IB 
Union Calendar No. 518 
116TH CONGRESS 
2D SESSION 
H. R. 1731 
[Report No. 116–633] 
To amend the Securities Exchange Act of 1934 to promote transparency 
in the oversight of cybersecurity risks at publicly traded companies. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 13, 2019 
Mr. HIMES (for himself, Mr. HECK, and Mr. MEEKS) introduced the following 
bill; which was referred to the Committee on Financial Services 
DECEMBER 8, 2020 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on March 13, 2019] 
VerDate Sep 11 2014 
03:37 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS
A BILL 
To amend the Securities Exchange Act of 1934 to promote 
transparency in the oversight of cybersecurity risks at 
publicly traded companies. 
VerDate Sep 11 2014 
02:03 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Disclosure 
Act of 2019’’. 
SEC. 2. CYBERSECURITY TRANSPARENCY. 
The Securities Exchange Act of 1934 (15 U.S.C. 78a 
et seq.) is amended by inserting after section 14B (15 
U.S.C. 78n–2) the following: 
‘‘SEC. 14C. CYBERSECURITY TRANSPARENCY. 
‘‘(a) DEFINITIONS.—In this section— 
‘‘(1) the term ‘cybersecurity’ means any action, 
step, or measure to detect, prevent, deter, mitigate, or 
address any cybersecurity threat or any potential cy-
bersecurity threat; 
‘‘(2) the term ‘cybersecurity threat’— 
‘‘(A) means an action, not protected by the 
First Amendment to the Constitution of the 
United States, on or through an information sys-
tem that may result in an unauthorized effort to 
adversely impact the security, availability, con-
fidentiality, or integrity of an information sys-
tem or information that is stored on, processed 
by, or transiting an information system; and 
VerDate Sep 11 2014 
02:03 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS
‘‘(B) does not include any action that solely 
involves a violation of a consumer term of service 
or a consumer licensing agreement; 
‘‘(3) the term ‘information system’— 
‘‘(A) has the meaning given the term in sec-
tion 3502 of title 44, United States Code; and 
‘‘(B) includes industrial control systems, 
such as supervisory control and data acquisition 
systems, distributed control systems, and pro-
grammable logic controllers; 
‘‘(4) the term ‘NIST’ means the National Insti-
tute of Standards and Technology; and 
‘‘(5) the term ‘reporting company’ means any 
company that is an issuer— 
‘‘(A) the securities of which are registered 
under section 12; or 
‘‘(B) that is required to file reports under 
section 15(d). 
‘‘(b) REQUIREMENT TO ISSUE RULES.—Not later than 
360 days after the date of enactment of this section, the 
Commission shall issue final rules to require each reporting 
company, in the annual report of the reporting company 
submitted under section 13 or section 15(d) or in the an-
nual proxy statement of the reporting company submitted 
under section 14(a)— 
VerDate Sep 11 2014 
02:03 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS
‘‘(1) to disclose whether any member of the gov-
erning body, such as the board of directors or general 
partner, of the reporting company has expertise or ex-
perience in cybersecurity and in such detail as nec-
essary to fully describe the nature of the expertise or 
experience; and 
‘‘(2) if no member of the governing body of the 
reporting company has expertise or experience in cy-
bersecurity, to describe what other aspects of the re-
porting company’s cybersecurity were taken into ac-
count by any person, such as an official serving on 
a nominating committee, that is responsible for iden-
tifying and evaluating nominees for membership to 
the governing body. 
‘‘(c) CYBERSECURITY EXPERTISE OR EXPERIENCE.— 
For purposes of subsection (b), the Commission, in consulta-
tion with NIST, shall define what constitutes expertise or 
experience in cybersecurity using commonly defined roles, 
specialties, knowledge, skills, and abilities, such as those 
provided in NIST Special Publication 800–181, titled ‘Na-
tional Initiative for Cybersecurity Education (NICE) Cy-
bersecurity Workforce Framework’, or any successor there-
to.’’. 
VerDate Sep 11 2014 
02:03 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS
Union Calendar No. 518 
116TH CONGRESS 
2D SESSION 
H. R. 1731 
[Report No. 116–633] 
A BILL 
To amend the Securities Exchange Act of 1934 to 
promote transparency in the oversight of cyberse-
curity risks at publicly traded companies. 
DECEMBER 8, 2020 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
03:37 Dec 09, 2020
Jkt 019200
PO 00000
Frm 00006
Fmt 6651
Sfmt 6651
E:\BILLS\H1731.RH
H1731
SSpencer on DSK126QN23PROD with BILLS