I 
115TH CONGRESS 
2D SESSION 
H. R. 6638 
To promote transparency in the oversight of cybersecurity risks at publicly 
traded companies. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 27, 2018 
Mr. HIMES (for himself, Mr. THOMAS J. ROONEY of Florida, Mr. MEEKS, and 
Mr. HECK) introduced the following bill; which was referred to the Com-
mittee on Financial Services 
A BILL 
To promote transparency in the oversight of cybersecurity 
risks at publicly traded companies. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Disclo-
sure Act of 2018’’. 
SEC. 2. CYBERSECURITY TRANSPARENCY. 
(a) DEFINITIONS.—In this section— 
(1) the term ‘‘Commission’’ means the Securi-
ties and Exchange Commission; 
(2) the term ‘‘cybersecurity threat’’— 
VerDate Sep 11 2014 
01:51 Aug 14, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6638.IH
H6638
pamtmann on DSKBFK8HB2PROD with BILLS
(A) means an action, not protected by the 
First Amendment to the Constitution of the 
United States, on or through an information 
system that may result in an unauthorized ef-
fort to adversely impact the security, avail-
ability, confidentiality, or integrity of an infor-
mation system or information that is stored on, 
processed by, or transiting an information sys-
tem; and 
(B) does not include any action that solely 
involves a violation of a consumer term of serv-
ice or a consumer licensing agreement; 
(3) the term ‘‘information system’’— 
(A) has the meaning given the term in sec-
tion 3502 of title 44, United States Code; and 
(B) includes industrial control systems, 
such as supervisory control and data acquisition 
systems, distributed control systems, and pro-
grammable logic controllers; 
(4) the term ‘‘issuer’’ has the meaning given 
the term in section 3 of the Securities Exchange Act 
of 1934 (15 U.S.C. 78c); 
(5) the term ‘‘NIST’’ means the National Insti-
tute of Standards and Technology; and 
VerDate Sep 11 2014 
01:51 Aug 14, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6638.IH
H6638
pamtmann on DSKBFK8HB2PROD with BILLS
(6) the term ‘‘reporting company’’ means any 
company that is an issuer— 
(A) the securities of which are registered 
under section 12 of the Securities Exchange 
Act of 1934 (15 U.S.C. 78l); or 
(B) that is required to file reports under 
section 15(d) of such Act (15 U.S.C. 78o(d)). 
(b) REQUIREMENT TO ISSUE RULES.—Not later 
than 360 days after the date of enactment of this Act, 
the Commission shall issue final rules to require each re-
porting company, in the annual report submitted under 
section 13 or section 15(d) of the Securities Exchange Act 
of 1934 (15 U.S.C. 78m and 78o(d)) or the annual proxy 
statement submitted under section 14(a) of such Act (15 
U.S.C. 78n(a))— 
(1) to disclose whether any member of the gov-
erning body, such as the board of directors or gen-
eral partner, of the reporting company has expertise 
or experience in cybersecurity and in such detail as 
necessary to fully describe the nature of the exper-
tise or experience; and 
(2) if no member of the governing body of the 
reporting company has expertise or experience in cy-
bersecurity, to describe what other cybersecurity 
steps taken by the reporting company were taken 
VerDate Sep 11 2014 
01:51 Aug 14, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6638.IH
H6638
pamtmann on DSKBFK8HB2PROD with BILLS