Section 1 Short title
This Act may be cited as the “Ensuring Cybersecurity at the NIH Act of 2022”.
Ensuring Cybersecurity at the NIH Act of 2022
A BILL
To amend the Public Health Service Act with respect to the information security policies and practices of the National Institutes of Health, and for other purposes.
Sec. 2 NIH information security policies and practices
Section 402(b) of the Public Health Service Act (42 U.S.C. 282(b)) is amended—
in paragraph (24), by striking “and” at the end;
in paragraph (25), by striking the period at the end and inserting “; and”; and
by adding at the end the following:
“(26) shall, in consultation with the Office of the Chief Information Officer, oversee information security policies and practices of the National Institutes of Health, including—
“(A) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely adoption of and compliance with standards promulgated under section 11331 of title 40, United States Code, including—
“(i) developing and reporting a complete inventory of all major information systems;
“(ii) fully developing a risk management strategy and assessing risks for reviewed systems;
“(iii) fully developing and documenting system security plans; and
“(iv) consistently authorizing systems based on defined system boundaries; and
“(B) identifying and providing information security protections commensurate with the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruptions, modification, or destruction of—
“(i) information collected or maintained by or on behalf of the National Institutes of Health;
“(ii) information systems used or operated by the National Institutes of Health or by a contractor of the agency or other organization on behalf of the agency; and
“(iii) coordinating information security policies and procedures with related information resources management policies and procedures.”