I 
118TH CONGRESS 
1ST SESSION H. R. 4552 
To improve the cybersecurity of the Federal Government, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 11, 2023 
Ms. MACE (for herself, Mr. RASKIN, Mr. COMER, and Mr. CONNOLLY) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Accountability, and in addition to the Committees on Science, 
Space, and Technology, Homeland Security, and Armed Services, for a 
period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To improve the cybersecurity of the Federal Government, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Federal Information Security Modernization Act of 
2023’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
Sec. 3. Amendments to title 44. 
Sec. 4. Amendments to subtitle III of title 40. 
Sec. 5. Actions to enhance Federal incident transparency. 
Sec. 6. Additional guidance to agencies on FISMA updates. 
Sec. 7. Agency requirements to notify private sector entities impacted by inci-
dents. 
Sec. 8. Mobile security briefings. 
Sec. 9. Data and logging retention for incident response. 
Sec. 10. CISA agency liaisons. 
Sec. 11. Federal penetration testing policy. 
Sec. 12. Vulnerability disclosure policies. 
Sec. 13. Implementing zero trust architecture. 
Sec. 14. Automation and artificial intelligence. 
Sec. 15. Extension of chief data officer council. 
Sec. 16. Council of the Inspectors General on Integrity and Efficiency dash-
board. 
Sec. 17. Security operations center shared service. 
Sec. 18. Federal cybersecurity requirements. 
Sec. 19. Federal Chief Information Security Officer. 
Sec. 20. Renaming Office of the Federal Chief Information Officer. 
Sec. 21. Rules of construction. 
SEC. 2. DEFINITIONS. 
In this Act, unless otherwise specified: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(2) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
(B) the Committee on Oversight and Ac-
countability of the House of Representatives; 
and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(C) the Committee on Homeland Security 
of the House of Representatives. 
(3) AWARDEE.—The term ‘‘awardee’’ has the 
meaning given the term in section 3591 of title 44, 
United States Code, as added by this Act. 
(4) CONTRACTOR.—The term ‘‘contractor’’ has 
the meaning given the term in section 3591 of title 
44, United States Code, as added by this Act. 
(5) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Office of Management and Budg-
et. 
(6) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘‘Federal information system’’ has the meaning 
give the term in section 3591 of title 44, United 
States Code, as added by this Act. 
(7) INCIDENT.—The term ‘‘incident’’ has the 
meaning given the term in section 3552(b) of title 
44, United States Code. 
(8) NATIONAL SECURITY SYSTEM.—The term 
‘‘national security system’’ has the meaning given 
the term in section 3552(b) of title 44, United 
States Code. 
(9) PENETRATION TEST.—The term ‘‘penetra-
tion test’’ has the meaning given the term in section 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
3552(b) of title 44, United States Code, as amended 
by this Act. 
(10) THREAT
HUNTING.—The term ‘‘threat 
hunting’’ means proactively and iteratively searching 
systems for threats and vulnerabilities, including 
threats or vulnerabilities that may evade detection 
by automated threat detection systems. 
(11) ZERO TRUST ARCHITECTURE.—The term 
‘‘zero trust architecture’’ has the meaning given the 
term in Special Publication 800–207 of the National 
Institute of Standards and Technology, or any suc-
cessor document. 
SEC. 3. AMENDMENTS TO TITLE 44. 
(a) SUBCHAPTER I AMENDMENTS.—Subchapter I of 
chapter 35 of title 44, United States Code, is amended— 
(1) in section 3504— 
(A) in subsection (a)(1)(B)— 
(i) by striking clause (v) and inserting 
the following: 
‘‘(v) privacy, confidentiality, disclo-
sure, and sharing of information;’’; 
(ii) by redesignating clause (vi) as 
clause (vii); and 
(iii) by inserting after clause (v) the 
following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(C) in paragraph (3) of the second sub-
section designated as subsection (c)— 
(i) in subparagraph (B)— 
(I) by inserting ‘‘the Director of 
the Cybersecurity and Infrastructure 
Security Agency, the National Cyber 
Director, and’’ before ‘‘the Comp-
troller General’’; and 
(II) by striking ‘‘and’’ at the end; 
(ii) in subparagraph (C)(v), by strik-
ing the period at the end and inserting ‘‘; 
and’’; and 
(iii) by adding at the end the fol-
lowing: 
‘‘(D) maintained on a continual basis 
through the use of automation, machine-read-
able data, and scanning, wherever practicable.’’; 
(3) in section 3506— 
(A) in subsection (a)(3), by inserting ‘‘In 
carrying out these duties, the Chief Information 
Officer shall consult, as appropriate, with the 
Chief Data Officer in accordance with the des-
ignated functions under section 3520(c).’’ after 
‘‘reduction of information collection burdens on 
the public.’’; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) in subsection (b)(1)(C), by inserting 
‘‘availability,’’ after ‘‘integrity,’’; 
(C) in subsection (h)(3), by inserting ‘‘se-
curity,’’ after ‘‘efficiency,’’; and 
(D) by adding at the end the following: 
‘‘(j)(1) Nothwithstanding paragraphs (2) and (3) of 
subsection (a), the head of each agency shall designate a 
Chief Privacy Officer with the necessary skills, knowledge, 
and expertise, who shall have the authority and responsi-
bility to— 
‘‘(A) lead the privacy program of the agency; 
and 
‘‘(B) carry out the privacy responsibilities of 
the agency under this chapter, section 552a of title 
5, and guidance issued by the Director. 
‘‘(2) The Chief Privacy Officer of each agency shall— 
‘‘(A) serve in a central leadership position with-
in the agency; 
‘‘(B) have visibility into relevant agency oper-
ations; and 
‘‘(C) be positioned highly enough within the 
agency to regularly engage with other agency leaders 
and officials, including the head of the agency. 
‘‘(3) A privacy officer of an agency established under 
a statute enacted before the date of enactment of the Fed-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
eral Information Security Modernization Act of 2023 may 
carry out the responsibilities under this subsection for the 
agency.’’; and 
(4) in section 3513— 
(A) by redesignating subsection (c) as sub-
section (d); and 
(B) by inserting after subsection (b) the 
following: 
‘‘(c) Each agency providing a written plan under sub-
section (b) shall provide any portion of the written plan 
addressing information security to the Secretary of Home-
land Security and the National Cyber Director.’’. 
(b) SUBCHAPTER II DEFINITIONS.— 
(1) IN GENERAL.—Section 3552(b) of title 44, 
United States Code, is amended— 
(A) by redesignating paragraphs (2), (3), 
(4), (5), (6), and (7) as paragraphs (3), (4), 
(5), (6), (8), and (10), respectively; 
(B) by inserting after paragraph (1) the 
following: 
‘‘(2) The term ‘high value asset’ means infor-
mation or an information system that the head of an 
agency, using policies, principles, standards, or 
guidelines issued by the Director under section 
3553(a), determines to be so critical to the agency 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
that the loss or degradation of the confidentiality, 
integrity, or availability of such information or infor-
mation system would have a serious impact on the 
ability of the agency to perform the mission of the 
agency or conduct business.’’; 
(C) by inserting after paragraph (6), as so 
redesignated, the following: 
‘‘(7) The term ‘major incident’ has the meaning 
given the term in guidance issued by the Director 
under section 3598(a).’’; 
(D) in paragraph (8)(A), as so redesig-
nated, by striking ‘‘used’’ and inserting ‘‘owned, 
managed,’’; 
(E) by inserting after paragraph (8), as so 
redesignated, the following: 
‘‘(9) The term ‘penetration test’— 
‘‘(A) means an authorized assessment that 
emulates attempts to gain unauthorized access 
to, or disrupt the operations of, an information 
system or component of an information system; 
and 
‘‘(B) includes any additional meaning 
given the term in policies, principles, standards, 
or guidelines issued by the Director under sec-
tion 3553(a).’’; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(F) by inserting after paragraph (10), as 
so redesignated, the following: 
‘‘(11) The term ‘shared service’ means a cen-
tralized mission capability or consolidated business 
function that is provided to multiple organizations 
within an agency or to multiple agencies. 
‘‘(12) The term ‘zero trust architecture’ has the 
meaning given the term in Special Publication 800– 
207 of the National Institute of Standards and 
Technology, or any successor document.’’. 
(2) CONFORMING AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Section 1001(c)(1)(A) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is 
amended by striking ‘‘section 3552(b)(5)’’ and 
inserting ‘‘section 3552(b)’’. 
(B) TITLE 10.— 
(i) SECTION 2222.—Section 2222(i)(8) 
of title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)(A)’’ and 
inserting ‘‘section 3552(b)(8)(A)’’. 
(ii) 
SECTION
2223.—Section 
2223(c)(3) of title 10, United States Code, 
is 
amended 
by 
striking 
‘‘section 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
3552(b)(6)’’ 
and 
inserting 
‘‘section 
3552(b)’’. 
(iii) SECTION 2315.—Section 2315 of 
title 10, United States Code, is amended 
by striking ‘‘section 3552(b)(6)’’ and in-
serting ‘‘section 3552(b)’’. 
(iv) 
SECTION
2339a.—Section 
2339a(e)(5) of title 10, United States 
Code, is amended by striking ‘‘section 
3552(b)(6)’’ 
and 
inserting 
‘‘section 
3552(b)’’. 
(C) HIGH-PERFORMANCE COMPUTING ACT 
OF 1991.—Section 207(a) of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 
5527(a)) is amended by striking ‘‘section 
3552(b)(6)(A)(i)’’ 
and 
inserting 
‘‘section 
3552(b)(8)(A)(i)’’. 
(D) INTERNET
OF
THINGS
CYBERSECU-
RITY IMPROVEMENT ACT OF 2020.—Section 3(5) 
of the Internet of Things Cybersecurity Im-
provement Act of 2020 (15 U.S.C. 278g–3a(5)) 
is amended by striking ‘‘section 3552(b)(6)’’ 
and inserting ‘‘section 3552(b)’’. 
(E) NATIONAL DEFENSE AUTHORIZATION 
ACT
FOR
FISCAL
YEAR
2013.—Section 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
933(e)(1)(B) of the National Defense Author-
ization Act for Fiscal Year 2013 (10 U.S.C. 
2224 note) is amended by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552(b)’’. 
(F) IKE SKELTON NATIONAL DEFENSE AU-
THORIZATION ACT FOR FISCAL YEAR 2011.—The 
Ike Skelton National Defense Authorization Act 
for Fiscal Year 2011 (Public Law 111–383) is 
amended— 
(i) in section 806(e)(5) (10 U.S.C. 
2304 note), by striking ‘‘section 3542(b)’’ 
and inserting ‘‘section 3552(b)’’; 
(ii) in section 931(b)(3) (10 U.S.C. 
2223 
note), 
by 
striking 
‘‘section 
3542(b)(2)’’ 
and 
inserting 
‘‘section 
3552(b)’’; and 
(iii) in section 932(b)(2) (10 U.S.C. 
2224 
note), 
by 
striking 
‘‘section 
3542(b)(2)’’ 
and 
inserting 
‘‘section 
3552(b)’’. 
(G) E-GOVERNMENT
ACT
OF
2002.—Sec-
tion 301(c)(1)(A) of the E-Government Act of 
2002 (44 U.S.C. 3501 note) is amended by 
striking ‘‘section 3542(b)(2)’’ and inserting 
‘‘section 3552(b)’’. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
tor of the National Institute of Standards and Tech-
nology— 
‘‘(A) the use of automation to improve 
Federal cybersecurity and visibility with respect 
to the implementation of Federal cybersecurity; 
and 
‘‘(B) the use of presumption of com-
promise and least privilege principles, such as 
zero trust architecture, to improve resiliency 
and timely response actions to incidents on 
Federal systems.’’; 
(B) in subsection (b)— 
(i) in the matter preceding paragraph 
(1), by inserting ‘‘and the National Cyber 
Director’’ after ‘‘Director’’; 
(ii) in paragraph (2)(A), by inserting 
‘‘and reporting requirements under sub-
chapter IV of this chapter’’ after ‘‘section 
3556’’; 
(iii) by redesignating paragraphs (8) 
and (9) as paragraphs (10) and (11), re-
spectively; and 
(iv) by inserting after paragraph (7) 
the following: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(8) expeditiously seeking opportunities to re-
duce costs, administrative burdens, and other bar-
riers to information technology security and mod-
ernization for agencies, including through shared 
services for cybersecurity capabilities identified as 
appropriate by the Director, in coordination with the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency and other agencies as appropriate;’’; 
(C) in subsection (c)— 
(i) in the matter preceding paragraph 
(1)— 
(I) by striking ‘‘each year’’ and 
inserting ‘‘each year during which 
agencies are required to submit re-
ports under section 3554(c)’’; 
(II) by inserting ‘‘, which shall be 
unclassified but may include 1 or 
more annexes that contain classified 
or other sensitive information, as ap-
propriate’’ after ‘‘a report’’; and 
(III) 
by 
striking 
‘‘preceding 
year’’ and inserting ‘‘preceding 2 
years’’; 
(ii) by striking paragraph (1); 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(iii) by redesignating paragraphs (2), 
(3), and (4) as paragraphs (1), (2), and 
(3), respectively; 
(iv) in paragraph (3), as so redesig-
nated, by striking ‘‘and’’ at the end; and 
(v) by inserting after paragraph (3), 
as so redesignated, the following: 
‘‘(4) a summary of the risks and trends identi-
fied in the Federal risk assessment required under 
subsection (i); and’’; 
(D) in subsection (h)— 
(i) in paragraph (2)— 
(I) in subparagraph (A), by in-
serting ‘‘and the National Cyber Di-
rector’’ after ‘‘in coordination with the 
Director’’; and 
(II) in subparagraph (D), by in-
serting ‘‘, the National Cyber Direc-
tor,’’ after ‘‘notify the Director’’; and 
(ii) in paragraph (3)(A)(iv), by insert-
ing ‘‘, the National Cyber Director,’’ after 
‘‘the Secretary provides prior notice to the 
Director’’; 
(E) by amending subsection (i) to read as 
follows: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) FEDERAL RISK ASSESSMENT.—On an ongoing 
and continuous basis, the Director of the Cybersecurity 
and Infrastructure Security Agency shall assess the Fed-
eral risk posture using any available information on the 
cybersecurity posture of agencies, and brief the Director 
and National Cyber Director on the findings of such as-
sessment, including— 
‘‘(1) the status of agency cybersecurity remedial 
actions for high value assets described in section 
3554(b)(7); 
‘‘(2) any vulnerability information relating to 
the systems of an agency that is known by the agen-
cy; 
‘‘(3) analysis of incident information under sec-
tion 3597; 
‘‘(4) evaluation of penetration testing per-
formed under section 3559A; 
‘‘(5) evaluation of vulnerability disclosure pro-
gram information under section 3559B; 
‘‘(6) evaluation of agency threat hunting re-
sults; 
‘‘(7) evaluation of Federal and non-Federal 
cyber threat intelligence; 
‘‘(8) data on agency compliance with standards 
issued under section 11331 of title 40; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(9) agency system risk assessments required 
under section 3554(a)(1)(A); 
‘‘(10) relevant reports from inspectors general 
of agencies and the Government Accountability Of-
fice; and 
‘‘(11) any other information the Director of the 
Cybersecurity and Infrastructure Security Agency 
determines relevant.’’; and 
(F) by adding at the end the following: 
‘‘(m) DIRECTIVES.— 
‘‘(1) EMERGENCY DIRECTIVE UPDATES.—If the 
Secretary issues an emergency directive under this 
section, the Director of the Cybersecurity and Infra-
structure Security Agency shall submit to the Direc-
tor, the National Cyber Director, the Committee on 
Homeland Security and Governmental Affairs of the 
Senate, and the Committees on Oversight and Ac-
countability and Homeland Security of the House of 
Representatives an update on the status of the im-
plementation of the emergency directive at agencies 
not later than 7 days after the date on which the 
emergency directive requires an agency to complete 
a requirement specified by the emergency directive, 
and every 30 days thereafter until— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) the date on which every agency has 
fully implemented the emergency directive; 
‘‘(B) the Secretary determines that an 
emergency directive no longer requires active 
reporting from agencies or additional implemen-
tation; or 
‘‘(C) the date that is 1 year after the 
issuance of the directive. 
‘‘(2) BINDING
OPERATIONAL
DIRECTIVE
UP-
DATES.—If the Secretary issues a binding oper-
ational directive under this section, the Director of 
the Cybersecurity and Infrastructure Security Agen-
cy shall submit to the Director, the National Cyber 
Director, the Committee on Homeland Security and 
Governmental Affairs of the Senate, and the Com-
mittees on Oversight and Accountability and Home-
land Security of the House of Representatives an 
update on the status of the implementation of the 
binding operational directive at agencies not later 
than 30 days after the issuance of the binding oper-
ational directive, and every 90 days thereafter 
until— 
‘‘(A) the date on which every agency has 
fully implemented the binding operational direc-
tive; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) the Secretary determines that a bind-
ing operational directive no longer requires ac-
tive reporting from agencies or additional im-
plementation; or 
‘‘(C) the date that is 1 year after the 
issuance or substantive update of the directive. 
‘‘(3) REPORT.—If the Director of the Cyberse-
curity and Infrastructure Security Agency ceases 
submitting updates required under paragraphs (1) 
or (2) on the date described in paragraph (1)(C) or 
(2)(C), the Director of the Cybersecurity and Infra-
structure Security Agency shall submit to the Direc-
tor, the National Cyber Director, the Committee on 
Homeland Security and Governmental Affairs of the 
Senate, and the Committees on Oversight and Ac-
countability and Homeland Security of the House of 
Representatives a list of every agency that, at the 
time of the report— 
‘‘(A) has not completed a requirement 
specified by an emergency directive; or 
‘‘(B) has not implemented a binding oper-
ational directive. 
‘‘(n) REVIEW
OF OFFICE
OF MANAGEMENT
AND 
BUDGET GUIDANCE AND POLICY.— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(1) CONDUCT
OF
REVIEW.—Not less fre-
quently than once every 3 years, the Director of the 
Office of Management and Budget shall review the 
efficacy of the guidance and policy promulgated by 
the Director in reducing cybersecurity risks, includ-
ing a consideration of reporting and compliance bur-
den on agencies. 
‘‘(2) CONGRESSIONAL NOTIFICATION.—The Di-
rector of the Office of Management and Budget 
shall notify the Committee on Homeland Security 
and Governmental Affairs of the Senate and the 
Committee on Oversight and Accountability of the 
House of Representatives of changes to guidance or 
policy resulting from the review under paragraph 
(1). 
‘‘(3) GAO REVIEW.—The Government Account-
ability Office shall review guidance and policy pro-
mulgated by the Director to assess its efficacy in 
risk reduction and burden on agencies. 
‘‘(o) AUTOMATED
STANDARD
IMPLEMENTATION 
VERIFICATION.—When the Director of the National Insti-
tute of Standards and Technology issues a proposed 
standard or guideline pursuant to paragraphs (2) or (3) 
of section 20(a) of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3(a)), the Director of 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
the National Institute of Standards and Technology shall 
consider developing and, if appropriate and practical, de-
velop specifications to enable the automated verification 
of the implementation of the controls. 
‘‘(p) INSPECTORS GENERAL ACCESS TO FEDERAL 
RISK ASSESSMENTS.—The Director of the Cybersecurity 
and Infrastructure Security Agency shall, upon request, 
make available Federal risk assessment information under 
subsection (i) to the Inspector General of the Department 
of Homeland Security and the inspector general of any 
agency that was included in the Federal risk assessment.’’; 
(3) in section 3554— 
(A) in subsection (a)— 
(i) in paragraph (1)— 
(I) by redesignating subpara-
graphs (A), (B), and (C) as subpara-
graphs (B), (C), and (D), respectively; 
(II) by inserting before subpara-
graph (B), as so redesignated, the fol-
lowing: 
‘‘(A) on an ongoing and continuous basis, 
assessing agency system risk, as applicable, 
by— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) identifying and documenting the 
high value assets of the agency using guid-
ance from the Director; 
‘‘(ii) evaluating the data assets inven-
toried under section 3511 for sensitivity to 
compromises in confidentiality, integrity, 
and availability; 
‘‘(iii) identifying whether the agency 
is participating in federally offered cyber-
security shared services programs; 
‘‘(iv) identifying agency systems that 
have access to or hold the data assets 
inventoried under section 3511; 
‘‘(v) evaluating the threats facing 
agency systems and data, including high 
value assets, based on Federal and non- 
Federal cyber threat intelligence products, 
where available; 
‘‘(vi) evaluating the vulnerability of 
agency systems and data, including high 
value assets, including by analyzing— 
‘‘(I) the results of penetration 
testing performed by the Department 
of Homeland Security under section 
3553(b)(9); 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(II) the results of penetration 
testing 
performed 
under 
section 
3559A; 
‘‘(III) information provided to 
the agency through the vulnerability 
disclosure program of the agency 
under section 3559B; 
‘‘(IV) incidents; and 
‘‘(V) any other vulnerability in-
formation relating to agency systems 
that is known to the agency; 
‘‘(vii) assessing the impacts of poten-
tial agency incidents to agency systems, 
data, and operations based on the evalua-
tions described in clauses (ii) and (v) and 
the agency systems identified under clause 
(iv); and 
‘‘(viii) assessing the consequences of 
potential incidents occurring on agency 
systems that would impact systems at 
other 
agencies, 
including 
due 
to 
interconnectivity between different agency 
systems or operational reliance on the op-
erations of the system or data in the sys-
tem;’’; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(III) in subparagraph (B), as so 
redesignated, in the matter preceding 
clause (i), by striking ‘‘providing in-
formation’’ and inserting ‘‘using infor-
mation from the assessment required 
under subparagraph (A), providing in-
formation’’; 
(IV) in subparagraph (C), as so 
redesignated— 
(aa) in clause (ii) by insert-
ing 
‘‘binding’’ 
before 
‘‘oper-
ational’’; and 
(bb) in clause (vi), by strik-
ing ‘‘and’’ at the end; and 
(V) by adding at the end the fol-
lowing: 
‘‘(E) providing an update on the ongoing 
and continuous assessment required under sub-
paragraph (A)— 
‘‘(i) upon request, to the inspector 
general of the agency or the Comptroller 
General of the United States; and 
‘‘(ii) at intervals determined by guid-
ance issued by the Director, and to the ex-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
tent appropriate and practicable using au-
tomation, to— 
‘‘(I) the Director; 
‘‘(II) the Director of the Cyberse-
curity and Infrastructure Security 
Agency; and 
‘‘(III) the National Cyber Direc-
tor;’’; 
(ii) in paragraph (2)— 
(I) in subparagraph (A), by in-
serting ‘‘in accordance with the agen-
cy system risk assessment required 
under paragraph (1)(A)’’ after ‘‘infor-
mation systems’’; and 
(II) in subparagraph (D), by in-
serting ‘‘, through the use of penetra-
tion testing, the vulnerability disclo-
sure program established under sec-
tion 3559B, and other means,’’ after 
‘‘periodically’’; 
(iii) in paragraph (3)(A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘senior agency infor-
mation security officer’’ and inserting 
‘‘Chief Information Security Officer’’; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(II) in clause (i), by striking 
‘‘this section’’ and inserting ‘‘sub-
sections (a) through (c)’’; 
(III) in clause (ii), by striking 
‘‘training and’’ and inserting ‘‘skills, 
training, and’’; 
(IV) by redesignating clauses (iii) 
and (iv) as (iv) and (v), respectively; 
(V) by inserting after clause (ii) 
the following: 
‘‘(iii) manage information security, cy-
bersecurity budgets, and risk and compli-
ance activities and explain those concepts 
to the head of the agency and the executive 
team of the agency;’’; and 
(VI) in clause (iv), as so redesig-
nated, by striking ‘‘information secu-
rity duties as that official’s primary 
duty’’ and inserting ‘‘information, 
computer network, and technology se-
curity duties as the Chief Information 
Security Officers’ primary duty’’; 
(iv) in paragraph (5), by striking ‘‘an-
nually’’ and inserting ‘‘not less frequently 
than quarterly’’; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(v) in paragraph (6), by striking ‘‘offi-
cial delegated’’ and inserting ‘‘Chief Infor-
mation Security Officer delegated’’; 
(B) in subsection (b)— 
(i) by striking paragraph (1) and in-
serting the following: 
‘‘(1) the ongoing and continuous assessment of 
agency system risk required under subsection 
(a)(1)(A), which may include using guidance and 
automated tools consistent with standards and 
guidelines promulgated under section 11331 of title 
40, as applicable;’’; 
(ii) in paragraph (2)— 
(I) by striking subparagraph (B); 
(II) by redesignating subpara-
graphs (C) and (D) as subparagraphs 
(B) and (C), respectively; 
(III) in subparagraph (B), as so 
redesignated, by striking ‘‘and’’ at the 
end; and 
(IV) in subparagraph (C), as so 
redesignated— 
(aa) 
by 
redesignating 
clauses (iii) and (iv) as clauses 
(iv) and (v), respectively; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(bb) 
by 
inserting 
after 
clause (ii) the following: 
‘‘(iii) binding operational directives 
and emergency directives issued by the 
Secretary under section 3553;’’; and 
(cc) in clause (iv), as so re-
designated, by striking ‘‘as deter-
mined by the agency; and’’ and 
inserting ‘‘as determined by the 
agency, considering the agency 
risk assessment required under 
subsection (a)(1)(A); 
(iii) in paragraph (5)(A), by inserting 
‘‘, including penetration testing, as appro-
priate,’’ after ‘‘shall include testing’’; 
(iv) by redesignating paragraphs (7) 
and (8) as paragraphs (8) and (9), respec-
tively; 
(v) by inserting after paragraph (6) 
the following: 
‘‘(7) a secure process for providing the status 
of every remedial action and unremediated identified 
system vulnerability of a high value asset to the Di-
rector and the Director of the Cybersecurity and In-
frastructure Security Agency, using automation and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
machine-readable data to the greatest extent prac-
ticable;’’; and 
(vi) in paragraph (8)(C), as so redes-
ignated— 
(I) by striking clause (ii) and in-
serting the following: 
‘‘(ii) notifying and consulting with the 
Federal information security incident cen-
ter established under section 3556 pursu-
ant to the requirements of section 3594;’’; 
(II) by redesignating clause (iii) 
as clause (iv); 
(III) by inserting after clause (ii) 
the following: 
‘‘(iii) performing the notifications and 
other activities required under subchapter 
IV of this chapter; and’’; and 
(IV) in clause (iv), as so redesig-
nated— 
(aa) in subclause (II), by 
adding ‘‘and’’ at the end; 
(bb) by striking subclause 
(III); and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(cc) by redesignating sub-
clause (IV) as subclause (III); 
and 
(C) in subsection (c)— 
(i) by redesignating paragraph (2) as 
paragraph (5); 
(ii) by striking paragraph (1) and in-
serting the following: 
‘‘(1) BIENNIAL
REPORT.—Not later than 2 
years after the date of enactment of the Federal In-
formation Security Modernization Act of 2023 and 
not less frequently than once every 2 years there-
after, using the continuous and ongoing agency sys-
tem risk assessment required under subsection 
(a)(1)(A), the head of each agency shall submit to 
the Director, the National Cyber Director, the Di-
rector of the Cybersecurity and Infrastructure Secu-
rity Agency, the Comptroller General of the United 
States, the majority and minority leaders of the Sen-
ate, the Speaker and minority leader of the House 
of Representatives, the Committee on Homeland Se-
curity and Governmental Affairs of the Senate, the 
Committee on Oversight and Accountability of the 
House of Representatives, the Committee on Home-
land Security of the House of Representatives, the 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
Committee on Commerce, Science, and Transpor-
tation of the Senate, the Committee on Science, 
Space, and Technology of the House of Representa-
tives, and the appropriate authorization and appro-
priations committees of Congress a report that— 
‘‘(A) summarizes the agency system risk 
assessment required under subsection (a)(1)(A); 
‘‘(B) evaluates the adequacy and effective-
ness of information security policies, proce-
dures, and practices of the agency to address 
the risks identified in the agency system risk 
assessment required under subsection (a)(1)(A), 
including an analysis of the agency’s cybersecu-
rity and incident response capabilities using the 
metrics established under section 224(c) of the 
Cybersecurity Act of 2015 (6 U.S.C. 1522(c)); 
and 
‘‘(C) summarizes the status of remedial ac-
tions identified by inspector general of the 
agency, the Comptroller General of the United 
States, and any other source determined appro-
priate by the head of the agency. 
‘‘(2) UNCLASSIFIED
REPORTS.—Each report 
submitted under paragraph (1)— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) shall be, to the greatest extent prac-
ticable, in an unclassified and otherwise uncon-
trolled form; and 
‘‘(B) may include 1 or more annexes that 
contain classified or other sensitive information, 
as appropriate. 
‘‘(3) BRIEFINGS.—During each year during 
which a report is not required to be submitted under 
paragraph (1), the Director shall provide to the con-
gressional committees described in paragraph (1) a 
briefing summarizing current agency and Federal 
risk postures.’’; and 
(iii) in paragraph (5), as so redesig-
nated, by striking the period at the end 
and inserting ‘‘, including the reporting 
procedures 
established 
under 
section 
11315(d) of title 40 and subsection 
(a)(3)(A)(v) of this section’’; 
(4) in section 3555— 
(A) in the section heading, by striking 
‘‘ANNUAL
INDEPENDENT’’ 
and 
inserting 
‘‘INDEPENDENT’’; 
(B) in subsection (a)— 
(i) in paragraph (1), by inserting 
‘‘during which a report is required to be 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(iii) by adding at the end the fol-
lowing: 
‘‘(B) identify any entity that performs an 
independent evaluation under subsection (b).’’; 
and 
(F) by striking subsection (j) and inserting 
the following: 
‘‘(j) GUIDANCE.— 
‘‘(1) IN GENERAL.—The Director, in consulta-
tion with the Director of the Cybersecurity and In-
frastructure Security Agency, the Chief Information 
Officers Council, the Council of the Inspectors Gen-
eral on Integrity and Efficiency, and other interested 
parties as appropriate, shall ensure the development 
of risk-based guidance for evaluating the effective-
ness of an information security program and prac-
tices. 
‘‘(2) PRIORITIES.—The risk-based guidance de-
veloped under paragraph (1) shall include— 
‘‘(A) the identification of the most common 
successful threat patterns; 
‘‘(B) the identification of security controls 
that address the threat patterns described in 
subparagraph (A); 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(C) any other security risks unique to 
Federal systems; and 
‘‘(D) any other element the Director deter-
mines appropriate.’’; and 
(5) in section 3556(a)— 
(A) in the matter preceding paragraph (1), 
by inserting ‘‘within the Cybersecurity and In-
frastructure Security Agency’’ after ‘‘incident 
center’’; and 
(B) 
in 
paragraph 
(4), 
by 
striking 
‘‘3554(b)’’ and inserting ‘‘3554(a)(1)(A)’’. 
(d) CONFORMING AMENDMENTS.— 
(1) TABLE OF SECTIONS.—The table of sections 
for chapter 35 of title 44, United States Code, is 
amended by striking the item relating to section 
3555 and inserting the following: 
‘‘3555. Independent evaluation.’’. 
(2) OMB REPORTS.—Section 226(c) of the Cy-
bersecurity Act of 2015 (6 U.S.C. 1524(c)) is 
amended— 
(A) in paragraph (1)(B), in the matter 
preceding clause (i), by striking ‘‘annually 
thereafter’’ and inserting ‘‘thereafter during the 
years during which a report is required to be 
submitted under section 3553(c) of title 44, 
United States Code’’; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) in paragraph (2)(B), in the matter 
preceding clause (i)— 
(i) by striking ‘‘annually thereafter’’ 
and inserting ‘‘thereafter during the years 
during which a report is required to be 
submitted under section 3553(c) of title 
44, United States Code’’; and 
(ii) by striking ‘‘the report required 
under section 3553(c) of title 44, United 
States Code’’ and inserting ‘‘that report’’. 
(3) 
NIST 
RESPONSIBILITIES.—Section 
20(d)(3)(B) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3(d)(3)(B)) is 
amended by striking ‘‘annual’’. 
(e) FEDERAL SYSTEM INCIDENT RESPONSE.— 
(1) IN
GENERAL.—Chapter 35 of title 44, 
United States Code, is amended by adding at the 
end the following: 
‘‘SUBCHAPTER IV—FEDERAL SYSTEM 
INCIDENT RESPONSE 
‘‘§ 3591. Definitions 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(b), the definitions under sections 3502 and 3552 shall 
apply to this subchapter. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this 
subchapter: 
‘‘(1) APPROPRIATE REPORTING ENTITIES.—The 
term ‘appropriate reporting entities’ means— 
‘‘(A) the majority and minority leaders of 
the Senate; 
‘‘(B) the Speaker and minority leader of 
the House of Representatives; 
‘‘(C) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(D) 
the 
Committee 
on 
Commerce, 
Science, and Transportation of the Senate; 
‘‘(E) the Committee on Oversight and Ac-
countability of the House of Representatives; 
‘‘(F) the Committee on Homeland Security 
of the House of Representatives; 
‘‘(G) the Committee on Science, Space, 
and Technology of the House of Representa-
tives; 
‘‘(H) the appropriate authorization and ap-
propriations committees of Congress; 
‘‘(I) the Director; 
‘‘(J) the Director of the Cybersecurity and 
Infrastructure Security Agency; 
‘‘(K) the National Cyber Director; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(L) the Comptroller General of the 
United States; and 
‘‘(M) the inspector general of any impacted 
agency. 
‘‘(2) AWARDEE.—The term ‘awardee’, with re-
spect to an agency— 
‘‘(A) means— 
‘‘(i) the recipient of a grant from an 
agency; 
‘‘(ii) a party to a cooperative agree-
ment with an agency; and 
‘‘(iii) a party to an other transaction 
agreement with an agency; and 
‘‘(B) includes a subawardee of an entity 
described in subparagraph (A). 
‘‘(3) BREACH.—The term ‘breach’— 
‘‘(A) means the compromise, unauthorized 
disclosure, unauthorized acquisition, or loss of 
control of personally identifiable information or 
any similar occurrence; and 
‘‘(B) includes any additional meaning 
given the term in policies, principles, standards, 
or guidelines issued by the Director. 
‘‘(4) 
CONTRACTOR.—The 
term 
‘contractor’ 
means a prime contractor of an agency or a subcon-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
tractor of a prime contractor of an agency that cre-
ates, collects, stores, processes, maintains, or trans-
mits Federal information on behalf of an agency. 
‘‘(5) FEDERAL INFORMATION.—The term ‘Fed-
eral information’ means information created, col-
lected, processed, maintained, disseminated, dis-
closed, or disposed of by or for the Federal Govern-
ment in any medium or form. 
‘‘(6) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ means an infor-
mation system owned, managed, or operated by an 
agency, or on behalf of an agency by a contractor, 
an awardee, or another organization. 
‘‘(7) INTELLIGENCE
COMMUNITY.—The term 
‘intelligence community’ has the meaning given the 
term in section 3 of the National Security Act of 
1947 (50 U.S.C. 3003). 
‘‘(8) 
NATIONWIDE
CONSUMER
REPORTING 
AGENCY.—The term ‘nationwide consumer reporting 
agency’ means a consumer reporting agency de-
scribed in section 603(p) of the Fair Credit Report-
ing Act (15 U.S.C. 1681a(p)). 
‘‘(9) VULNERABILITY DISCLOSURE.—The term 
‘vulnerability disclosure’ means a vulnerability iden-
tified under section 3559B. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘§ 3592. Notification of breach 
‘‘(a) DEFINITION.—In this section, the term ‘covered 
breach’ means a breach— 
‘‘(1) involving not less than 50,000 potentially 
affected individuals; or 
‘‘(2) the result of which the head of an agency 
determines that notifying potentially affected indi-
viduals is necessary pursuant to subsection (b)(1), 
regardless of whether— 
‘‘(A) the number of potentially affected in-
dividuals is less than 50,000; or 
‘‘(B) the notification is delayed under sub-
section (d). 
‘‘(b) NOTIFICATION.—As expeditiously as practicable 
and without unreasonable delay, and in any case not later 
than 45 days after an agency has a reasonable basis to 
conclude that a breach has occurred, the head of the agen-
cy, in consultation with the Chief Information Officer and 
Chief Privacy Officer of the agency, shall— 
‘‘(1) determine whether notice to any individual 
potentially affected by the breach is appropriate, in-
cluding by conducting an assessment of the risk of 
harm to the individual that considers— 
‘‘(A) the nature and sensitivity of the per-
sonally identifiable information affected by the 
breach; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) the likelihood of access to and use of 
the personally identifiable information affected 
by the breach; 
‘‘(C) the type of breach; and 
‘‘(D) any other factors determined by the 
Director; and 
‘‘(2) if the head of the agency determines notifi-
cation is necessary pursuant to paragraph (1), pro-
vide written notification in accordance with sub-
section (c) to each individual potentially affected by 
the breach— 
‘‘(A) to the last known mailing address of 
the individual; or 
‘‘(B) through an appropriate alternative 
method of notification. 
‘‘(c) CONTENTS OF NOTIFICATION.—Each notifica-
tion of a breach provided to an individual under subsection 
(b)(2) shall include, to the maximum extent practicable— 
‘‘(1) a brief description of the breach; 
‘‘(2) if possible, a description of the types of 
personally identifiable information affected by the 
breach; 
‘‘(3) contact information of the agency that 
may be used to ask questions of the agency, which— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) shall include an e-mail address or an-
other digital contact mechanism; and 
‘‘(B) may include a telephone number, 
mailing address, or a website; 
‘‘(4) information on any remedy being offered 
by the agency; 
‘‘(5) any applicable educational materials relat-
ing to what individuals can do in response to a 
breach that potentially affects their personally iden-
tifiable information, including relevant contact infor-
mation for the appropriate Federal law enforcement 
agencies and each nationwide consumer reporting 
agency; and 
‘‘(6) any other appropriate information, as de-
termined by the head of the agency or established in 
guidance by the Director. 
‘‘(d) DELAY OF NOTIFICATION.— 
‘‘(1) IN GENERAL.—The head of an agency, in 
coordination with the Director and the National 
Cyber Director, and as appropriate, the Attorney 
General, the Director of National Intelligence, or the 
Secretary of Homeland Security, may delay a notifi-
cation required under subsection (b) or (e) if the no-
tification would— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) impede a criminal investigation or a 
national security activity; 
‘‘(B) cause an adverse result (as described 
in section 2705(a)(2) of title 18); 
‘‘(C) reveal sensitive sources and methods; 
‘‘(D) cause damage to national security; or 
‘‘(E) hamper security remediation actions. 
‘‘(2) RENEWAL.—A delay under paragraph (1) 
shall be for a period of 60 days and may be renewed. 
‘‘(3) NATIONAL SECURITY SYSTEMS.—The head 
of an agency delaying notification under this sub-
section with respect to a breach exclusively of a na-
tional security system shall coordinate such delay 
with the Secretary of Defense. 
‘‘(e) UPDATE NOTIFICATION.—If an agency deter-
mines there is a significant change in the reasonable basis 
to conclude that a breach occurred, a significant change 
to the determination made under subsection (b)(1), or that 
it is necessary to update the details of the information pro-
vided to potentially affected individuals as described in 
subsection (c), the agency shall as expeditiously as prac-
ticable and without unreasonable delay, and in any case 
not later than 30 days after such a determination, notify 
each individual who received a notification pursuant to 
subsection (b) of those changes. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(f) DELAY OF NOTIFICATION REPORT.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Federal Information 
Security Modernization Act of 2023, and annually 
thereafter, the head of an agency, in coordination 
with any official who delays a notification under sub-
section (d), shall submit to the appropriate reporting 
entities a report on each delay that occurred during 
the previous 2 years. 
‘‘(2) COMPONENT
OF
OTHER
REPORT.—The 
head of an agency may submit the report required 
under paragraph (1) as a component of the report 
submitted under section 3554(c). 
‘‘(g) 
CONGRESSIONAL
REPORTING
REQUIRE-
MENTS.— 
‘‘(1) REVIEW
AND
UPDATE.—On a periodic 
basis, the Director of the Office of Management and 
Budget shall review, and update as appropriate, 
breach notification policies and guidelines for agen-
cies. 
‘‘(2) REQUIRED
NOTICE
FROM
AGENCIES.— 
Subject to paragraph (4), the Director of the Office 
of Management and Budget shall require the head 
of an agency affected by a covered breach to expedi-
tiously and not later than 30 days after the date on 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
which the agency discovers the covered breach give 
notice of the breach, which may be provided elec-
tronically, to— 
‘‘(A) each congressional committee de-
scribed in section 3554(c)(1); and 
‘‘(B) the Committee on the Judiciary of 
the Senate and the Committee on the Judiciary 
of the House of Representatives. 
‘‘(3) CONTENTS OF NOTICE.—Notice of a cov-
ered breach provided by the head of an agency pur-
suant to paragraph (2) shall include, to the extent 
practicable— 
‘‘(A) information about the covered breach, 
including a summary of any information about 
how the covered breach occurred known by the 
agency as of the date of the notice; 
‘‘(B) an estimate of the number of individ-
uals affected by the covered breach based on in-
formation known by the agency as of the date 
of the notice, including an assessment of the 
risk of harm to affected individuals; 
‘‘(C) a description of any circumstances 
necessitating a delay in providing notice to indi-
viduals affected by the covered breach in ac-
cordance with subsection (d); and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(iv) any other agency; 
‘‘(E) the authority of the head of an agen-
cy to provide information to Congress about 
agency breaches, including— 
‘‘(i) breaches that are not covered 
breaches; and 
‘‘(ii) additional information beyond 
the information described in subsection 
(g)(3); or 
‘‘(F) any congressional reporting require-
ments of agencies under any other law; or 
‘‘(2) limit or supersede any existing privacy 
protections in existing law. 
‘‘§ 3593. Congressional and executive branch reports 
on major incidents 
‘‘(a) APPROPRIATE CONGRESSIONAL ENTITIES.—In 
this section, the term ‘appropriate congressional entities’ 
means— 
‘‘(1) the majority and minority leaders of the 
Senate; 
‘‘(2) the Speaker and minority leader of the 
House of Representatives; 
‘‘(3) the Committee on Homeland Security and 
Governmental Affairs of the Senate; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(4) the Committee on Commerce, Science, and 
Transportation of the Senate; 
‘‘(5) the Committee on Oversight and Account-
ability of the House of Representatives; 
‘‘(6) the Committee on Homeland Security of 
the House of Representatives; 
‘‘(7) the Committee on Science, Space, and 
Technology of the House of Representatives; and 
‘‘(8) the appropriate authorization and appro-
priations committees of Congress. 
‘‘(b) INITIAL NOTIFICATION.— 
‘‘(1) IN GENERAL.—Not later than 72 hours 
after an agency has a reasonable basis to conclude 
that a major incident occurred, the head of the 
agency impacted by the major incident shall submit 
to the appropriate reporting entities a written notifi-
cation, which may be submitted electronically and 
include 1 or more annexes that contain classified or 
other sensitive information, as appropriate. 
‘‘(2) CONTENTS.—A notification required under 
paragraph (1) with respect to a major incident shall 
include the following, based on information available 
to agency officials as of the date on which the agen-
cy submits the notification: 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) A summary of the information avail-
able about the major incident, including how 
the major incident occurred and the threat 
causing the major incident. 
‘‘(B) If applicable, information relating to 
any breach associated with the major incident, 
regardless of whether— 
‘‘(i) the breach was the reason the in-
cident was determined to be a major inci-
dent; and 
‘‘(ii) head of the agency determined it 
was appropriate to provide notification to 
potentially impacted individuals pursuant 
to section 3592(b)(1). 
‘‘(C) A preliminary assessment of the im-
pacts to— 
‘‘(i) the agency; 
‘‘(ii) the Federal Government; 
‘‘(iii) the national security, foreign re-
lations, homeland security, and economic 
security of the United States; and 
‘‘(iv) the civil liberties, public con-
fidence, privacy, and public health and 
safety of the people of the United States. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(D) If applicable, whether any ransom 
has been demanded or paid, or is expected to be 
paid, by any entity operating a Federal infor-
mation system or with access to Federal infor-
mation or a Federal information system, includ-
ing, as available, the name of the entity de-
manding ransom, the date of the demand, and 
the amount and type of currency demanded, un-
less disclosure of such information will disrupt 
an active Federal law enforcement or national 
security operation. 
‘‘(c) SUPPLEMENTAL UPDATE.—Within a reasonable 
amount of time, but not later than 30 days after the date 
on which the head of an agency submits a written notifica-
tion under subsection (a), the head of the agency shall 
provide to the appropriate congressional entities an un-
classified and written update, which may include 1 or 
more annexes that contain classified or other sensitive in-
formation, as appropriate, on the major incident, based 
on information available to agency officials as of the date 
on which the agency provides the update, on— 
‘‘(1) system vulnerabilities relating to the major 
incident, where applicable, means by which the 
major incident occurred, the threat causing the 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
major incident, where applicable, and impacts of the 
major incident to— 
‘‘(A) the agency; 
‘‘(B) other Federal agencies, Congress, or 
the judicial branch; 
‘‘(C) the national security, foreign rela-
tions, homeland security, or economic security 
of the United States; or 
‘‘(D) the civil liberties, public confidence, 
privacy, or public health and safety of the peo-
ple of the United States; 
‘‘(2) the status of compliance of the affected 
Federal information system with applicable security 
requirements at the time of the major incident; 
‘‘(3) if the major incident involved a breach, a 
description of the affected information, an estimate 
of the number of individuals potentially impacted, 
and any assessment to the risk of harm to such indi-
viduals; 
‘‘(4) an update to the assessment of the risk to 
agency operations, or to impacts on other agency or 
non-Federal entity operations, affected by the major 
incident; and 
‘‘(5) the detection, response, and remediation 
actions of the agency, including any support pro-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
vided by the Cybersecurity and Infrastructure Secu-
rity Agency under section 3594(d), if applicable. 
‘‘(d) ADDITIONAL UPDATE.—If the head of an agen-
cy, the Director, or the National Cyber Director deter-
mines that there is any significant change in the under-
standing of the scope, scale, or consequence of a major 
incident for which the head of the agency submitted a 
written notification and update under subsections (b) and 
(c), the head of the agency shall submit to the appropriate 
congressional entities a written update that includes infor-
mation relating to the change in understanding. 
‘‘(e) BIENNIAL REPORT.—Each agency shall submit 
as part of the biennial report required under section 
3554(c)(1) a description of each major incident that oc-
curred during the 2-year period preceding the date on 
which the biennial report is submitted. 
‘‘(f) REPORT DELIVERY.— 
‘‘(1) IN GENERAL.—Any written notification or 
update required to be submitted under this section— 
‘‘(A) shall be submitted in an electronic 
format; and 
‘‘(B) may be submitted in a paper format. 
‘‘(2) CLASSIFICATION
STATUS.—Any written 
notification or update required to be submitted 
under this section— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) shall be— 
‘‘(i) unclassified; and 
‘‘(ii) submitted through unclassified 
electronic means pursuant to paragraph 
(1)(A); and 
‘‘(B) may include classified annexes, as ap-
propriate. 
‘‘(g) REPORT CONSISTENCY.—To achieve consistent 
and coherent agency reporting to Congress, the National 
Cyber Director, in coordination with the Director, shall— 
‘‘(1) provide recommendations to agencies on 
formatting and the contents of information to be in-
cluded in the reports required under this section, in-
cluding recommendations for consistent formats for 
presenting any associated metrics; and 
‘‘(2) maintain a comprehensive record of each 
major incident notification, update, and briefing pro-
vided under this section, which shall— 
‘‘(A) include, at a minimum— 
‘‘(i) the full contents of the written 
notification or update; 
‘‘(ii) the identity of the reporting 
agency; and 
‘‘(iii) the date of submission; and 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(iv) a list of the recipient congres-
sional entities; and 
‘‘(B) be made available upon request to the 
majority and minority leaders of the Senate, the 
Speaker and minority leader of the House of 
Representatives, the Committee on Homeland 
Security and Governmental Affairs of the Sen-
ate, and the Committee on Oversight and Ac-
countability of the House of Representatives. 
‘‘(h) NATIONAL SECURITY SYSTEMS CONGRESSIONAL 
REPORTING EXEMPTION.—With respect to a major inci-
dent that occurs exclusively on a national security system, 
the head of the affected agency shall submit the notifica-
tions and reports required to be submitted to Congress 
under this section only to— 
‘‘(1) the majority and minority leaders of the 
Senate; 
‘‘(2) the Speaker and minority leader of the 
House of Representatives; 
‘‘(3) the appropriations committees of Con-
gress; 
‘‘(4) the appropriate authorization committees 
of Congress; 
‘‘(5) the Committee on Homeland Security and 
Governmental Affairs of the Senate; 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(6) the Select Committee on Intelligence of the 
Senate; 
‘‘(7) the Committee on Oversight and Account-
ability of the House of Representatives; and 
‘‘(8) the Permanent Select Committee on Intel-
ligence of the House of Representatives. 
‘‘(i) MAJOR INCIDENTS INCLUDING BREACHES.—If 
a major incident constitutes a covered breach, as defined 
in section 3592(a), information on the covered breach re-
quired to be submitted to Congress pursuant to section 
3592(g) may— 
‘‘(1) be included in the notifications required 
under subsection (b) or (c); or 
‘‘(2) be reported to Congress under the process 
established under section 3592(g). 
‘‘(j) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to— 
‘‘(1) limit— 
‘‘(A) the ability of an agency to provide ad-
ditional reports or briefings to Congress; 
‘‘(B) Congress from requesting additional 
information from agencies through reports, 
briefings, or other means; 
‘‘(C) any congressional reporting require-
ments of agencies under any other law; or 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(2) limit or supersede any privacy protections 
under any other law. 
‘‘§ 3594. Government information sharing and inci-
dent response 
‘‘(a) IN GENERAL.— 
‘‘(1) INCIDENT
SHARING.—Subject to para-
graph (4) and subsection (b), and in accordance 
with the applicable requirements pursuant to section 
3553(b)(2)(A) for reporting to the Federal informa-
tion security incident center established under sec-
tion 3556, the head of each agency shall provide to 
the Cybersecurity and Infrastructure Security Agen-
cy information relating to any incident affecting the 
agency, whether the information is obtained by the 
Federal Government directly or indirectly. 
‘‘(2) CONTENTS.—A provision of information 
relating to an incident made by the head of an agen-
cy under paragraph (1) shall include, at a min-
imum— 
‘‘(A) a full description of the incident, in-
cluding— 
‘‘(i) all indicators of compromise and 
tactics, techniques, and procedures; 
‘‘(ii) an indicator of how the intruder 
gained initial access, accessed agency data 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
or systems, and undertook additional ac-
tions on the network of the agency; 
‘‘(iii) information that would support 
enabling defensive measures; and 
‘‘(iv) other information that may as-
sist in identifying other victims; 
‘‘(B) information to help prevent similar 
incidents, such as information about relevant 
safeguards in place when the incident occurred 
and the effectiveness of those safeguards; and 
‘‘(C) information to aid in incident re-
sponse, such as— 
‘‘(i) a description of the affected sys-
tems or networks; 
‘‘(ii) the estimated dates of when the 
incident occurred; and 
‘‘(iii) information that could reason-
ably help identify any malicious actor that 
may have conducted or caused the inci-
dent, subject to appropriate privacy protec-
tions. 
‘‘(3) INFORMATION SHARING.—The Director of 
the Cybersecurity and Infrastructure Security Agen-
cy shall— 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) make incident information provided 
under paragraph (1) available to the Director 
and the National Cyber Director; 
‘‘(B) to the greatest extent practicable, 
share information relating to an incident with— 
‘‘(i) the head of any agency that may 
be— 
‘‘(I) impacted by the incident; 
‘‘(II) particularly susceptible to 
the incident; or 
‘‘(III) similarly targeted by the 
incident; and 
‘‘(ii) appropriate Federal law enforce-
ment agencies to facilitate any necessary 
threat response activities, as requested; 
‘‘(C) coordinate any necessary information 
sharing efforts relating to a major incident with 
the private sector; and 
‘‘(D) notify the National Cyber Director of 
any efforts described in subparagraph (C). 
‘‘(4) NATIONAL
SECURITY
SYSTEMS
EXEMP-
TION.— 
‘‘(A) 
IN
GENERAL.—Notwithstanding 
paragraphs (1) and (3), each agency operating 
or exercising control of a national security sys-
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(c) DELEGATION OF AUTHORITY FOR CERTAIN SYS-
TEMS.—The authorities of the Director described in sub-
section (a) shall be delegated to— 
‘‘(1) the Secretary of Defense in the case of a 
system described in section 3553(e)(2); and 
‘‘(2) the Director of National Intelligence in the 
case of a system described in section 3553(e)(3).’’. 
(b) EXISTING GUIDANCE.— 
(1) IN
GENERAL.—Compliance with guidance 
issued by the Director relating to penetration testing 
before the date of enactment of this Act shall be 
deemed to be compliant with section 3559A of title 
44, United States Code, as added by this Act. 
(2) IMMEDIATE
NEW
GUIDANCE
NOT
RE-
QUIRED.—Nothing in section 3559A of title 44, 
United States Code, as added by this Act, shall be 
construed to require the Director to issue new guid-
ance to agencies relating to penetration testing be-
fore the date described in paragraph (3). 
(3) 
GUIDANCE
UPDATES.—Notwithstanding 
paragraphs (1) and (2), not later than 2 years after 
the date of enactment of this Act, the Director shall 
review and, as appropriate, update existing guidance 
requiring penetration testing by agencies. 
VerDate Sep 11 2014 
21:38 Aug 11, 2023
Jkt 039200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H4552.IH
H4552
pbinns on DSKJLVW7X2PROD with $$_JOB