3.0.0 2521 2023-03-22T18:49:23Z 2023-03-22T18:49:23Z Senate S S 2014-06-24 113 ssga00 Homeland Security and Governmental Affairs Committee Senate Standing Reported by 2014-09-15T22:02:15Z Markup by 2014-06-25T19:09:40Z Referred to 2014-06-24T21:16:19Z hshm00 Homeland Security Committee House Standing Legislative interest 2014-08-01T18:49:00Z S. Rept. 113-256 Federal Information Security Amendments Act of 2013 113 1163 HR 2013-04-17 Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs. Related bill CRS 2014-12-18 Became Public Law No: 113-283. President E40000 2 House floor actions 2014-12-18 Became Public Law No: 113-283. BecameLaw 36000 9 Library of Congress 2014-12-18 Signed by President. President E30000 2 House floor actions 2014-12-18 Signed by President. BecameLaw 36000 9 Library of Congress 2014-12-12 Presented to President. Floor E20000 2 House floor actions 2014-12-12 Presented to President. President 28000 9 Library of Congress 2014-12-10 17:23:37 Motion to reconsider laid on the table Agreed to without objection. Floor H38310 2 House floor actions 2014-12-10 17:23:34 On passage Passed without objection. (text: CR H8994-8998) Floor H37100 2 House floor actions 2014-12-10 17:23:34 Passed/agreed to in House: On passage Passed without objection.(text: CR H8994-8998) Floor 8000 9 Library of Congress 2014-12-10 17:23:32 Considered by unanimous consent. (consideration: CR H8994-8998) Floor H30000 2 House floor actions 2014-12-10 17:23:17 Mr. Meadows asked unanimous consent to take from the Speaker's table and consider. Floor H30200 2 House floor actions 2014-12-09 15:58:24 Held at the desk. Floor H15000 2 House floor actions 2014-12-09 Senate Message on Senate action sent to the House. Floor 2014-12-09 12:51:04 Received in the House. Floor H14000 2 House floor actions 2014-12-08 Senate Passed Senate with an amendment by Voice Vote. Floor 2014-12-08 Passed/agreed to in Senate: Passed Senate with an amendment by Voice Vote. Floor 17000 9 Library of Congress 2014-12-08 Senate Measure laid before Senate by unanimous consent. (consideration: CR S6395) Floor 2014-09-15 Senate Placed on Senate Legislative Calendar under General Orders. Calendar No. 564. Calendars 2014-09-15 ssga00 Homeland Security and Governmental Affairs Committee Senate Committee on Homeland Security and Governmental Affairs. Reported by Senator Carper without amendment. With written report No. 113-256. Committee 2014-09-15 Committee on Homeland Security and Governmental Affairs. Reported by Senator Carper without amendment. With written report No. 113-256. Committee 14000 9 Library of Congress ssga00 Homeland Security and Governmental Affairs Committee 2014-06-25 ssga00 Homeland Security and Governmental Affairs Committee Senate Committee on Homeland Security and Governmental Affairs. Ordered to be reported without amendment favorably. Committee 2014-06-24 ssga00 Homeland Security and Governmental Affairs Committee Senate Read twice and referred to the Committee on Homeland Security and Governmental Affairs. IntroReferral 2014-06-24 Introduced in Senate IntroReferral 10000 9 Library of Congress C000174 Sen. Carper, Thomas R. [D-DE] Thomas Carper D DE R. N C000560 Sen. Coburn, Tom [R-OK] TOM COBURN R OK 2014-06-24 True Public Law 113-283 Government Operations and Politics Computer security and identity theft Computers and information technology Executive agency funding and structure Federal officials Government employee pay, benefits, personnel management Government information and archives Intelligence activities, surveillance, classified information Office of Management and Budget (OMB) Performance measurement Government Operations and Politics 00 2014-06-24 Introduced in Senate 2014-08-14T19:22:13Z Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies, and (2) set forth authority for the Secretary of Homeland Security (DHS) to carry out the operational aspects of such policies for information systems.

Requires the Secretary to develop and oversee implementation of operational directives to agencies to implement the Director's standards and guidelines, as well as the requirements of this Act. Authorizes the Director to repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs agency heads to ensure that: (1) senior agency officials, including chief information officers, carry out their information security responsibilities; and (2) all personnel are held accountable for complying with the agency-wide information security program.

Requires agencies to notify Congress of discovered security incidents within seven days.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO).

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Requires OMB to revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.

Requires OMB to establish procedures for agencies to follow in the event of a breach involving disclosure of personally identifiable information, including requirements for notice to affected individuals, FISIC, and Congress.

]]> 80 2014-09-15 Reported to Senate without amendment 2014-09-30T19:41:37Z (This measure has not been amended since it was introduced. The summary of that version is repeated here.)

Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies, and (2) set forth authority for the Secretary of Homeland Security (DHS) to carry out the operational aspects of such policies for information systems.

Requires the Secretary to develop and oversee implementation of operational directives to agencies to implement the Director's standards and guidelines, as well as the requirements of this Act. Authorizes the Director to repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs agency heads to ensure that: (1) senior agency officials, including chief information officers, carry out their information security responsibilities; and (2) all personnel are held accountable for complying with the agency-wide information security program.

Requires agencies to notify Congress of discovered security incidents within seven days.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO).

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Requires OMB to revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.

Requires OMB to establish procedures for agencies to follow in the event of a breach involving disclosure of personally identifiable information, including requirements for notice to affected individuals, FISIC, and Congress.

]]> 35 2014-12-08 Passed Senate amended 2014-12-22T19:31:53Z Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

Requires the Secretary to develop and oversee implementation of operational directives requiring agencies to implement the Director's standards and guidelines for safeguarding federal information and systems from a known or reasonably suspected information security threat, vulnerability, or risk. Authorizes the Director to revise or repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Directs the Secretary to administer procedures to deploy technology, upon request by an agency, to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities.

Requires the Director's annual report to Congress regarding the effectiveness of information security policies to assess agency compliance with OMB data breach notification procedures.

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs the Secretary to consult with and consider guidance developed by the National Institute of Standards and Technology (NIST) to ensure that operational directives do not conflict with NIST information security standards.

Directs agency heads to ensure that: (1) information security management processes are integrated with budgetary planning; (2) senior agency officials, including chief information officers, carry out their information security responsibilities; and (3) all personnel are held accountable for complying with the agency-wide information security program.

Provides for the use of automated tools in agencies' information security programs, including for periodic risk assessments, testing of security procedures, and detecting, reporting, and responding to security incidents.

Requires agencies to include offices of general counsel as recipients of security incident notices. Requires agencies to notify Congress of major security incidents within seven days after there is a reasonable basis to conclude that a major incident has occurred.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO). Requires such reports to include: (1) threats and threat actors, vulnerabilities, and impacts; (2) risk assessments of affected systems before, and the status of compliance of the systems at the time of, major incidents; (3) detection, response, and remediation actions; (4) the total number of incidents; and (5) a description of the number of individuals affected by, and the information exposed by, major incidents involving a breach of personally identifiable information.

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Requires OMB to ensure the development of guidance for: (1) evaluating the effectiveness of information security programs and practices, and (2) determining what constitutes a major incident.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Directs OMB, during the two-year period after enactment of this Act, to include in an annual report to Congress an assessment of the adoption by agencies of continuous diagnostics technologies and other advanced security tools.

Requires OMB to ensure that data breach notification policies require agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General, heads of elements of the intelligence community, or the DHS Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions.

Requires OMB to amend or revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.

]]> 81 2014-12-10 Passed House without amendment 2014-12-22T19:33:35Z (This measure has not been amended since it was passed by the Senate on December 8, 2014. The summary of that version is repeated here.)

Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

Requires the Secretary to develop and oversee implementation of operational directives requiring agencies to implement the Director's standards and guidelines for safeguarding federal information and systems from a known or reasonably suspected information security threat, vulnerability, or risk. Authorizes the Director to revise or repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Directs the Secretary to administer procedures to deploy technology, upon request by an agency, to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities.

Requires the Director's annual report to Congress regarding the effectiveness of information security policies to assess agency compliance with OMB data breach notification procedures.

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs the Secretary to consult with and consider guidance developed by the National Institute of Standards and Technology (NIST) to ensure that operational directives do not conflict with NIST information security standards.

Directs agency heads to ensure that: (1) information security management processes are integrated with budgetary planning; (2) senior agency officials, including chief information officers, carry out their information security responsibilities; and (3) all personnel are held accountable for complying with the agency-wide information security program.

Provides for the use of automated tools in agencies' information security programs, including for periodic risk assessments, testing of security procedures, and detecting, reporting, and responding to security incidents.

Requires agencies to include offices of general counsel as recipients of security incident notices. Requires agencies to notify Congress of major security incidents within seven days after there is a reasonable basis to conclude that a major incident has occurred.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO). Requires such reports to include: (1) threats and threat actors, vulnerabilities, and impacts; (2) risk assessments of affected systems before, and the status of compliance of the systems at the time of, major incidents; (3) detection, response, and remediation actions; (4) the total number of incidents; and (5) a description of the number of individuals affected by, and the information exposed by, major incidents involving a breach of personally identifiable information.

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Requires OMB to ensure the development of guidance for: (1) evaluating the effectiveness of information security programs and practices, and (2) determining what constitutes a major incident.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Directs OMB, during the two-year period after enactment of this Act, to include in an annual report to Congress an assessment of the adoption by agencies of continuous diagnostics technologies and other advanced security tools.

Requires OMB to ensure that data breach notification policies require agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General, heads of elements of the intelligence community, or the DHS Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions.

Requires OMB to amend or revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.

]]> 49 2014-12-18 Public Law 2014-12-24T19:44:01Z (This measure has not been amended since it was passed by the Senate on December 8, 2014. The summary of that version is repeated here.)

Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

Requires the Secretary to develop and oversee implementation of operational directives requiring agencies to implement the Director's standards and guidelines for safeguarding federal information and systems from a known or reasonably suspected information security threat, vulnerability, or risk. Authorizes the Director to revise or repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Directs the Secretary to administer procedures to deploy technology, upon request by an agency, to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities.

Requires the Director's annual report to Congress regarding the effectiveness of information security policies to assess agency compliance with OMB data breach notification procedures.

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs the Secretary to consult with and consider guidance developed by the National Institute of Standards and Technology (NIST) to ensure that operational directives do not conflict with NIST information security standards.

Directs agency heads to ensure that: (1) information security management processes are integrated with budgetary planning; (2) senior agency officials, including chief information officers, carry out their information security responsibilities; and (3) all personnel are held accountable for complying with the agency-wide information security program.

Provides for the use of automated tools in agencies' information security programs, including for periodic risk assessments, testing of security procedures, and detecting, reporting, and responding to security incidents.

Requires agencies to include offices of general counsel as recipients of security incident notices. Requires agencies to notify Congress of major security incidents within seven days after there is a reasonable basis to conclude that a major incident has occurred.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO). Requires such reports to include: (1) threats and threat actors, vulnerabilities, and impacts; (2) risk assessments of affected systems before, and the status of compliance of the systems at the time of, major incidents; (3) detection, response, and remediation actions; (4) the total number of incidents; and (5) a description of the number of individuals affected by, and the information exposed by, major incidents involving a breach of personally identifiable information.

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Requires OMB to ensure the development of guidance for: (1) evaluating the effectiveness of information security programs and practices, and (2) determining what constitutes a major incident.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Directs OMB, during the two-year period after enactment of this Act, to include in an annual report to Congress an assessment of the adoption by agencies of continuous diagnostics technologies and other advanced security tools.

Requires OMB to ensure that data breach notification policies require agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General, heads of elements of the intelligence community, or the DHS Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions.

Requires OMB to amend or revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.

]]> Federal Information Security Modernization Act of 2014 Display Title Federal Information Security Modernization Act of 2014 Official Title as Introduced A bill to amend chapter 35 of title 44, United States Code, to provide for reform to Federal information security. Introduced in Senate IS Short Titles as Passed House Federal Information Security Modernization Act of 2014 H House Short Titles as Introduced Federal Information Security Modernization Act of 2014 Short Titles as Enacted Federal Information Security Modernization Act of 2014 Short Titles as Passed Senate Federal Information Security Modernization Act of 2014 S Senate Short Titles as Reported to Senate Federal Information Security Modernization Act of 2014 S Senate 3975 113 SAMDT In the nature of a substitute. 2022-02-25T17:33:31Z 2014-12-08 Amendment SA 3975 agreed to in Senate by Unanimous Consent. SA 3975 https://www.congress.gov/amendment/113th-congress/senate-amendment/3975 C000174 Sen. Carper, Thomas R. [D-DE] Thomas Carper D DE R. 1 1 C000560 Sen. Coburn, Tom [R-OK] TOM COBURN R OK 2014-12-08 True 2014-12-08T05:00:00Z 2014-12-08T05:00:00Z Senate 113 S Senate S 2521 Federal Information Security Modernization Act of 2014 2023-03-22T18:49:23Z 6 2014-12-08 0 Senate Amendment SA 3975 agreed to in Senate by Unanimous Consent. Floor 2014-12-08 0 Senate Amendment SA 3975 proposed by Senator Reid for Senator Carper. (consideration: CR S6395) In the nature of a substitute. Floor 2014-12-08 Senate amendment proposed (on the floor): Amendment SA 3975 proposed by Senator Reid for Senator Carper.(consideration: CR S6395) Floor 93000 9 Library of Congress 2014-12-08 Senate amendment agreed to: Amendment SA 3975 agreed to in Senate by Unanimous Consent. Floor 94000 9 Library of Congress 2014-12-08 Senate amendment submitted Floor 91000 9 Library of Congress Enrolled Bill https://www.govinfo.gov/content/pkg/BILLS-113s2521enr/xml/BILLS-113s2521enr.xml Engrossed in Senate 2014-12-08T05:00:00Z https://www.govinfo.gov/content/pkg/BILLS-113s2521es/xml/BILLS-113s2521es.xml Reported to Senate 2014-09-15T04:00:00Z https://www.govinfo.gov/content/pkg/BILLS-113s2521rs/xml/BILLS-113s2521rs.xml Introduced in Senate 2014-06-24T04:00:00Z https://www.govinfo.gov/content/pkg/BILLS-113s2521is/xml/BILLS-113s2521is.xml 2014-12-19T04:59:59Z https://www.govinfo.gov/content/pkg/PLAW-113publ283/uslm/PLAW-113publ283.xml Public Law 2014-12-18 Became Public Law No: 113-283. text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. Congressional Research Service, Library of Congress This file contains bill summaries and statuses for federal legislation. A bill summary describes the most significant provisions of a piece of legislation and details the effects the legislative text may have on current law and federal programs. Bill summaries are authored by the Congressional Research Service (CRS) of the Library of Congress. As stated in Public Law 91-510 (2 USC 166 (d)(6)), one of the duties of CRS is "to prepare summaries and digests of bills and resolutions of a public general nature introduced in the Senate or House of Representatives". For more information, refer to the User Guide that accompanies this file.