H. R. 1668—4 
SEC. 5. GUIDELINES ON THE DISCLOSURE PROCESS FOR SECURITY 
VULNERABILITIES RELATING TO INFORMATION SYSTEMS, 
INCLUDING INTERNET OF THINGS DEVICES. 
(a) IN GENERAL.—Not later than 180 days after the date of 
the enactment of this Act, the Director of the Institute, in consulta-
tion with such cybersecurity researchers and private sector industry 
experts as the Director considers appropriate, and in consultation 
with the Secretary, shall develop and publish under section 20 
of the National Institute of Standards and Technology Act (15 
U.S.C. 278g–3) guidelines— 
(1) for the reporting, coordinating, publishing, and receiving 
of information about— 
(A) a security vulnerability relating to information sys-
tems owned or controlled by an agency (including Internet 
of Things devices owned or controlled by an agency); and 
(B) the resolution of such security vulnerability; and 
(2) for a contractor providing to an agency an information 
system (including an Internet of Things device) and any subcon-
tractor thereof at any tier providing such information system 
to such contractor, on— 
(A) receiving information about a potential security 
vulnerability relating to the information system; and 
(B) disseminating information about the resolution of 
a security vulnerability relating to the information system. 
(b) ELEMENTS.—The guidelines published under subsection (a) 
shall— 
(1) to the maximum extent practicable, be aligned with 
industry best practices and Standards 29147 and 30111 of 
the International Standards Organization (or any successor 
standard) or any other appropriate, relevant, and widely-used 
standard; 
(2) incorporate guidelines on— 
(A) receiving information about a potential security 
vulnerability relating to an information system owned or 
controlled by an agency (including an Internet of Things 
device); and 
(B) disseminating information about the resolution of 
a security vulnerability relating to an information system 
owned or controlled by an agency (including an Internet 
of Things device); and 
(3) be consistent with the policies and procedures produced 
under section 2009(m) of the Homeland Security Act of 2002 
(6 U.S.C. 659(m)). 
(c) INFORMATION ITEMS.—The guidelines published under sub-
section (a) shall include example content, on the information items 
that should be reported, coordinated, published, or received pursu-
ant to this section by a contractor, or any subcontractor thereof 
at any tier, providing an information system (including Internet 
of Things device) to the Federal Government. 
(d) OVERSIGHT.—The Director of OMB shall oversee the 
implementation of the guidelines published under subsection (a). 
(e) OPERATIONAL AND TECHNICAL ASSISTANCE.—The Secretary, 
in consultation with the Director of OMB, shall administer the 
implementation of the guidelines published under subsection (a) 
and provide operational and technical assistance in implementing 
such guidelines.
H. R. 1668—5 
SEC. 6. IMPLEMENTATION OF COORDINATED DISCLOSURE OF SECU-
RITY VULNERABILITIES RELATING TO AGENCY INFORMA-
TION SYSTEMS, INCLUDING INTERNET OF THINGS DEVICES. 
(a) AGENCY GUIDELINES REQUIRED.—Not later than 2 years 
after the date of the enactment of this Act, the Director of OMB, 
in consultation with the Secretary, shall develop and oversee the 
implementation of policies, principles, standards, or guidelines as 
may be necessary to address security vulnerabilities of information 
systems (including Internet of Things devices). 
(b) OPERATIONAL AND TECHNICAL ASSISTANCE.—Consistent with 
section 3553(b) of title 44, United States Code, the Secretary, in 
consultation with the Director of OMB, shall provide operational 
and technical assistance to agencies on reporting, coordinating, 
publishing, and receiving information about security vulnerabilities 
of information systems (including Internet of Things devices). 
(c) CONSISTENCY WITH GUIDELINES FROM NATIONAL INSTITUTE 
OF STANDARDS AND TECHNOLOGY.—The Secretary shall ensure that 
the assistance provided under subsection (b) is consistent with 
applicable standards and publications developed by the Director 
of the Institute. 
(d) REVISION OF FEDERAL ACQUISITION REGULATION.—The Fed-
eral Acquisition Regulation shall be revised as necessary to imple-
ment the provisions under this section. 
SEC. 7. CONTRACTOR COMPLIANCE WITH COORDINATED DISCLOSURE 
OF SECURITY VULNERABILITIES RELATING TO AGENCY 
INTERNET OF THINGS DEVICES. 
(a) PROHIBITION ON PROCUREMENT AND USE.— 
(1) IN GENERAL.—The head of an agency is prohibited from 
procuring or obtaining, renewing a contract to procure or obtain, 
or using an Internet of Things device, if the Chief Information 
Officer of that agency determines during a review required 
by section 11319(b)(1)(C) of title 40, United States Code, of 
a contract for such device that the use of such device prevents 
compliance with the standards and guidelines developed under 
section 4 or the guidelines published under section 5 with 
respect to such device. 
(2) SIMPLIFIED ACQUISITION THRESHOLD.—Notwithstanding 
section 1905 of title 41, United States Code, the requirements 
under paragraph (1) shall apply to a contract or subcontract 
in amounts not greater than the simplified acquisition 
threshold. 
(b) WAIVER.— 
(1) AUTHORITY.—The head of an agency may waive the 
prohibition under subsection (a)(1) with respect to an Internet 
of Things device if the Chief Information Officer of that agency 
determines that— 
(A) the waiver is necessary in the interest of national 
security; 
(B) procuring, obtaining, or using such device is nec-
essary for research purposes; or 
(C) such device is secured using alternative and effec-
tive methods appropriate to the function of such device. 
(2) AGENCY PROCESS.—The Director of OMB shall establish 
a standardized process for the Chief Information Officer of 
each agency to follow in determining whether the waiver under 
paragraph (1) may be granted.
H. R. 1668—6 
(c) REPORTS TO CONGRESS.— 
(1) REPORT.—Every 2 years during the 6-year period begin-
ning on the date of the enactment of this Act, the Comptroller 
General of the United States shall submit to the Committee 
on Oversight and Reform of the House of Representatives, 
the Committee on Homeland Security of the House of Rep-
resentatives, and the Committee on Homeland Security and 
Governmental Affairs of the Senate a report— 
(A) on the effectiveness of the process established under 
subsection (b)(2); 
(B) that contains recommended best practices for the 
procurement of Internet of Things devices; and 
(C) that lists— 
(i) the number and type of each Internet of Things 
device for which a waiver under subsection (b)(1) was 
granted during the 2-year period prior to the submis-
sion of the report; and 
(ii) the legal authority under which each such 
waiver was granted, such as whether the waiver was 
granted pursuant to subparagraph (A), (B), or (C) of 
such subsection. 
(2) CLASSIFICATION
OF
REPORT.—Each report submitted 
under this subsection shall be submitted in unclassified form, 
but may include a classified annex that contains the informa-
tion described under paragraph (1)(C). 
(d) EFFECTIVE DATE.—The prohibition under subsection (a)(1) 
shall take effect 2 years after the date of the enactment of this 
Act. 
SEC. 8. GOVERNMENT ACCOUNTABILITY OFFICE REPORT ON CYBERSE-
CURITY CONSIDERATIONS STEMMING FROM THE CONVER-
GENCE OF INFORMATION TECHNOLOGY, INTERNET OF 
THINGS, AND OPERATIONAL TECHNOLOGY DEVICES, NET-
WORKS, AND SYSTEMS. 
(a) BRIEFING.—Not later than 1 year after the date of the 
enactment of this Act, the Comptroller General of the United States 
shall provide a briefing to the Committee on Oversight and Reform 
of the House of Representatives, the Committee on Homeland Secu-
rity of the House of Representatives, and the Committee on Home-
land Security and Governmental Affairs of the Senate on broader 
Internet of Things efforts, including projects designed to assist 
in managing potential security vulnerabilities associated with the 
use of traditional information technology devices, networks, and 
systems with— 
(1) Internet of Things devices, networks, and systems; and 
(2) operational technology devices, networks, and systems. 
(b) REPORT.—Not later than 2 years after the date of enactment 
of this Act, the Comptroller General shall submit a report to the
H. R. 1668—7 
Committee on Oversight and Reform of the House of Representa-
tives, the Committee on Homeland Security of the House of Rep-
resentatives, and the Committee on Homeland Security and Govern-
mental Affairs of the Senate on broader Internet of Things efforts 
addressed in subsection (a). 
Speaker of the House of Representatives. 
Vice President of the United States and
President of the Senate.