This bill requires an agency's websites that collect or store personally identifiable information (i.e., information that can be used to identify an individual, such as a name, social security number, or date and place of birth) to be certified as fully functional and secure by the agency's chief information officer. Such websites that are not certified within 90 days must be made inaccessible to the public. New websites that collect or store personally identifiable information must be certified before they are made accessible to the public.

Websites designed for testing and development are exempted if users execute an agreement acknowledging the risks involved.

The Office of Management and Budget must establish and oversee policies and procedures for federal agencies to follow in the event of a breach of information security involving the disclosure of personally identifiable information.