Ensuring Cybersecurity at the NIH Act of 2022

Bill: 117-hr-9228
Sponsor: full_name: Rep. Griffith, H. Morgan [R-VA-9]
Introduced: 2022-10-25
Policy area: Health
Latest action: action_date: 2022-10-26
text: Referred to the Subcommittee on Health.

Summaries:
action_date: 2022-10-25
action_desc: Introduced in House
text: <p><b>Ensuring Cybersecurity at the NIH Act of 2022</b></p> <p>This bill tasks the National Institutes of Health with strengthening information security protections for its data and systems, including through developing and implementing relevant policies, standards, and guidelines.</p>

tv_txt: I 117th CONGRESS 2d Session H. R. 9228 IN THE HOUSE OF REPRESENTATIVES October 25, 2022 Mr. Griffith introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend the Public Health Service Act with respect to the information security policies and practices of the National Institutes of Health, and for other purposes.

1. Short title This Act may be cited as the Ensuring Cybersecurity at the NIH Act of 2022 . 2. NIH information security policies and practices Section 402(b) of the Public Health Service Act ( 42 U.S.C. 282(b) ) is amended— (1) in paragraph (24), by striking and at the end; (2) in paragraph (25), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (26) shall, in consultation with the Office of the Chief Information Officer, oversee information security policies and practices of the National Institutes of Health, including— (A) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely adoption of and compliance with standards promulgated under section 11331 of title 40, United States Code, including— (i) developing and reporting a complete inventory of all major information systems; (ii) fully developing a risk management strategy and assessing risks for reviewed systems; (iii) fully developing and documenting system security plans; and (iv) consistently authorizing systems based on defined system boundaries; and (B) identifying and providing information security protections commensurate with the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruptions, modification, or destruction of— (i) information collected or maintained by or on behalf of the National Institutes of Health; (ii) information systems used or operated by the National Institutes of Health or by a contractor of the agency or other organization on behalf of the agency; and (iii) coordinating information security policies and procedures with related information resources management policies and procedures. .