragraph (7) to read as follows: 
‘‘(7) SECTOR RISK MANAGEMENT AGENCY.—The term ‘Sector 
Risk Management Agency’ has the meaning given the term 
in section 2200 of the Homeland Security Act of 2002.’’; 
(B) in subsection (c)(3)(B), by striking ‘‘given such term 
in section 2201(5) (6 U.S.C. 651(5))’’ and inserting ‘‘given 
such term in section 2200’’; and 
(C) in subsection (d), by striking ‘‘section 2215 of the 
Homeland Security Act of 2002, as added by this section’’ 
and inserting ‘‘section 2218 of the Homeland Security Act 
of 2002 (6 U.S.C. 665d)’’. 
(6) NATIONAL SECURITY ACT OF 1947.—Section 113B(b)(4) 
of the National Security Act of 1947 (50 U.S.C. 3049a(b)(4)) 
is amended by striking section ‘‘226 of the Homeland Security 
Act of 2002 (6 U.S.C. 147)’’ and inserting ‘‘section 2208 of 
the Homeland Security Act of 2002 (6 U.S.C. 658)’’. 
(7) NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 
2020.—Section 6503(a)(3) of the National Defense Authorization 
Act for Fiscal Year 2020 (50 U.S.C. 3371a(a)(3)) is amended 
by striking ‘‘section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501)’’ and inserting ‘‘section 
2200 of the Homeland Security Act of 2002’’. 
(8) IOT CYBERSECURITY IMPROVEMENT ACT OF 2020.—Section 
3(8) of the IoT Cybersecurity Improvement Act of 2020 (15 
U.S.C. 278g-3a(8)) is amended by striking ‘‘section 102(17) of 
the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 
1501(17))’’ and inserting ‘‘section 2200 of the Homeland Security 
Act of 2002’’. 
(9) SMALL BUSINESS ACT.—Section 21(a)(8)(B) of the Small 
Business Act (15 U.S.C. 648(a)(8)(B)) is amended by striking 
‘‘section 2209(a)’’ and inserting ‘‘section 2200’’. 
(10) TITLE 46.—Section 70101(2) of title 46, United States 
Code, is amended by striking ‘‘section 227 of the Homeland 
Security Act of 2002 (6 U.S.C. 148)’’ and inserting ‘‘section 
2200 of the Homeland Security Act of 2002’’. 
(e) CLARIFYING AND TECHNICAL AMENDMENTS TO THE CYBER 
INCIDENT REPORTING FOR CRITICAL INFRASTRUCTURE ACT OF 2022.— 
The Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is 
amended— 
(1) in section 2243(6 U.S.C. 681c), by striking subsection 
(c) and inserting the following: 
‘‘(c) APPLICATION OF SECTION 2245.—Section 2245 shall apply 
in the same manner and to the same extent to reports and informa-
tion submitted under subsections (a) and (b) as it applies to reports 
and information submitted under section 2242.’’; and 
(2) in section 2244(b)(2) (6 U.S.C. 681d(b)(2)), by inserting 
‘‘including that section 2245 shall apply to such information 
in the same manner and to the same extent to information 
submitted in response to requests under paragraph (1) as it 
applies to information submitted under section 2242’’after ‘‘sec-
tion 2242’’. 
(f) RULE OF CONSTRUCTION.— 
(1) INTERPRETATION OF TECHNICAL CORRECTIONS.—Nothing 
in the amendments made by subsections (a) through (d) shall 
be construed to alter the authorities, responsibilities, functions, 
or activities of any agency (as such term is defined in section 
3502 of title 44, United States Code) or officer or employee
H. R. 7776—1271 
of the United States on or before the date of enactment of 
this Act. 
(2) INTERPRETATION OF REFERENCES TO DEFINITIONS.—Any 
reference to a term defined in the Homeland Security Act 
of 2002 (6 U.S.C. 101 et seq.) on the day before the date 
of enactment of this Act that is defined in section 2200 of 
that Act pursuant to the amendments made under this Act 
shall be deemed to be a reference to that term as defined 
in section 2200 of the Homeland Security Act of 2002, as 
added by this Act. 
TITLE LXXII—GOVERNMENTAL AFFAIRS 
Subtitle A—Intragovernmental Cybersecurity Information Sharing Act 
Sec. 7201. Requirement for information sharing agreements. 
Subtitle A—Improving Government for America’s Taxpayers 
Sec. 7211. Government Accountability Office unimplemented priority recommenda-
tions. 
Subtitle B—Advancing American AI Act 
Sec. 7221. Short title. 
Sec. 7222. Purposes. 
Sec. 7223. Definitions. 
Sec. 7224. Principles and policies for use of artificial intelligence in Government. 
Sec. 7225. Agency inventories and artificial intelligence use cases. 
Sec. 7226. Rapid pilot, deployment and scale of applied artificial intelligence capa-
bilities to demonstrate modernization activities related to use cases. 
Sec. 7227. Enabling entrepreneurs and agency missions. 
Sec. 7228. Intelligence community exception. 
Subtitle C—Strategic EV Management 
Sec. 7231. Short Title. 
Sec. 7232. Definitions. 
Sec. 7233. Strategic guidance. 
Sec. 7234. Study of Federal fleet vehicles. 
Subtitle D—Congressionally Mandated Reports 
Sec. 7241. Short title. 
Sec. 7242. Definitions. 
Sec. 7243. Establishment of online portal for congressionally mandated reports. 
Sec. 7244. Federal agency responsibilities. 
Sec. 7245. Changing or removing reports. 
Sec. 7246. Withholding of information. 
Sec. 7247. Implementation. 
Sec. 7248. Determination of budgetary effects. 
Subtitle A—Intragovernmental 
Cybersecurity Information Sharing Act 
SEC. 7201. REQUIREMENT FOR INFORMATION SHARING AGREEMENTS. 
(a) SHORT
TITLE.—This section may be cited as the 
‘‘Intragovernmental Cybersecurity and Counterintelligence Informa-
tion Sharing Act’’. 
(b) FINDINGS.—Congress finds the following: 
(1) The legislative branch, as a separate and equal branch 
of the United States Government, is a target of adversary 
cyber actors and intelligence services. 
(2) The legislative branch relies on the executive branch 
to provide timely and urgent tactical and operational informa-
tion to ensure that Congress can protect the constitutional
H. R. 7776—1272 
officers, personnel, and facilities of Congress and the institution 
of Congress more broadly. 
(3) The legislative branch currently is not receiving this 
information in a timely manner nor as a matter of course. 
(c) DEFINITIONS.—In this section— 
(1) the term ‘‘congressional leadership’’ means— 
(A) the Majority and Minority Leader of the Senate 
with respect to an agreement with the Sergeant at Arms 
and Doorkeeper of the Senate or the Secretary of the 
Senate; and 
(B) the Speaker and Minority Leader of the House 
of Representatives with respect to an agreement with the 
Chief Administrative Officer of the House of Representa-
tives or the Sergeant at Arms of the House of Representa-
tives; and 
(2) the terms ‘‘cybersecurity threat’’ and ‘‘security vulner-
ability’’ have the meanings given those terms in section 2200 
of the Homeland Security Act of 2002, as added by section 
5171 of this division. 
(d) REQUIREMENT.— 
(1) DESIGNATION.— 
(A) IN GENERAL.—Not later than 30 days after the 
date of enactment of this Act, the President shall des-
ignate— 
(i) an individual appointed by the President, by 
and with the advice and consent of the Senate, to 
serve as a single point of contact to the legislative 
branch on matters related to tactical and operational 
cybersecurity threats and security vulnerabilities; and 
(ii) an individual appointed by the President, by 
and with the advice and consent of the Senate, to 
serve as a single point of contact to the legislative 
branch on matters related to tactical and operational 
counterintelligence. 
(B) COORDINATION.—The individuals designated by the 
President under subparagraph (A) shall coordinate with 
appropriate Executive agencies (as defined in section 105 
of title 5, United States Code, including the Executive 
Office of the President) and appropriate officers in the 
executive branch in entering any agreement described in 
paragraph (2). 
(2) INFORMATION SHARING AGREEMENTS.— 
(A) IN GENERAL.—Not later than 90 days after the 
date of enactment of this Act, the individuals designated 
by the President under paragraph (1)(A) shall enter into 
1 or more information sharing agreements with— 
(i) the Sergeant at Arms and Doorkeeper of the 
Senate with respect to cybersecurity information 
sharing, subject to the approval of congressional leader-
ship and in consultation with the chairman and the 
ranking minority member of the Committee on Rules 
and Administration of the Senate; 
(ii) the Secretary of the Senate with respect to 
counterintelligence information sharing, subject to the 
approval of congressional leadership and in consulta-
tion with the chairman and ranking minority member
H. R. 7776—1273 
of the Committee on Rules and Administration of the 
Senate; 
(iii) the Chief Administrative Officer of the House 
of Representatives with respect to cybersecurity 
information sharing, subject to the approval of the 
chair of the Committee on House Administration of 
the House of Representatives and in consultation with 
the ranking minority member of the committee and 
congressional leadership; and 
(iv) the Sergeant at Arms of the House of Rep-
resentatives 
with 
respect 
to 
counterintelligence 
information sharing, subject to the approval of the 
chair of the Committee on House Administration of 
the House of Representatives and in consultation with 
the ranking minority member of the committee and 
congressional leadership. 
(B) PURPOSE.—The agreements described in subpara-
graph (A) shall establish procedures for timely sharing 
of tactical and operational cybersecurity threat and security 
vulnerability information and planned or ongoing counter-
intelligence operations or targeted collection efforts with 
the legislative branch. 
(3) IMPLEMENTATION.—Not less frequently than semiannu-
ally during the 3-year period beginning on the date of enact-
ment of this Act, the individuals designated by the President 
under paragraph (1)(A) shall meet with the officers referenced 
in clauses (i), (ii), (iii), and (iv) of paragraph (2)(A), the chairman 
and ranking minority member of the Committee on Homeland 
Security and Governmental Affairs of the Senate, with respect 
to an agreement with the Sergeant at Arms and Doorkeeper 
of the Senate, and the chair and ranking minority member 
of the Committee on Oversight and Reform of the House of 
Representatives, with respect to an agreement with the Chief 
Administrative Officer of the House of Representatives or the 
Sergeant at Arms of the House of Representatives, to ensure 
the agreements with such officers are being implemented in 
a manner consistent with applicable laws, including this Act. 
(e) ELEMENTS.— 
(1) IN GENERAL.—The parties to an information sharing 
agreement under subsection (d)(2) shall jointly develop such 
elements of the agreement as the parties find appropriate, 
which— 
(A) with respect to an agreement covered by subsection 
(d)(2)(A)(i) or (ii), shall, at a minimum, include the 
applicable elements specified in paragraph (2); and 
(B) with respect to an agreement covered by subsection 
(d)(2)(A)(iii) or (iv), may include the applicable elements 
specified in paragraph (2). 
(2) ELEMENTS SPECIFIED.—The elements specified in this 
paragraph are— 
(A) direct and timely sharing of technical indicators 
and contextual information on cyber threats and security 
vulnerabilities, and the means for such sharing; 
(B) direct and timely sharing of counterintelligence 
threats and vulnerabilities, including trends of counter-
intelligence activity, and the means for such sharing;
H. R. 7776—1274 
(C) identification, by position, of the officials at the 
operational and tactical level responsible for daily manage-
ment of the agreement; 
(D) the ability to seat cybersecurity personnel of the 
Office of the Sergeant at Arms and Doorkeeper of the 
Senate or the Office of the Chief Administrative Officer 
of the House of Representatives at cybersecurity operations 
centers within the executive branch; and 
(E) any other elements the parties find appropriate. 
Subtitle A—Improving Government for 
America’s Taxpayers 
SEC. 7211. GOVERNMENT ACCOUNTABILITY OFFICE UNIMPLEMENTED 
PRIORITY RECOMMENDATIONS. 
(a) IN GENERAL.—The Comptroller General of the United States 
shall, as part of the Comptroller General’s annual reporting to 
committees of Congress— 
(1) consolidate Matters for Congressional Consideration 
from the Government Accountability Office in one report orga-
nized by policy topic that includes the amount of time such 
Matters have been unimplemented and submit such report 
to congressional leadership and the oversight committees of 
each House; 
(2) with respect to the annual letters sent by the Comp-
troller General to individual agency heads and relevant congres-
sional committees on the status of unimplemented priority rec-
ommendations, identify any additional congressional oversight 
actions that can help agencies implement such priority rec-
ommendations and address any underlying issues relating to 
such implementation; 
(3) make publicly available the information described in 
paragraphs (1) and (2); and 
(4) publish any known costs of unimplemented priority 
recommendations, if applicable. 
(b) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to require reporting relating to unimplemented priority 
recommendations or any other report, recommendation, information, 
or item relating to any element of the intelligence community, 
as defined in section 3 of the National Security Act of 1947 (50 
U.S.C. 3003). 
Subtitle B—Advancing American AI Act 
SEC. 7221. SHORT TITLE. 
This subtitle may be cited as the ‘‘Advancing American AI 
Act’’. 
SEC. 7222. PURPOSES. 
The purposes of this subtitle are to— 
(1) encourage agency artificial intelligence-related pro-
grams and initiatives that enhance the competitiveness of the 
United States and foster an approach to artificial intelligence 
that builds on the strengths of the United States in innovation 
and entrepreneurialism;
H. R. 7776—1275 
(2) enhance the ability of the Federal Government to trans-
late research advances into artificial intelligence applications 
to modernize systems and assist agency leaders in fulfilling 
their missions; 
(3) promote adoption of modernized business practices and 
advanced technologies across the Federal Government that 
align with the values of the United States, including the protec-
tion of privacy, civil rights, and civil liberties; and 
(4) test and harness applied artificial intelligence to 
enhance mission effectiveness, agency program integrity, and 
business practice efficiency. 
SEC. 7223. DEFINITIONS. 
In this subtitle: 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given 
the term in section 3502 of title 44, United States Code. 
(2) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the Committee on Homeland Security and Govern-
mental Affairs of the Senate; 
(B) the Committee on Oversight and Reform of the 
House of Representatives; and 
(C) the Committee on Homeland Security of the House 
of Representatives. 
(3) ARTIFICIAL INTELLIGENCE.—The term ‘‘artificial intel-
ligence’’ has the meaning given the term in section 238(g) 
of the John S. McCain National Defense Authorization Act 
for Fiscal Year 2019 (10 U.S.C. 2358 note). 
(4) ARTIFICIAL INTELLIGENCE SYSTEM.—The term ‘‘artificial 
intelligence system’’— 
(A) means any data system, software, application, tool, 
or utility that operates in whole or in part using dynamic 
or static machine learning algorithms or other forms of 
artificial intelligence, whether— 
(i) the data system, software, application, tool, or 
utility is established primarily for the purpose of 
researching, developing, or implementing artificial 
intelligence technology; or 
(ii) artificial intelligence capability is integrated 
into another system or agency business process, oper-
ational activity, or technology system; and 
(B) does not include any common commercial product 
within which artificial intelligence is embedded, such as 
a word processor or map navigation system. 
(5) DEPARTMENT.—The term ‘‘Department’’ means the 
Department of Homeland Security. 
(6) DIRECTOR.—The term ‘‘Director’’ means the Director 
of the Office of Management and Budget. 
SEC. 7224. PRINCIPLES AND POLICIES FOR USE OF ARTIFICIAL INTEL-
LIGENCE IN GOVERNMENT. 
(a) GUIDANCE.—The Director shall, when developing the guid-
ance required under section 104(a) of the AI in Government Act 
of 2020 (title I of division U of Public Law 116–260), consider— 
(1) the considerations and recommended practices identified 
by the National Security Commission on Artificial Intelligence 
in the report entitled ‘‘Key Considerations for the Responsible 
Development and Fielding of AI’’, as updated in April 2021;
H. R. 7776—1276 
(2) the principles articulated in Executive Order 13960 
(85 Fed. Reg. 78939; relating to promoting the use of trust-
worthy artificial intelligence in Government); and 
(3) the input of— 
(A) the Administrator of General Services; 
(B) relevant interagency councils, such as the Federal 
Privacy Council, the Chief Financial Officers Council, the 
Chief Information Officers Council, and the Chief Data 
Officers Council; 
(C) other governmental and nongovernmental privacy, 
civil rights, and civil liberties experts; 
(D) academia; 
(E) industry technology and data science experts; and 
(F) any other individual or entity the Director deter-
mines to be appropriate. 
(b) DEPARTMENT POLICIES AND PROCESSES FOR PROCUREMENT 
AND USE
OF ARTIFICIAL INTELLIGENCE-ENABLED SYSTEMS.—Not 
later than 180 days after the date of enactment of this Act— 
(1) the Secretary of Homeland Security, with the participa-
tion of the Chief Procurement Officer, the Chief Information 
Officer, the Chief Privacy Officer, and the Officer for Civil 
Rights and Civil Liberties of the Department and any other 
person determined to be relevant by the Secretary of Homeland 
Security, shall issue policies and procedures for the Department 
related to— 
(A) the acquisition and use of artificial intelligence; 
and 
(B) considerations for the risks and impacts related 
to artificial intelligence-enabled systems, including associ-
ated data of machine learning systems, to ensure that 
full consideration is given to— 
(i) the privacy, civil rights, and civil liberties 
impacts of artificial intelligence-enabled systems; and 
(ii) security against misuse, degradation, or 
rending inoperable of artificial intelligence-enabled sys-
tems; and 
(2) the Chief Privacy Officer and the Officer for Civil Rights 
and Civil Liberties of the Department shall report to Congress 
on any additional staffing or funding resources that may be 
required to carry out the requirements of this subsection. 
(c) INSPECTOR GENERAL.—Not later than 180 days after the 
date of enactment of this Act, the Inspector General of the Depart-
ment shall identify any training and investments needed to enable 
employees of the Office of the Inspector General to continually 
advance their understanding of— 
(1) artificial intelligence systems; 
(2) best practices for governance, oversight, and audits 
of the use of artificial intelligence systems; and 
(3) how the Office of the Inspector General is using artificial 
intelligence to enhance audit and investigative capabilities, 
including actions to— 
(A) ensure the integrity of audit and investigative 
results; and 
(B) guard against bias in the selection and conduct 
of audits and investigations.
H. R. 7776—1277 
(d) ARTIFICIAL INTELLIGENCE HYGIENE
AND PROTECTION
OF 
GOVERNMENT INFORMATION, PRIVACY, CIVIL RIGHTS, AND CIVIL LIB-
ERTIES.— 
(1) ESTABLISHMENT.—Not later than 1 year after the date 
of enactment of this Act, the Director, in consultation with 
a working group consisting of members selected by the Director 
from appropriate interagency councils, shall develop an initial 
means by which to— 
(A) ensure that contracts for the acquisition of an 
artificial intelligence system or service— 
(i) align with the guidance issued to the head 
of each agency under section 104(a) of the AI in 
Government Act of 2020 (title I of division U of Public 
Law 116–260); 
(ii) address protection of privacy, civil rights, and 
civil liberties; 
(iii) address the ownership and security of data 
and other information created, used, processed, stored, 
maintained, disseminated, disclosed, or disposed of by 
a contractor or subcontractor on behalf of the Federal 
Government; and 
(iv) include considerations for securing the training 
data, algorithms, and other components of any artificial 
intelligence system against misuse, unauthorized alter-
ation, degradation, or rendering inoperable; and 
(B) address any other issue or concern determined 
to be relevant by the Director to ensure appropriate use 
and protection of privacy and Government data and other 
information. 
(2) CONSULTATION.—In developing the considerations under 
paragraph (1)(A)(iv), the Director shall consult with the Sec-
retary of Homeland Security, the Secretary of Energy, the 
Director of the National Institute of Standards and Technology, 
and the Director of National Intelligence. 
(3) REVIEW.—The Director— 
(A) should continuously update the means developed 
under paragraph (1); and 
(B) not later than 2 years after the date of enactment 
of this Act and not less frequently than every 2 years 
thereafter, shall update the means developed under para-
graph (1). 
(4) BRIEFING.—The Director shall brief the appropriate 
congressional committees— 
(A) not later than 90 days after the date of enactment 
of this Act and thereafter on a quarterly basis until the 
Director first implements the means developed under para-
graph (1); and 
(B) annually thereafter on the implementation of this 
subsection. 
(5) SUNSET.—This subsection shall cease to be effective 
on the date that is 5 years after the date of enactment of 
this Act. 
SEC. 7225. AGENCY INVENTORIES AND ARTIFICIAL INTELLIGENCE USE 
CASES. 
(a) INVENTORY.—Not later than 60 days after the date of enact-
ment of this Act, and continuously thereafter for a period of 5
H. R. 7776—1278 
years, the Director, in consultation with the Chief Information 
Officers Council, the Chief Data Officers Council, and other inter-
agency bodies as determined to be appropriate by the Director, 
shall require the head of each agency to— 
(1) prepare and maintain an inventory of the artificial 
intelligence use cases of the agency, including current and 
planned uses; 
(2) share agency inventories with other agencies, to the 
extent practicable and consistent with applicable law and policy, 
including those concerning protection of privacy and of sensitive 
law enforcement, national security, and other protected 
information; and 
(3) make agency inventories available to the public, in 
a manner determined by the Director, and to the extent prac-
ticable and in accordance with applicable law and policy, 
including those concerning the protection of privacy and of 
sensitive law enforcement, national security, and other pro-
tected information. 
(b) CENTRAL INVENTORY.—The Director is encouraged to des-
ignate a host entity and ensure the creation and maintenance 
of an online public directory to— 
(1) make agency artificial intelligence use case information 
available to the public and those wishing to do business with 
the Federal Government; and 
(2) identify common use cases across agencies. 
(c) SHARING.—The sharing of agency inventories described in 
subsection (a)(2) may be coordinated through the Chief Information 
Officers Council, the Chief Data Officers Council, the Chief Finan-
cial Officers Council, the Chief Acquisition Officers Council, or 
other interagency bodies to improve interagency coordination and 
information sharing for common use cases. 
(d) DEPARTMENT OF DEFENSE.—Nothing in this section shall 
apply to the Department of Defense. 
SEC. 7226. RAPID PILOT, DEPLOYMENT AND SCALE OF APPLIED 
ARTIFICIAL 
INTELLIGENCE 
CAPABILITIES 
TO 
DEM-
ONSTRATE MODERNIZATION ACTIVITIES RELATED TO 
USE CASES. 
(a) IDENTIFICATION OF USE CASES.—Not later than 270 days 
after the date of enactment of this Act, the Director, in consultation 
with the Chief Information Officers Council, the Chief Data Officers 
Council, the Chief Financial Officers Council, and other interagency 
bodies as determined to be appropriate by the Director, shall iden-
tify 4 new use cases for the application of artificial intelligence- 
enabled systems to support interagency or intra-agency moderniza-
tion initiatives that require linking multiple siloed internal and 
external data sources, consistent with applicable laws and policies, 
including those relating to the protection of privacy and of sensitive 
law enforcement, national security, and other protected information. 
(b) PILOT PROGRAM.— 
(1) PURPOSES.—The purposes of the pilot program under 
this subsection include— 
(A) to enable agencies to operate across organizational 
boundaries, coordinating between existing established pro-
grams and silos to improve delivery of the agency mission;