Federal Information Security Modernization Act of 2021

Bill: 117-s-2902
Sponsor: Sen. Peters, Gary C. [D-MI]
Introduced: 2021-09-29 in the Senate
Policy area: Government Operations and Politics
Subjects: Computer security and identity theft
Congressional oversight
Department of Homeland Security
Employment and training programs
Government employee pay, benefits, personnel management
Government information and archives
Government studies and investigations
Performance measurement
Right of privacy
Technology assessment

Summary:
action_date: 2021-09-29
text: 

Federal Information Security Modernization Act of 2021

 
This bill addresses federal information security management, notification and remediation of cybersecurity incidents, and the role of the Office of Management and Budget (OMB) and the Cybersecurity and Infrastructure Security Agency (CISA).
 
The OMB and CISA must perform, on an ongoing and continuous basis, assessments of federal risk posture. The bill requires annual evaluation by each agency of whether additional cybersecurity procedures are appropriate.
 
An agency, within 30 days of concluding that a major incident has occurred due to a high risk exposure of personal identifiable information, must provide notification to the last known home mailing address of each individual whom the incident may have impacted. Notification may be delayed under specified circumstances.
 
Each agency must provide any information relating to an incident to CISA, the OMB, the Office of the National Cyber Director, the Government Accountability Office, and Congress. An agency's contractors and grant recipients must immediately notify the agency of an incident involving federal information.
 
Each agency shall develop training for individuals at the agency with access to federal information or information systems on how to identify and respond to an incident.
 
The OMB and CISA must (1) develop and promulgate guidance on the definition of
 major incident
, and (2) develop a framework for prioritizing federal penetration testing resources among agencies. CISA must establish a program to provide ongoing, hypothesis-driven threat-hunting services on the network of each agency.
 
The bill establishes specified pilot programs to enhance federal cybersecurity.

action_date: 2022-12-19
text: 

Federal Information Security Modernization Act of 2021

 
This bill addresses federal information security management, notification and remediation of cybersecurity incidents. 
 
For example, the bill requires (1) the Cybersecurity and Infrastructure Security Agency to perform ongoing and continuous assessments of federal information security risk posture; and (2) federal agencies to take certain actions in response to information security breaches, such as notifying affected individuals. 


Legislative actions:
action_date: 2022-12-19
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 673.
action_date: 2022-12-19
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-274.
action_date: 2022-12-19
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-274.
action_date: 2021-10-06
text: Committee on Homeland Security and Governmental Affairs. Ordered to be reported with an amendment in the nature of a substitute favorably.
action_date: 2021-09-29
text: Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
action_date: 2021-09-29
text: Introduced in Senate