‘‘(B) FORMAT.—In carrying out subpara-
graph (A), the Director shall share the anal-
yses— 
‘‘(i) in human-readable written prod-
ucts; and 
‘‘(ii) to the greatest extent practicable, 
in machine-readable formats in order to 
enable automated intake and use by agen-
cies. 
‘‘(b) ANNUAL REPORT ON FEDERAL INCIDENTS.— 
Not later than 2 years after the date of the enactment 
of this section, and not less frequently than annually 
thereafter, the Director of the Cybersecurity and Infra-
structure Security Agency, in consultation with the Direc-
tor, the National Cyber Director, and the heads of other 
agencies as appropriate, shall submit to the appropriate 
reporting entities a report that includes— 
‘‘(1) a summary of causes of incidents from 
across the Federal Government that categorizes 
those incidents as incidents or major incidents; 
‘‘(2) the quantitative and qualitative analyses of 
incidents developed under subsection (a)(1) on an 
agency-by-agency basis and comprehensively across 
the Federal Government, including— 
‘‘(A) a specific analysis of breaches; and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) an analysis of the Federal Govern-
ment’s performance against the metrics estab-
lished under section 224(c) of the Cybersecurity 
Act of 2015 (6 U.S.C. 1522(c)); and 
‘‘(3) an annex for each agency that includes— 
‘‘(A) a description of each major incident; 
and 
‘‘(B) an analysis of the agency’s perform-
ance against the metrics established under sec-
tion 224(c) of the Cybersecurity Act of 2015 (6 
U.S.C. 1522(c)). 
‘‘(c) PUBLICATION.—To the extent that publication 
is consistent with national security interests, a version of 
each report submitted under subsection (b) shall be made 
publicly available on the website of the Cybersecurity and 
Infrastructure Security Agency during the year in which 
the report is submitted. 
‘‘(d) INFORMATION PROVIDED BY AGENCIES.— 
‘‘(1) IN
GENERAL.—The analysis required 
under subsection (a) and each report submitted 
under subsection (b) shall use information provided 
by agencies under section 3594(a). 
‘‘(2) NATIONAL SECURITY SYSTEM REPORTS.— 
‘‘(A) IN GENERAL.—Annually, the head of 
an agency that operates or exercises control of 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
a national security system shall submit a report 
that includes the information described in sub-
section (b) with respect to the agency to the ex-
tent that the submission is consistent with 
standards and guidelines for national security 
systems issued in accordance with law and as 
directed by the President to— 
‘‘(i) the majority and minority leaders 
of the Senate; 
‘‘(ii) the Speaker and minority leader 
of the House of Representatives; 
‘‘(iii) the Committee on Homeland Se-
curity and Governmental Affairs of the 
Senate; 
‘‘(iv) the Select Committee on Intel-
ligence of the Senate; 
‘‘(v) the Committee on Armed Serv-
ices of the Senate; 
‘‘(vi) the Committee on Appropria-
tions of the Senate; 
‘‘(vii) the Committee on Oversight and 
Reform of the House of Representatives; 
‘‘(viii) the Committee on Homeland 
Security of the House of Representatives; 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(ix) the Permanent Select Committee 
on Intelligence of the House of Represent-
atives; 
‘‘(x) the Committee on Armed Serv-
ices of the House of Representatives; and 
‘‘(xi) the Committee on Appropria-
tions of the House of Representatives. 
‘‘(B) CLASSIFIED
FORM.—A report re-
quired under subparagraph (A) may be sub-
mitted in a classified form. 
‘‘(e) REQUIREMENT
FOR
COMPILING
INFORMA-
TION.—In publishing the public report required under 
subsection (c), the Director of the Cybersecurity and In-
frastructure Security Agency shall sufficiently compile in-
formation such that no specific incident of an agency can 
be identified, except with the concurrence of the Director 
of the Office of Management and Budget, the National 
Cyber Director, and in consultation with the impacted 
agency. 
‘‘§ 3598. Major incident definition 
‘‘(a) IN GENERAL.—Not later than 180 days after 
the date of the enactment of the Federal Information Se-
curity Modernization Act of 2022, the Director, in coordi-
nation with the Director of the Cybersecurity and Infra-
structure Security Agency and the National Cyber Direc-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
tor, shall develop and promulgate guidance on the defini-
tion of the term ‘major incident’ for the purposes of sub-
chapter II and this subchapter. 
‘‘(b) REQUIREMENTS.—With respect to the guidance 
issued under subsection (a), the definition of the term 
‘major incident’ shall— 
‘‘(1) include, with respect to any information 
collected or maintained by or on behalf of an agency 
or an information system used or operated by an 
agency or by a contractor of an agency or another 
organization on behalf of an agency, any incident 
the head of the agency determines is likely to result 
in demonstrable harm to— 
‘‘(A) the national security interests, foreign 
relations, or the economy of the United States; 
‘‘(B) the public confidence, civil liberties, 
or public health and safety of the people of the 
United States; 
‘‘(C) the integrity of personally identifiable 
information, including the exfiltration, modifica-
tion, or deletion of such information; or 
‘‘(D) any other type of incident determined 
appropriate by the Director; and 
‘‘(2) stipulate that the Director, in coordination 
with the National Cyber Director, shall declare a 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
major incident at each agency impacted by an inci-
dent if it is determined that an incident— 
‘‘(A) occurs at not less than 2 agencies; 
‘‘(B) is enabled by— 
‘‘(i) a common technical root cause, 
such as a supply chain compromise or a 
common software or hardware vulner-
ability; or 
‘‘(ii) the related activities of a com-
mon threat actor; or 
‘‘(C) has a significant impact on the con-
fidentiality, integrity, or availability of a high 
value asset. 
‘‘(c) EVALUATION AND UPDATES.—Not later than 2 
years after the date of the enactment of the Federal Infor-
mation Security Modernization Act of 2022, and not less 
frequently than every 2 years thereafter, the Director shall 
submit to the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate and the Committee on 
Oversight and Reform of the House of Representatives an 
evaluation, which shall include— 
‘‘(1) an update, if necessary, to the guidance 
issued under subsection (a); 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) the definition of the term ‘major incident’ 
included in the guidance issued under subsection (a); 
and 
‘‘(3) an explanation of, and the analysis that 
led to, the definition described in paragraph (2).’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions for chapter 35 of title 44, United States Code, 
is amended by adding at the end the following: 
‘‘SUBCHAPTER IV—FEDERAL SYSTEM INCIDENT RESPONSE 
‘‘3591. Definitions. 
‘‘3592. Notification of breach. 
‘‘3593. Congressional and executive branch reports. 
‘‘3594. Government information sharing and incident response. 
‘‘3595. Responsibilities of contractors and awardees. 
‘‘3596. Training. 
‘‘3597. Analysis and report on Federal incidents. 
‘‘3598. Major incident definition.’’. 
SEC. 102. AMENDMENTS TO SUBTITLE III OF TITLE 40. 
(a) MODERNIZING GOVERNMENT TECHNOLOGY.— 
Subtitle G of title X of Division A of the National Defense 
Authorization Act for Fiscal Year 2018 (Public Law 115– 
91; 40 U.S.C. 11301 note) is amended in section 1078— 
(1) by striking subsection (a) and inserting the 
following: 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) AGENCY.—The term ‘agency’ has the 
meaning given the term in section 551 of title 5, 
United States Code. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) HIGH
VALUE
ASSET.—The term ‘high 
value asset’ has the meaning given the term in sec-
tion 3552 of title 44, United States Code.’’; and 
(2) in subsection (c)— 
(A) in paragraph (2)(A)(i), by inserting ‘‘, 
including a consideration of the impact on high 
value assets’’ after ‘‘operational risks’’; 
(B) in paragraph (5)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
‘‘(C) a senior official from the Cybersecu-
rity and Infrastructure Security Agency of the 
Department of Homeland Security, appointed 
by the Director.’’; and 
(C) in paragraph (6)(A), by striking ‘‘shall 
be—’’ and all that follows through ‘‘4 employ-
ees’’ and inserting ‘‘shall be 4 employees’’. 
(b) SUBCHAPTER I.—Subchapter I of chapter 113 of 
subtitle III of title 40, United States Code, is amended— 
(1) in section 11302— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(A) in subsection (b), by striking ‘‘use, se-
curity, and disposal of’’ and inserting ‘‘use, and 
disposal of, and, in consultation with the Direc-
tor of the Cybersecurity and Infrastructure Se-
curity Agency and the National Cyber Director, 
promote and improve the security of,’’; 
(B) in subsection (c)(3)(B), by adding at 
the end the following: 
‘‘(iii) The Director may make avail-
able, upon request, to the National Cyber 
Director any cybersecurity funding infor-
mation provided to the Director under 
clause (ii) of this subparagraph.’’; 
(C) in subsection (f), by striking ‘‘The Di-
rector shall’’ and inserting ‘‘The Director 
shall— 
‘‘(1) encourage the heads of the executive agen-
cies to develop and use the best practices in the ac-
quisition of information technology, including supply 
chain risk management standards, guidelines, and 
practices developed by the National Institute of 
Standards and Technology; and 
‘‘(2) consult with the Federal Chief Information 
Security Officer appointed by the President under 
section 3607 of title 44, for the development and use 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
of risk management standards, guidelines, and prac-
tices developed by the National Institute of Stand-
ards and Technology.’’; and 
(D) in subsection (h), by inserting ‘‘, in-
cluding cybersecurity performances,’’ after ‘‘the 
performances’’; and 
(2) in section 11303(b), in paragraph (2)(B)— 
(A) in clause (i), by striking ‘‘or’’ at the 
end; 
(B) in clause (ii), by adding ‘‘or’’ at the 
end; and 
(C) by adding at the end the following: 
‘‘(iii) whether the function should be 
performed by a shared service offered by 
another executive agency.’’. 
(c) SUBCHAPTER II.—Subchapter II of chapter 113 
of subtitle III of title 40, United States Code, is amend-
ed— 
(1) in section 11312(a), by inserting ‘‘, includ-
ing security risks’’ after ‘‘managing the risks’’; 
(2) in section 11313(1), by striking ‘‘efficiency 
and effectiveness’’ and inserting ‘‘efficiency, security, 
and effectiveness’’; 
(3) in section 11315, by adding at the end the 
following: 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(d) COMPONENT AGENCY CHIEF INFORMATION OF-
FICERS.—The Chief Information Officer or an equivalent 
official of a component agency shall report to— 
‘‘(1) the Chief Information Officer designated 
under section 3506(a)(2) of title 44 or an equivalent 
official of the agency of which the component agency 
is a component; and 
‘‘(2) the head of the component agency.’’; 
(4) in section 11317, by inserting ‘‘security,’’ 
before ‘‘or schedule’’; and 
(5) in section 11319(b)(1), in the paragraph 
heading, by striking ‘‘CIOS’’ and inserting ‘‘CHIEF 
INFORMATION OFFICERS’’. 
(d) SUBCHAPTER III.—Section 11331 of title 40, 
United States Code, is amended— 
(1) in subsection (a), by striking ‘‘section 
3532(b)(1)’’ and inserting ‘‘section 3552(b)’’; 
(2) in subsection (b)(1)(A), by striking ‘‘the 
Secretary of Homeland Security’’ and inserting ‘‘the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency’’; and 
(3) by adding at the end the following: 
‘‘(e) REVIEW
OF OFFICE
OF MANAGEMENT
AND 
BUDGET GUIDANCE AND POLICY.— 
‘‘(1) CONDUCT OF REVIEW.— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) IN
GENERAL.—Not less frequently 
than once every 3 years, the Director of the Of-
fice of Management and Budget, in consultation 
with, as available, the Chief Information Offi-
cers Council, the Director of the Cybersecurity 
and Infrastructure Security Agency, the Na-
tional Cyber Director, the Comptroller General 
of the United States, and the Council of the In-
spectors General on Integrity and Efficiency, 
shall review the efficacy of the guidance and 
policy promulgated by the Director in reducing 
cybersecurity risks, including an assessment of 
the requirements for agencies to report infor-
mation to the Director, and determine whether 
any changes to that guidance or policy is appro-
priate. 
‘‘(B) FEDERAL
RISK
ASSESSMENTS.—In 
conducting the review described in subpara-
graph (A), the Director shall consider the Fed-
eral risk assessments performed under section 
3553(i) of title 44. 
‘‘(C) REQUIREMENTS BURDEN REDUCTION 
AND CLARITY.—In conducting the review de-
scribed in subparagraph (A), the Director shall 
consider the cumulative reporting and compli-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
ance burden to agencies as well as the clarity 
of the requirements and deadlines contained in 
guidance and policy documents. 
‘‘(2) UPDATED GUIDANCE.—Not later than 90 
days after the date on which a review is completed 
under paragraph (1), the Director of the Office of 
Management and Budget shall issue updated guid-
ance or policy to agencies determined appropriate by 
the Director, based on the results of the review. 
‘‘(3) CONGRESSIONAL
BRIEFING.—Not later 
than 60 days after the date on which a review is 
completed under paragraph (1), the Director is ex-
pected to provide to the Committee on Homeland 
Security and Governmental Affairs of the Senate 
and the Committee on Oversight and Reform of the 
House of Representatives a briefing on the review 
and any newly issued guidance or policy, which shall 
include— 
‘‘(A) an overview of the guidance and pol-
icy promulgated under this section that is cur-
rently in effect; 
‘‘(B) the cybersecurity risk mitigation, or 
other cybersecurity benefit, offered by each 
guidance or policy document described in sub-
paragraph (A); and 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) a summary of the guidance or policy 
to which changes were determined appropriate 
during the review and what the changes in-
clude. 
‘‘(f) 
AUTOMATED
STANDARD
IMPLEMENTATION 
VERIFICATION.—When the Director of the National Insti-
tute of Standards and Technology issues a proposed 
standard pursuant to paragraphs (2) and (3) of section 
20(a) of the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3(a)), the Director of the Na-
tional Institute of Standards and Technology shall con-
sider developing and, if appropriate and practical, develop, 
in consultation with the Director of the Cybersecurity and 
Infrastructure Security Agency, specifications to enable 
the automated verification of the implementation of con-
trols.’’. 
SEC. 103. ACTIONS TO ENHANCE FEDERAL INCIDENT RE-
SPONSE. 
(a) RESPONSIBILITIES OF THE CYBERSECURITY AND 
INFRASTRUCTURE SECURITY AGENCY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Di-
rector of the Cybersecurity and Infrastructure Secu-
rity Agency shall— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(A) develop a plan for the development of 
the analysis required under section 3597(a) of 
title 44, United States Code, as added by this 
Act, and the report required under subsection 
(b) of that section that includes— 
(i) a description of any challenges the 
Director anticipates encountering; and 
(ii) the use of automation and ma-
chine-readable formats for collecting, com-
piling, monitoring, and analyzing data; and 
(B) provide to the appropriate congres-
sional committees a briefing on the plan devel-
oped under subparagraph (A). 
(2) BRIEFING.—Not later than 1 year after the 
date of the enactment of this Act, the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy shall provide to the appropriate congressional 
committees a briefing on— 
(A) the execution of the plan required 
under paragraph (1)(A); and 
(B) the development of the report required 
under section 3597(b) of title 44, United States 
Code, as added by this Act. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
OFFICE OF MANAGEMENT AND BUDGET.— 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
(1) FISMA.—Section 2 of the Federal Informa-
tion Security Modernization Act of 2014 (Public 
Law 113–283; 44 U.S.C. 3554 note) is amended— 
(A) by striking subsection (b); and 
(B) 
by 
redesignating 
subsections 
(c) 
through (f) as subsections (b) through (e), re-
spectively. 
(2) IN GENERAL.—The Director shall develop 
guidance, to be updated not less frequently than 
once every 2 years, on the content, timeliness, and 
format of the information provided by agencies 
under section 3594(a) of title 44, United States 
Code, as added by this Act. 
(3) GUIDANCE ON RESPONDING TO INFORMA-
TION REQUESTS.—Not later than 1 year after the 
date of the enactment of this Act, the Director shall 
develop guidance for agencies to implement the re-
quirement under section 3594(c) of title 44, United 
States Code, as added by this Act, to provide infor-
mation to other agencies experiencing incidents. 
(4) STANDARD GUIDANCE AND TEMPLATES.— 
Not later than 1 year after the date of the enact-
ment of this Act, the Director, in consultation with 
the Director of the Cybersecurity and Infrastructure 
Security Agency, shall develop guidance and tem-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
plates, to be reviewed and, if necessary, updated not 
less frequently than once every 2 years, for use by 
Federal agencies in the activities required under sec-
tions 3592, 3593, and 3596 of title 44, United 
States Code, as added by this Act. 
(5) CONTRACTOR AND AWARDEE GUIDANCE.— 
(A) IN GENERAL.—Not later than 1 year 
after the date of the enactment of this Act, the 
Director, in coordination with the Secretary of 
Homeland Security, the Secretary of Defense, 
the Administrator of General Services, and the 
heads of other agencies determined appropriate 
by the Director, shall issue guidance to Federal 
agencies on how to deconflict, to the greatest 
extent practicable, existing regulations, policies, 
and procedures relating to the responsibilities of 
contractors and awardees established under sec-
tion 3595 of title 44, United States Code, as 
added by this Act. 
(B) EXISTING PROCESSES.—To the great-
est extent practicable, the guidance issued 
under subparagraph (A) shall allow contractors 
and awardees to use existing processes for noti-
fying Federal agencies of incidents involving in-
formation of the Federal Government. 
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS
‘‘§ 3559B. Federal vulnerability disclosure programs 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) REPORT.—The term ‘report’ means a vul-
nerability disclosure made to an agency by a re-
porter. 
‘‘(2) REPORTER.—The term ‘reporter’ means 
an individual that submits a vulnerability report 
pursuant to the vulnerability disclosure process of an 
agency. 
‘‘(b) RESPONSIBILITIES OF OMB.— 
‘‘(1) LIMITATION ON LEGAL ACTION.—The Di-
rector of the Office of Management and Budget, in 
consultation with the Attorney General, shall issue 
guidance to agencies to not recommend or pursue 
legal action against a reporter or an individual that 
conducts a security research activity that the head 
of the agency determines— 
‘‘(A) represents a good faith effort to fol-
low the vulnerability disclosure policy of the 
agency developed under subsection (d)(2); and 
‘‘(B) is authorized under the vulnerability 
disclosure policy of the agency developed under 
subsection (d)(2). 
‘‘(2) SHARING INFORMATION WITH CISA.—The 
Director of the Office of Management and Budget, 
in coordination with the Director of the Cybersecu-
VerDate Sep 11 2014 
04:39 Jan 27, 2022
Jkt 029200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H6497.IH
H6497
kjohnson on DSK79L0C42PROD with BILLS