S. 3600 — what changed

“(v) confidentiality, privacy, disclosure, and sharing of information;”

“(vi) in consultation with the National Cyber Director, security of information; and”

“(1) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, disclosure, and sharing, and in consultation with the National Cyber Director, oversee the implementation of policies, principles, standards, and guidelines on security, of information collected or maintained by or for agencies; and”

“(D) maintained on a continual basis through the use of automation, machine-readable data, and scanning, wherever practicable.”

“(c) Each agency providing a written plan under subsection (b) shall provide any portion of the written plan addressing information security to the Secretary of the Department of Homeland Security and the National Cyber Director.”

“(1) The term additional cybersecurity procedure means a process, procedure, or other activity that is established in excess of the information security standards promulgated under section 11331(b) of title 40 to increase the security and reduce the cybersecurity risk of agency systems.”

“(3) The term high value asset means information or an information system that the head of an agency, using policies, principles, standards, or guidelines issued by the Director under section 3553(a), determines to be so critical to the agency that the loss or corruption of the information or the loss of access to the information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business.”

“(8) The term major incident has the meaning given the term in guidance issued by the Director under section 3598(a).”

“(10) The term penetration test—

“(A) means an authorized assessment that emulates attempts to gain unauthorized access to, or disrupt the operations of, an information system or component of an information system; and

“(B) includes any additional meaning given the term in policies, principles, standards, or guidelines issued by the Director under section 3553(a).”

“(12) The term shared service means a centralized business or mission capability that is provided to multiple organizations within an agency or to multiple agencies.”

“(7) recognize that each agency has specific mission requirements and, at times, unique cybersecurity requirements to meet the mission of the agency;

“(8) recognize that each agency does not have the same resources to secure agency systems, and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone; and

“(9) recognize that a holistic Federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies.”

“(8) promoting, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, and the Director of the National Institute of Standards and Technology—

“(A) the use of automation to improve Federal cybersecurity and visibility with respect to the implementation of Federal cybersecurity; and

“(B) the use of presumption of compromise and least privilege principles to improve resiliency and timely response actions to incidents on Federal systems.”

“(4) a summary of each assessment of Federal risk posture performed under subsection (i);”

“(i) Federal risk assessments—On an ongoing and continuous basis, the Director of the Cybersecurity and Infrastructure Security Agency shall perform assessments of Federal risk posture using any available information on the cybersecurity posture of agencies, and brief the Director and National Cyber Director on the findings of those assessments including—

“(1) the status of agency cybersecurity remedial actions described in section 3554(b)(7);

“(2) any vulnerability information relating to the systems of an agency that is known by the agency;

“(3) analysis of incident information under section 3597;

“(4) evaluation of penetration testing performed under section 3559A;

“(5) evaluation of vulnerability disclosure program information under section 3559B;

“(6) evaluation of agency threat hunting results;

“(7) evaluation of Federal and non-Federal cyber threat intelligence;

“(8) data on agency compliance with standards issued under section 11331 of title 40;

“(9) agency system risk assessments performed under section 3554(a)(1)(A); and

“(10) any other information the Director of the Cybersecurity and Infrastructure Security Agency determines relevant.”

“(1) the specific”

“(2) the trends identified in the Federal risk assessment performed under subsection (i).”

changed “(n) Binding operational directives—If the Director of the Cybersecurity and Infrastructure Security Agency issues a binding operational directive or an emergency directive under this section, not later than 4 days after the date on which the binding operational directive requires an agency to take an action, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the Director, National Cyber Director, the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives the status of the implementation of the binding operational directive at the agency.”agency.

added “(o) Review of Office of Management and Budget guidance and policy

added “(1) Review

added “(A) In general—Not less frequently than once every 3 years, the Director, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency, shall—

added “(i) review the efficacy of the guidance and policy developed by the Director under subsection (a)(1) in reducing cybersecurity risks, including an assessment of the requirements for agencies to report information to the Director; and

added “(ii) determine whether any changes to the guidance or policy developed under subsection (a)(1) is appropriate.

added “(B) Considerations—In conducting the review required under subparagraph (A), the Director shall consider—

added “(i) the Federal risk assessments performed under subsection (i);

added “(ii) the cumulative reporting and compliance burden to agencies; and

added “(iii) the clarity of the requirements and deadlines contained in guidance and policy documents.

added “(2) Updated guidance—Not later than 90 days after the date on which a review is completed under paragraph (1), the Director shall issue updated guidance or policy to agencies determined appropriate by the Director, based on the results of the review.

added “(3) Public report—Not later than 30 days after the date on which the Director completes a review under paragraph (1), the Director shall make publicly available a report that includes—

added “(A) an overview of the guidance and policy developed under subsection (a)(1) that is in effect;

added “(B) the cybersecurity risk mitigation, or other cybersecurity benefit, offered by each guidance or policy described in subparagraph (A);

added “(C) a summary of the guidance or policy developed under subsection (a)(1) to which changes were determined appropriate during the review; and

added “(D) the changes that are anticipated to be included in the updated guidance or policy issued under paragraph (2).

added “(4) Congressional briefing—Not later than 60 days after the date on which a review is completed under paragraph (1), the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a briefing on the review.

added “(p) Automated standard implementation verification—When the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) or (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3(a)), the Director of the National Institute of Standards and Technology shall consider developing and, if appropriate and practical, develop, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, specifications to enable the automated verification of the implementation of the controls within the standard.”

“(A) on an ongoing and continuous basis, performing agency system risk assessments that—

“(i) identify and document the high value assets of the agency using guidance from the Director;

“(ii) evaluate the data assets inventoried under section 3511 for sensitivity to compromises in confidentiality, integrity, and availability;

“(iii) identify agency systems that have access to or hold the data assets inventoried under section 3511;

“(iv) evaluate the threats facing agency systems and data, including high value assets, based on Federal and non-Federal cyber threat intelligence products, where available;

“(v) evaluate the vulnerability of agency systems and data, including high value assets, including by analyzing—

“(I) the results of penetration testing performed by the Department of Homeland Security under section 3553(b)(9);

“(II) the results of penetration testing performed under section 3559A;

“(III) information provided to the agency through the vulnerability disclosure program of the agency under section 3559B;

“(IV) incidents; and

“(V) any other vulnerability information relating to agency systems that is known to the agency;

“(vi) assess the impacts of potential agency incidents to agency systems, data, and operations based on the evaluations described in clauses (ii) and (iv) and the agency systems identified under clause (iii); and

“(vii) assess the consequences of potential incidents occurring on agency systems that would impact systems at other agencies, including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system;”

“(E) providing an update on the ongoing and continuous assessment performed under subparagraph (A)—

“(i) upon request, to the inspector general of the agency or the Comptroller General of the United States; and

“(ii) on a periodic basis, as determined by guidance issued by the Director but not less frequently than annually, to—

“(I) the Director;

“(II) the Director of the Cybersecurity and Infrastructure Security Agency; and

“(III) the National Cyber Director;

“(F) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and not less frequently than once every 3 years, performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of, or under the supervision of, the agency, which shall—

“(i) be completed considering the agency system risk assessment performed under subparagraph (A); and

“(ii) include a specific evaluation for high value assets;

“(G) not later than 30 days after completing the evaluation performed under subparagraph (F), providing the evaluation and an implementation plan, if applicable, for using additional cybersecurity procedures determined to be appropriate to—

“(i) the Director of the Cybersecurity and Infrastructure Security Agency;

“(ii) the Director; and

“(iii) the National Cyber Director; and

“(H) if the head of the agency determines there is need for additional cybersecurity procedures, ensuring that those additional cybersecurity procedures are reflected in the budget request of the agency;”

“(i) standards”

“(ii) the evaluation performed under paragraph (1)(F); and

“(iii) the implementation plan described in paragraph (1)(G);”

“(v) ensure that—

“(I) senior agency information security officers of component agencies carry out responsibilities under this subchapter, as directed by the senior agency information security officer of the agency or an equivalent official; and

“(II) senior agency information security officers of component agencies report to—

“(aa) the senior information security officer of the agency or an equivalent official; and

“(bb) the Chief Information Officer of the component agency or an equivalent official;”

“(1) pursuant to subsection (a)(1)(A), performing ongoing and continuous agency system risk assessments, which may include using guidelines and automated tools consistent with standards and guidelines promulgated under section 11331 of title 40, as applicable;”

“(B) comply with the risk-based cyber budget model developed pursuant to section 3553(a)(7);”

“(iii) binding operational directives and emergency directives promulgated by the Director of the Cybersecurity and Infrastructure Security Agency under section 3553;”

removed “(I) the agency risk assessment performed under subsection (a)(1)(A); and

removed “(II) the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section 11331(c)(1) of title 40; and”

“(7) a process for providing the status of every remedial action and unremediated identified system vulnerability to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable;”

“(ii) notifying and consulting with the Federal information security incident center established under section 3556 pursuant to the requirements of section 3594;”

“(iii) performing the notifications and other activities required under subchapter IV of this chapter; and”

“(1) Biannual report—Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2022 and not less frequently than once every 2 years thereafter, using the continuous and ongoing agency system risk assessment under subsection (a)(1)(A), the head of each agency shall submit to the Director, the Director of the Cybersecurity and Infrastructure Security Agency, the majority and minority leaders of the Senate, the Speaker and minority leader of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Reform of the House of Representatives, the Committee on Homeland Security of the House of Representatives, the Committee on Commerce, Science, and Transportation of the Senate, the Committee on Science, Space, and Technology of the House of Representatives, the appropriate authorization and appropriations committees of Congress, the National Cyber Director, and the Comptroller General of the United States a report that—

“(A) summarizes the agency system risk assessment performed under subsection (a)(1)(A);

“(B) evaluates the adequacy and effectiveness of information security policies, procedures, and practices of the agency to address the risks identified in the agency system risk assessment performed under subsection (a)(1)(A), including an analysis of the agency’s cybersecurity and incident response capabilities using the metrics established under section 224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 1522(c));

“(C) summarizes the evaluation and implementation plans described in subparagraphs (F) and (G) of subsection (a)(1) and whether those evaluation and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency; and

“(D) summarizes the status of remedial actions identified by inspector general of the agency, the Comptroller General of the United States, and any other source determined appropriate by the head of the agency.

“(2) Unclassified reports—Each report submitted under paragraph (1)—

“(A) shall be, to the greatest extent practicable, in an unclassified and otherwise uncontrolled form; and

“(B) may include a classified annex.

“(3) Access to information—The head of an agency shall ensure that, to the greatest extent practicable, information is included in the unclassified form of the report submitted by the agency under paragraph (2)(A).

“(4) Briefings—During each year during which a report is not required to be submitted under paragraph (1), the Director shall provide to the congressional committees described in paragraph (1) a briefing summarizing current agency and Federal risk postures.”

“(f) Reporting structure exemption

“(1) In general—On an annual basis, the Director may exempt an agency from the reporting structure requirement under subsection (a)(3)(A)(v)(II).

“(2) Report—On an annual basis, the Director shall submit a report to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives that includes a list of each exemption granted under paragraph (1) and the associated rationale for each exemption.

“(3) Component of other report—The report required under paragraph (2) may be incorporated into any other annual report required under this chapter.”

“(3) An evaluation under this section may include recommendations for improving the cybersecurity posture of the agency.”

“(f) Protection of information

“(1) Agencies, evaluators, and other recipients of information that, if disclosed, may cause grave harm to the efforts of Federal information security officers, shall take appropriate steps to ensure the protection of that information, including safeguarding the information from public disclosure.

“(2) The protections required under paragraph (1) shall be commensurate with the risk and comply with all applicable laws and regulations.

“(3) With respect to information that is not related to national security systems, agencies and evaluators shall make a summary of the information unclassified and publicly available, including information that does not identify—

“(A) specific information system incidents; or

“(B) specific information system vulnerabilities.”

“(A) shall”

“(B) identify any entity that performs an independent evaluation under subsection (b).”

“(j) Guidance

“(1) In general—The Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the Chief Information Officers Council, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of risk-based guidance for evaluating the effectiveness of an information security program and practices

“(2) Priorities—The risk-based guidance developed under paragraph (1) shall include—

“(A) the identification of the most common successful threat patterns experienced by each agency;

“(B) the identification of security controls that address the threat patterns described in subparagraph (A);

“(C) any other security risks unique to the networks of each agency; and

“(D) any other element the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Council of the Inspectors General on Integrity and Efficiency, determines appropriate.”

“IV Federal System Incident Response

“3591. Definitions

“(a) In general—Except as provided in subsection (b), the definitions under sections 3502 and 3552 shall apply to this subchapter.

“(b) Additional definitions—As used in this subchapter:

“(1) Appropriate reporting entities—The term appropriate reporting entities means—

“(A) the majority and minority leaders of the Senate;

“(B) the Speaker and minority leader of the House of Representatives;

“(C) the Committee on Homeland Security and Governmental Affairs of the Senate;

“(D) the Committee on Oversight and Reform of the House of Representatives;

“(E) the Committee on Homeland Security of the House of Representatives;

“(F) the appropriate authorization and appropriations committees of Congress;

“(G) the Director;

“(H) the Director of the Cybersecurity and Infrastructure Security Agency;

“(I) the National Cyber Director;

“(J) the Comptroller General of the United States; and

“(K) the inspector general of any impacted agency.

“(2) Awardee—The term awardee—

“(A) means a person, business, or other entity that receives a grant from, or is a party to a cooperative agreement or an other transaction agreement with, an agency; and

“(B) includes any subgrantee of a person, business, or other entity described in subparagraph (A).

“(3) Breach—The term breach—

“(A) means the loss, control, compromise, unauthorized disclosure, or unauthorized acquisition of personally identifiable information or any similar occurrence; and

“(B) includes any additional meaning given the term in policies, principles, standards, or guidelines issued by the Director under section 3553(a).

“(4) Contractor—The term contractor means a prime contractor of an agency or a subcontractor of a prime contractor of an agency.

“(5) Federal information—The term Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government in any medium or form.

“(6) Federal information system—The term Federal information system means an information system used or operated by an agency, a contractor, an awardee, or another organization on behalf of an agency.

“(7) Intelligence community—The term intelligence community has the meaning given the term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003).

“(8) Nationwide consumer reporting agency—The term nationwide consumer reporting agency means a consumer reporting agency described in section 603(p) of the Fair Credit Reporting Act (15 U.S.C. 1681a(p)).

“(9) Vulnerability disclosure—The term vulnerability disclosure means a vulnerability identified under section 3559B.

“3592. Notification of breach

“(a) Notification—As expeditiously as practicable and without unreasonable delay, and in any case not later than 45 days after an agency has a reasonable basis to conclude that a breach has occurred, the head of the agency, in consultation with a senior privacy officer of the agency, shall—

“(1) determine whether notice to any individual potentially affected by the breach is appropriate based on an assessment of the risk of harm to the individual that considers—

“(A) the nature and sensitivity of the personally identifiable information affected by the breach;

“(B) the likelihood of access to and use of the personally identifiable information affected by the breach;

“(C) the type of breach; and

“(D) any other factors determined by the Director; and

“(2) as appropriate, provide written notice in accordance with subsection (b) to each individual potentially affected by the breach—

“(A) to the last known mailing address of the individual; or

“(B) through an appropriate alternative method of notification that the head of the agency or a designated senior-level individual of the agency selects based on factors determined by the Director.

“(b) Contents of notice—Each notice of a breach provided to an individual under subsection (a)(2) shall include—

“(1) a brief description of the breach;

“(2) if possible, a description of the types of personally identifiable information affected by the breach;

“(3) contact information of the agency that may be used to ask questions of the agency, which—

“(A) shall include an e-mail address or another digital contact mechanism; and

“(B) may include a telephone number, mailing address, or a website;

“(4) information on any remedy being offered by the agency;

“(5) any applicable educational materials relating to what individuals can do in response to a breach that potentially affects their personally identifiable information, including relevant contact information for Federal law enforcement agencies and each nationwide consumer reporting agency; and

“(6) any other appropriate information, as determined by the head of the agency or established in guidance by the Director.

“(c) Delay of notification

“(1) In general—The Attorney General, the Director of National Intelligence, or the Secretary of Homeland Security may delay a notification required under subsection (a) or (d) if the notification would—

“(A) impede a criminal investigation or a national security activity;

“(B) reveal sensitive sources and methods;

“(C) cause damage to national security; or

“(D) hamper security remediation actions.

“(2) Documentation

“(A) In general—Any delay under paragraph (1) shall be reported in writing to the Director, the Attorney General, the Director of National Intelligence, the Secretary of Homeland Security, the National Cyber Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the head of the agency and the inspector general of the agency that experienced the breach.

“(B) Contents—A report required under subparagraph (A) shall include a written statement from the entity that delayed the notification explaining the need for the delay.

“(C) Form—The report required under subparagraph (A) shall be unclassified but may include a classified annex.

“(3) Renewal—A delay under paragraph (1) shall be for a period of 60 days and may be renewed.

“(d) Update notification—If an agency determines there is a significant change in the reasonable basis to conclude that a breach occurred, a significant change to the determination made under subsection (a)(1), or that it is necessary to update the details of the information provided to potentially affected individuals as described in subsection (b), the agency shall as expeditiously as practicable and without unreasonable delay, and in any case not later than 30 days after such a determination, notify each individual who received a notification pursuant to subsection (a) of those changes.

“(e) Rule of construction—Nothing in this section shall be construed to limit—

“(1) the Director from issuing guidance relating to notifications or the head of an agency from notifying individuals potentially affected by breaches that are not determined to be major incidents; or

“(2) the Director from issuing guidance relating to notifications of major incidents or the head of an agency from providing more information than described in subsection (b) when notifying individuals potentially affected by breaches.

“3593. Congressional and Executive Branch reports

“(a) Initial report

“(1) In general—Not later than 72 hours after an agency has a reasonable basis to conclude that a major incident occurred, the head of the agency impacted by the major incident shall submit to the appropriate reporting entities a written report and, to the extent practicable, provide a briefing to the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Reform of the House of Representatives, the Committee on Homeland Security of the House of Representatives, and the appropriate authorization and appropriations committees of Congress, taking into account—

“(A) the information known at the time of the report;

“(B) the sensitivity of the details associated with the major incident; and

“(C) the classification level of the information contained in the report.

“(2) Contents—A report required under paragraph (1) shall include, in a manner that excludes or otherwise reasonably protects personally identifiable information and to the extent permitted by applicable law, including privacy and statistical laws—

“(A) a summary of the information available about the major incident, including how the major incident occurred, information indicating that the major incident may be a breach, and information relating to the major incident as a breach, based on information available to agency officials as of the date on which the agency submits the report;

“(B) if applicable, a description and any associated documentation of any circumstances necessitating a delay in a notification to individuals potentially affected by the major incident under section 3592(c);

“(C) if applicable, an assessment of the impacts to the agency, the Federal Government, or the security of the United States, based on information available to agency officials on the date on which the agency submits the report; and

“(D) if applicable, whether any ransom has been demanded or paid, or plans to be paid, by any entity operating a Federal information system or with access to a Federal information system, unless disclosure of such information may disrupt an active Federal law enforcement or national security operation.

“(b) Supplemental report—Within a reasonable amount of time, but not later than 30 days after the date on which an agency submits a written report under subsection (a), the head of the agency shall provide to the appropriate reporting entities written updates, which may include classified annexes, on the major incident and, to the extent practicable, provide a briefing, which may include a classified component, to the congressional committees described in subsection (a)(1), including summaries of—

“(1) vulnerabilities, means by which the major incident occurred, and impacts to the agency relating to the major incident;

“(2) any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred;

“(3) the status of compliance of the affected information system with applicable security requirements that are directly related to the cause of the incident, at the time of the major incident;

“(4) an estimate of the number of individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update;

“(5) an assessment of the risk of harm to individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update;

“(6) an update to the assessment of the risk to agency operations, or to impacts on other agency or non-Federal entity operations, affected by the major incident based on information available to agency officials as of the date on which the agency provides the update;

“(7) the detection, response, and remediation actions of the agency, including any support provided by the Cybersecurity and Infrastructure Security Agency under section 3594(d) and status updates on the notification process described in section 3592(a), including any delay described in section 3592(c), if applicable; and

“(8) if applicable, a description of any circumstances or data leading the head of the agency to determine, pursuant to section 3592(a)(1), not to notify individuals potentially impacted by a breach.

“(c) Update report—If the agency determines that there is any significant change in the understanding of the agency of the scope, scale, or consequence of a major incident for which an agency submitted a written report under subsection (a), the agency shall provide an updated report to the appropriate reporting entities that includes information relating to the change in understanding.

“(d) Biannual report—Each agency shall submit as part of the biannual report required under section 3554(c)(1) of this title a description of each major incident that occurred during the 2-year period preceding the date on which the biannual report is submitted.

“(e) Delay and lack of notification report

“(1) In general—The Director shall submit to the appropriate reporting entities an annual report on all notification delays granted pursuant to section 3592(c).

“(2) Lack of breach notification—The Director shall submit to the appropriate reporting entities an annual report on each breach with respect to which the head of an agency determined, pursuant to section 3592(a)(1), not to notify individuals potentially impacted by the breach.

“(3) Component of other report—The Director may submit the report required under paragraph (1) as a component of the annual report submitted under section 3597(b).

“(f) Report delivery—Any written report required to be submitted under this section may be submitted in a paper or electronic format.

“(g) Threat briefing

“(1) In general—Not later than 7 days after the date on which an agency has a reasonable basis to conclude that a major incident occurred, the head of the agency, jointly with the Director, the National Cyber Director and any other Federal entity determined appropriate by the National Cyber Director, shall provide a briefing to the congressional committees described in subsection (a)(1) on the threat causing the major incident.

“(2) Components—The briefing required under paragraph (1)—

“(A) shall, to the greatest extent practicable, include an unclassified component; and

“(B) may include a classified component.

“(h) Rule of construction—Nothing in this section shall be construed to limit—

“(1) the ability of an agency to provide additional reports or briefings to Congress; or

“(2) Congress from requesting additional information from agencies through reports, briefings, or other means.

“3594. Government information sharing and incident response

“(a) In general

“(1) Incident reporting—Subject to the limitations described in subsection (b), the head of each agency shall provide any information relating to any incident affecting the agency, whether the information is obtained by the Federal Government directly or indirectly, to the Cybersecurity and Infrastructure Security Agency.

“(2) Contents—A provision of information relating to an incident made by the head of an agency under paragraph (1) shall—

“(A) include detailed information about the safeguards that were in place when the incident occurred;

“(B) whether the agency implemented the safeguards described in subparagraph (A) correctly;

“(C) in order to protect against a similar incident, identify—

“(i) how the safeguards described in subparagraph (A) should be implemented differently; and

“(ii) additional necessary safeguards; and

“(D) include information to aid in incident response, such as—

“(i) a description of the affected systems or networks;

“(ii) the estimated dates of when the incident occurred; and

“(iii) information that could reasonably help identify the party that conducted the incident or the cause of the incident, subject to appropriate privacy protections.

“(3) Information sharing—The Director of the Cybersecurity and Infrastructure Security Agency shall—

“(A) make incident information provided under paragraph (1) available to the Director and the National Cyber Director;

“(B) to the greatest extent practicable, share information relating to an incident with the head of any agency that may be—

“(i) impacted by the incident;

“(ii) similarly susceptible to the incident; or

“(iii) similarly targeted by the incident; and

“(C) coordinate any necessary information sharing efforts relating to a major incident with the private sector.

“(4) National security systems—Each agency operating or exercising control of a national security system shall share information about incidents that occur on national security systems with the Director of the Cybersecurity and Infrastructure Security Agency to the extent consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the President.

“(b) Compliance—In providing information and selecting a method to provide information under subsection (a), the head of each agency shall take into account the level of classification of the information and any information sharing limitations and protections, such as limitations and protections relating to law enforcement, national security, privacy, statistical confidentiality, or other factors determined by the Director in order to implement subsection (a)(1) in a manner that enables automated and consistent reporting to the greatest extent practicable.

“(c) Incident response—Each agency that has a reasonable basis to conclude that a major incident occurred involving Federal information in electronic medium or form that does not exclusively involve a national security system, regardless of delays from notification granted for a major incident that is also a breach, shall coordinate with the Cybersecurity and Infrastructure Security Agency to facilitate asset response activities and provide recommendations for mitigating future incidents.

“3595. Responsibilities of contractors and awardees

“(a) Reporting

“(1) In general—Unless otherwise specified in a contract, grant, cooperative agreement, or an other transaction agreement, any contractor or awardee of an agency shall report to the agency within the same amount of time such agency is required to report an incident to the Cybersecurity and Infrastructure Security Agency, if the contractor or awardee has a reasonable basis to suspect or conclude that—

“(A) an incident or breach has occurred with respect to Federal information collected, used, or maintained by the contractor or awardee in connection with the contract, grant, cooperative agreement, or other transaction agreement of the contractor or awardee;

“(B) an incident or breach has occurred with respect to a Federal information system used or operated by the contractor or awardee in connection with the contract, grant, cooperative agreement, or other transaction agreement of the contractor or awardee; or

“(C) the contractor or awardee has received information from the agency that the contractor or awardee is not authorized to receive in connection with the contract, grant, cooperative agreement, or other transaction agreement of the contractor or awardee.

“(2) Procedures

“(A) Major incident—Following a report of a breach or major incident by a contractor or awardee under paragraph (1), the agency, in consultation with the contractor or awardee, shall carry out the requirements under sections 3592, 3593, and 3594 with respect to the major incident.

“(B) Incident—Following a report of an incident by a contractor or awardee under paragraph (1), an agency, in consultation with the contractor or awardee, shall carry out the requirements under section 3594 with respect to the incident.

“(b) Effective date—This section shall apply—

“(1) on and after the date that is 1 year after the date of enactment of the Federal Information Security Modernization Act of 2022; and

“(2) with respect to any contract entered into on or after the date described in paragraph (1).

“3596. Training

“(a) Covered individual defined—In this section, the term “covered individual” means an individual who obtains access to Federal information or Federal information systems because of the status of the individual as an employee, contractor, awardee, volunteer, or intern of an agency.

“(b) Requirement—The head of each agency shall develop training for covered individuals on how to identify and respond to an incident, including—

“(1) the internal process of the agency for reporting an incident; and

“(2) the obligation of a covered individual to report to the agency a confirmed major incident and any suspected incident involving information in any medium or form, including paper, oral, and electronic.

“(c) Inclusion in annual training—The training developed under subsection (b) may be included as part of an annual privacy or security awareness training of an agency.

“3597. Analysis and report on Federal incidents

“(a) Analysis of federal incidents

“(1) Quantitative and qualitative analyses—The Director of the Cybersecurity and Infrastructure Security Agency shall develop, in consultation with the Director and the National Cyber Director, and perform continuous monitoring and quantitative and qualitative analyses of incidents at agencies, including major incidents, including—

“(A) the causes of incidents, including—

“(i) attacker tactics, techniques, and procedures; and

“(ii) system vulnerabilities, including zero days, unpatched systems, and information system misconfigurations;

“(B) the scope and scale of incidents at agencies;

“(C) common root causes of incidents across multiple Federal agencies;

“(D) agency incident response, recovery, and remediation actions and the effectiveness of those actions, as applicable;

“(E) lessons learned and recommendations in responding to, recovering from, remediating, and mitigating future incidents; and

“(F) trends across multiple Federal agencies to address intrusion detection and incident response capabilities using the metrics established under section 224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 1522(c)).

“(2) Automated analysis—The analyses developed under paragraph (1) shall, to the greatest extent practicable, use machine readable data, automation, and machine learning processes.

“(3) Sharing of data and analysis

“(A) In general—The Director shall share on an ongoing basis the analyses required under this subsection with agencies and the National Cyber Director to—

“(i) improve the understanding of cybersecurity risk of agencies; and

“(ii) support the cybersecurity improvement efforts of agencies.

“(B) Format—In carrying out subparagraph (A), the Director shall share the analyses—

“(i) in human-readable written products; and

“(ii) to the greatest extent practicable, in machine-readable formats in order to enable automated intake and use by agencies.

“(b) Annual report on Federal incidents—Not later than 2 years after the date of enactment of this section, and not less frequently than annually thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director, the National Cyber Director and the heads of other Federal agencies, as appropriate, shall submit to the appropriate reporting entities a report that includes—

“(1) a summary of causes of incidents from across the Federal Government that categorizes those incidents as incidents or major incidents;

“(2) the quantitative and qualitative analyses of incidents developed under subsection (a)(1) on an agency-by-agency basis and comprehensively across the Federal Government, including—

“(A) a specific analysis of breaches; and

“(B) an analysis of the Federal Government’s performance against the metrics established under section 224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 1522(c)); and

“(3) an annex for each agency that includes—

“(A) a description of each major incident;

“(B) the total number of incidents of the agency; and

“(C) an analysis of the agency’s performance against the metrics established under section 224(c) of the Cybersecurity Act of 2015 (6 U.S.C. 1522(c)).

“(c) Publication

“(1) In general—A version of each report submitted under subsection (b) shall be made publicly available on the website of the Cybersecurity and Infrastructure Security Agency during the year in which the report is submitted.

“(2) Exemption—The Director of the Cybersecurity and Infrastructure Security Agency may exempt all or a portion of a report described in paragraph (1) from public publication if the Director of the Cybersecurity and Infrastructure Security Agency determines the exemption is in the interest of national security.

“(3) Limitation on exemption—An exemption granted under paragraph (2) shall not apply to any version of a report submitted to the appropriate reporting entities under subsection (b).

“(d) Information provided by agencies

“(1) In general—The analysis required under subsection (a) and each report submitted under subsection (b) shall use information provided by agencies under section 3594(a).

“(2) Noncompliance reports

“(A) In general—Subject to subparagraph (B), during any year during which the head of an agency does not provide data for an incident to the Cybersecurity and Infrastructure Security Agency in accordance with section 3594(a), the head of the agency, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Director, shall submit to the appropriate reporting entities a report that includes the information described in subsection (b) with respect to the agency.

“(B) Exception for national security systems—The head of an agency that owns or exercises control of a national security system shall not include data for an incident that occurs on a national security system in any report submitted under subparagraph (A).

“(3) National security system reports

“(A) In general—Annually, the head of an agency that operates or exercises control of a national security system shall submit a report that includes the information described in subsection (b) with respect to the national security system to the extent that the submission is consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the President to—

“(i) the majority and minority leaders of the Senate,

“(ii) the Speaker and minority leader of the House of Representatives;

“(iii) the Committee on Homeland Security and Governmental Affairs of the Senate;

“(iv) the Select Committee on Intelligence of the Senate;

“(v) the Committee on Armed Services of the Senate;

“(vi) the Committee on Appropriations of the Senate;

“(vii) the Committee on Oversight and Reform of the House of Representatives;

“(viii) the Committee on Homeland Security of the House of Representatives;

“(ix) the Permanent Select Committee on Intelligence of the House of Representatives;

“(x) the Committee on Armed Services of the House of Representatives; and

“(xi) the Committee on Appropriations of the House of Representatives.

“(B) Classified form—A report required under subparagraph (A) may be submitted in a classified form.

“(e) Requirement for compiling information—In publishing the public report required under subsection (c), the Director of the Cybersecurity and Infrastructure Security Agency shall sufficiently compile information such that no specific incident of an agency can be identified, except with the concurrence of the Director of the Office of Management and Budget and in consultation with the impacted agency.

“3598. Major incident definition

“(a) In general—Not later than 180 days after the date of enactment of the Federal Information Security Modernization Act of 2022, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the National Cyber Director, shall develop and promulgate guidance on the definition of the term “major incident” for the purposes of subchapter II and this subchapter.

“(b) Requirements—With respect to the guidance issued under subsection (a), the definition of the term major incident shall—

“(1) include, with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency—

“(A) any incident the head of the agency determines is likely to have an impact on—

“(i) the national security, homeland security, or economic security of the United States; or

“(ii) the civil liberties or public health and safety of the people of the United States;

“(B) any incident the head of the agency determines likely to result in an inability for the agency, a component of the agency, or the Federal Government, to provide 1 or more critical services;

“(C) any incident that the head of an agency, in consultation with a senior privacy officer of the agency, determines is likely to have a significant privacy impact on 1 or more individual;

“(D) any incident that the head of the agency, in consultation with a senior privacy official of the agency, determines is likely to have a substantial privacy impact on a significant number of individuals;

“(E) any incident the head of the agency determines substantially disrupts the operations of a high value asset owned or operated by the agency;

“(F) any incident involving the exposure of sensitive agency information to a foreign entity, such as the communications of the head of the agency, the head of a component of the agency, or the direct reports of the head of the agency or the head of a component of the agency; and

“(G) any other type of incident determined appropriate by the Director;

“(2) stipulate that the National Cyber Director, in consultation with the Director, shall declare a major incident at each agency impacted by an incident if it is determined that an incident—

“(A) occurs at not less than 2 agencies; and

“(B) is enabled by—

“(i) a common technical root cause, such as a supply chain compromise, a common software or hardware vulnerability; or

“(ii) the related activities of a common threat actor; and

“(3) stipulate that, in determining whether an incident constitutes a major incident because that incident is any incident described in paragraph (1), the head of the agency shall consult with the National Cyber Director and may consult with the Director of the Cybersecurity and Infrastructure Security Agency.

“(c) Significant number of individuals—In determining what constitutes a significant number of individuals under subsection (b)(1)(D), the Director—

“(1) may determine a threshold for a minimum number of individuals that constitutes a significant amount; and

“(2) may not determine a threshold described in paragraph (1) that exceeds 5,000 individuals.

“(d) Evaluation and updates—Not later than 2 years after the date of enactment of the Federal Information Security Modernization Act of 2022, and not less frequently than every 2 years thereafter, the Director shall provide a briefing to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives, which shall include—

“(1) an evaluation of any necessary updates to the guidance issued under subsection (a);

“(2) an evaluation of any necessary updates to the definition of the term major incident included in the guidance issued under subsection (a); and

“(3) an explanation of, and the analysis that led to, the definition described in paragraph (2).”

“(a) Definitions—In this section:

“(1) Agency—The term agency has the meaning given the term in section 551 of title 5, United States Code.

“(2) High value asset—The term high value asset has the meaning given the term in section 3552 of title 44, United States Code.”

“(8) Proposal evaluation—The Director shall—

“(A) give consideration for the use of amounts in the Fund to improve the security of high value assets; and

“(B) require that any proposal for the use of amounts in the Fund includes a cybersecurity plan, including a supply chain risk management plan, to be reviewed by the member of the Technology Modernization Board described in subsection (c)(5)(C).”

“(C) a senior official from the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, appointed by the Director.”

“(i) include data”

“(ii) specifically denote cybersecurity funding under the risk-based cyber budget model developed pursuant to section 3553(a)(7) of title 44.”

“(iii) The Director shall provide to the National Cyber Director any cybersecurity funding information described in subparagraph (A)(ii) that is provided to the Director under clause (ii) of this subparagraph.”

“(1) develop”

“(2) consult with the Director of the Cybersecurity and Infrastructure Security Agency for the development and use of supply chain security best practices.”

“(iii) whether the function should be performed by a shared service offered by another executive agency;”

“(d) Component agency chief information officers—The Chief Information Officer or an equivalent official of a component agency shall report to—

“(1) the Chief Information Officer designated under section 3506(a)(2) of title 44 or an equivalent official of the agency of which the component agency is a component; and

“(2) the head of the component agency.

“(e) Reporting structure exemption

“(1) In general—On annual basis, the Director may exempt any agency from the reporting structure requirements under subsection (d).

“(2) Report—On an annual basis, the Director shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report that includes a list of each exemption granted under paragraph (1) and the associated rationale for each exemption.

“(3) Component of other report—The report required under paragraph (2) may be incorporated into any other annual report required under chapter 35 of title 44, United States Code.”

removed “(c) Application of more stringent standards

removed “(1) In general—The head of an agency shall—

removed “(A) evaluate, in consultation with the senior agency information security officers, the need to employ standards for cost-effective, risk-based information security for all systems, operations, and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the Director under this section, if such standards contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Director; and

removed “(B) to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph (A) are necessary, employ those standards.

removed “(2) Evaluation of more stringent standards—In evaluating the need to employ more stringent standards under paragraph (1), the head of an agency shall consider available risk information, such as—

removed “(A) the status of cybersecurity remedial actions of the agency;

removed “(B) any vulnerability information relating to agency systems that is known to the agency;

removed “(C) incident information of the agency;

removed “(D) information from—

removed “(i) penetration testing performed under section 3559A of title 44; and

removed “(ii) information from the vulnerability disclosure program established under section 3559B of title 44;

removed “(E) agency threat hunting results under section 112 of the Federal Information Security Modernization Act of 2022;

removed “(F) Federal and non-Federal cyber threat intelligence;

removed “(G) data on compliance with standards issued under this section;

removed “(H) agency system risk assessments performed under section 3554(a)(1)(A) of title 44; and

removed “(I) any other information determined relevant by the head of the agency.”

removed “(A) for a decision to significantly modify or not promulgate such a proposed standard, after the public is given an opportunity to comment on the Director’s proposed decision;

removed “(B) in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency;

removed “(C) considering the Federal risk assessments performed under section 3553(i) of title 44; and

removed “(D) considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard.”

removed “(e) Review of office of management and budget guidance and policy

removed “(1) Conduct of review

removed “(A) In general—Not less frequently than once every 3 years, the Director of the Office of Management and Budget, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency, shall review the efficacy of the guidance and policy promulgated by the Director in reducing cybersecurity risks, including an assessment of the requirements for agencies to report information to the Director, and determine whether any changes to that guidance or policy is appropriate.

removed “(B) Federal risk assessments—In conducting the review described in subparagraph (A), the Director shall consider the Federal risk assessments performed under section 3553(i) of title 44.

removed “(C) Requirements burden reduction and clarity—In conducting the review described in subparagraph (A), the Director shall consider—

removed “(i) the cumulative reporting and compliance burden to agencies; and

removed “(ii) the clarity of the requirements and deadlines contained in guidance and policy documents.

removed “(2) Updated guidance—Not later than 90 days after the date on which a review is completed under paragraph (1), the Director of the Office of Management and Budget shall issue updated guidance or policy to agencies determined appropriate by the Director, based on the results of the review.

removed “(3) Public report—Not later than 30 days after the date on which a review is completed under paragraph (1), the Director of the Office of Management and Budget shall make publicly available a report that includes—

removed “(A) an overview of the guidance and policy promulgated under this section that is currently in effect;

removed “(B) the cybersecurity risk mitigation, or other cybersecurity benefit, offered by each guidance or policy document described in subparagraph (A); and

removed “(C) a summary of the guidance or policy to which changes were determined appropriate during the review and what the changes are anticipated to include.

removed “(4) Congressional briefing—Not later than 60 days after the date on which a review is completed under paragraph (1), the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a briefing on the review.

removed “(f) Automated standard implementation verification—When the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3(a)), the Director of the National Institute of Standards and Technology shall consider developing and, if appropriate and practical, develop, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, specifications to enable the automated verification of the implementation of the controls within the standard.”