IoT Cybersecurity Improvement Act of 2020

Bill: 116-hr-1668
Sponsor: Rep. Kelly, Robin L. [D-IL-2]
Introduced: 2019-03-11 in the House
Policy area: Government Operations and Politics
Subjects: Administrative law and regulatory procedures
Computer security and identity theft
Computers and information technology
Government information and archives
Government studies and investigations
Internet and video services
Internet, web applications, social media
Office of Management and Budget (OMB)
Public contracts and procurement

Summary:
action_date: 2019-03-11
text: 

Internet of Things Cybersecurity Improvement Act of 2019 or the IoT Cybersecurity Improvement Act of 2019

 
This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects.
 
The bill establishes September 30, 2019, as the deadline for the completion of NIST's efforts regarding considerations for managing IoT cybersecurity risks, especially regarding examples of possible cybersecurity capabilities of IoT devices. By March 31, 2020, NIST must develop recommendations for the appropriate use and management of IoT devices owned or controlled by the government, including minimum information security requirements for managing cybersecurity risks.
 
The OMB shall then issue guidelines for each agency that are consistent with such recommendations.
 
NIST and the OMB shall publish guidance on policies and procedures for the reporting, coordinating, publishing, and receiving of information about a security vulnerability relating to an IoT device used by the government and the resolution of such security vulnerability.

action_date: 2020-09-14
text: 

Internet of Things Cybersecurity Improvement Act of 2020 or the IoT Cybersecurity Improvement Act of 2020
 
 
 
This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects.
 
Specifically, the bill requires NIST to develop and publish standards and guidelines for the federal government on the appropriate use and management by agencies of IoT devices owned or controlled by an agency and connected to information systems owned or controlled by an agency, including minimum information security requirements for managing cybersecurity risks associated with such devices.
 
The bill requires the OMB to review agency information security policies and principles on the basis of the NIST standards and guidelines and issue such policies and principles as necessary to ensure the agency policies and principles are consistent with the NIST standards and guidelines. 
 
NIST shall review and revise, as appropriate, the standards and guidelines every five years. The OMB shall update any policy or principle to be consistent with NIST revisions. 
 
NIST shall develop and publish guidelines for agency, contractor, and subcontractor communications regarding security vulnerabilities.

The OMB shall develop and oversee the implementation of policies, principles, standards, or guidelines as necessary to address security vulnerabilities of information systems. 

An agency is prohibited from procuring, obtaining, or using an IoT device if the agency determines during a review of a contract that the use of such device prevents compliance with the standards and guidelines, subject to a waiver where necessary for national security, for research purposes, or where such device is secured using alternative effective methods. 

The Government Accountability Office shall report to Congress on broader IoT efforts.

action_date: 2020-11-17
text: 

Internet of Things Cybersecurity Improvement Act of 2020 or the IoT Cybersecurity Improvement Act of 2020

 
This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects.
 
Specifically, the bill requires NIST to develop and publish standards and guidelines for the federal government on the appropriate use and management by agencies of IoT devices owned or controlled by an agency and connected to information systems owned or controlled by an agency, including minimum information security requirements for managing cybersecurity risks associated with such devices.
 
The bill requires the OMB to review agency information security policies and principles on the basis of the NIST standards and guidelines and issue such policies and principles as necessary to ensure the agency policies and principles are consistent with the NIST standards and guidelines. 
 
NIST shall review and revise, as appropriate, the standards and guidelines every five years. The OMB shall update any policy or principle to be consistent with NIST revisions. 
 
NIST shall develop and publish guidelines for agency, contractor, and subcontractor communications regarding security vulnerabilities.

The OMB shall develop and oversee the implementation of policies, principles, standards, or guidelines as necessary to address security vulnerabilities of information systems. 

An agency is prohibited from procuring, obtaining, or using an IoT device if the agency determines during a review of a contract that the use of such device prevents compliance with the standards and guidelines, subject to a waiver where necessary for national security, for research purposes, or where such device is secured using alternative effective methods. 

The Government Accountability Office shall report to Congress on broader IoT efforts.

action_date: 2020-12-04
text: 

Internet of Things Cybersecurity Improvement Act of 2020 or the IoT Cybersecurity Improvement Act of 2020

 
This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects.
 
Specifically, the bill requires NIST to develop and publish standards and guidelines for the federal government on the appropriate use and management by agencies of IoT devices owned or controlled by an agency and connected to information systems owned or controlled by an agency, including minimum information security requirements for managing cybersecurity risks associated with such devices.
 
The bill requires the OMB to review agency information security policies and principles on the basis of the NIST standards and guidelines and issue such policies and principles as necessary to ensure the agency policies and principles are consistent with the NIST standards and guidelines. 
 
NIST shall review and revise, as appropriate, the standards and guidelines every five years. The OMB shall update any policy or principle to be consistent with NIST revisions. 
 
NIST shall develop and publish guidelines for agency, contractor, and subcontractor communications regarding security vulnerabilities.

The OMB shall develop and oversee the implementation of policies, principles, standards, or guidelines as necessary to address security vulnerabilities of information systems. 

An agency is prohibited from procuring, obtaining, or using an IoT device if the agency determines during a review of a contract that the use of such device prevents compliance with the standards and guidelines, subject to a waiver where necessary for national security, for research purposes, or where such device is secured using alternative effective methods. 

The Government Accountability Office shall report to Congress on broader IoT efforts.


Legislative actions:
action_date: 2020-12-04
text: Became Public Law No: 116-207.
action_date: 2020-12-04
text: Became Public Law No: 116-207.
action_date: 2020-12-04
text: Signed by President.
action_date: 2020-12-04
text: Signed by President.
action_date: 2020-11-24
text: Presented to President.
action_date: 2020-11-24
text: Presented to President.
action_date: 2020-11-18
text: Message on Senate action sent to the House.
action_date: 2020-11-17
text: Passed Senate without amendment by Unanimous Consent. (consideration: CR S7043-7044)
action_date: 2020-11-17
text: Passed/agreed to in Senate: Passed Senate without amendment by Unanimous Consent.(consideration: CR S7043-7044)
action_date: 2020-09-15
text: Received in the Senate, read twice.
action_date: 2020-09-14
text: The title of the measure was amended. Agreed to without objection.
action_date: 2020-09-14
text: Motion to reconsider laid on the table Agreed to without objection.
action_date: 2020-09-14
text: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H4351-4352)
action_date: 2020-09-14
text: Passed/agreed to in House: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote.
action_date: 2020-09-14
text: DEBATE - The House proceeded with forty minutes of debate on H.R. 1668.
action_date: 2020-09-14
text: Considered under suspension of the rules. (consideration: CR H4351-4354)
action_date: 2020-09-14
text: Mrs. Maloney, Carolyn B. moved to suspend the rules and pass the bill, as amended.
action_date: 2020-09-14
text: Placed on the Union Calendar, Calendar No. 402.
action_date: 2020-09-14
text: Committee on Science, Space, and Technology discharged.
action_date: 2020-09-14
text: Committee on Science, Space, and Technology discharged.
action_date: 2020-09-14
text: Reported (Amended) by the Committee on Oversight and Reform. H. Rept. 116-501, Part I.
action_date: 2020-09-14
text: Reported (Amended) by the Committee on Oversight and Reform. H. Rept. 116-501, Part I.
action_date: 2019-06-12
text: Ordered to be Reported in the Nature of a Substitute by Voice Vote.
action_date: 2019-06-12
text: Committee Consideration and Mark-up Session Held.
action_date: 2019-03-11
text: Referred to the Subcommittee on Research and Technology.
action_date: 2019-03-11
text: Referred to the Committee on Oversight and Reform, and in addition to the Committee on Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
action_date: 2019-03-11
text: Referred to the Committee on Oversight and Reform, and in addition to the Committee on Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
action_date: 2019-03-11
text: Introduced in House
action_date: 2019-03-11
text: Introduced in House

Enacted as: number: 116-207