[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[H.R. 1668 Reported in House (RH)]
<DOC>
Union Calendar No. 402
116th CONGRESS
2d Session
H. R. 1668
[Report No. 116-501, Part I]
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
March 11, 2019
Ms. Kelly of Illinois (for herself, Mr. Hurd of Texas, Mr. Khanna, Mr.
Budd, Mr. Ruppersberger, Mr. Marshall, Mr. Ted Lieu of California, Mr.
Ratcliffe, Mr. Meadows, Mr. Soto, Mr. Walker, Mr. Connolly, Mr. Foster,
and Mr. Baird) introduced the following bill; which was referred to the
Committee on Oversight and Reform, and in addition to the Committee on
Science, Space, and Technology, for a period to be subsequently
determined by the Speaker, in each case for consideration of such
provisions as fall within the jurisdiction of the committee concerned
September 14, 2020
Additional sponsors: Mr. Olson, Ms. Hill of California, Mr.
Fitzpatrick, Mr. O'Halleran, Mrs. Brooks of Indiana, Ms. Clarke of New
York, Ms. Stevens, Mr. Harder of California, Mr. Norman, Mr. Rouda, Mr.
Graves of Georgia, Ms. Wasserman Schultz, and Ms. DelBene
September 14, 2020
Reported from the Committee on Oversight and Reform with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
September 14, 2020
Committee on Science, Space, and Technology discharged; committed to
the Committee of the Whole House on the State of the Union and ordered
to be printed
[For text of introduced bill, see copy of bill as introduced on March
11, 2019]
_______________________________________________________________________
A BILL
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Internet of Things Cybersecurity
Improvement Act of 2019'' or the ``IoT Cybersecurity Improvement Act of
2019''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Agency.--The term ``agency'' has the meaning given such
term in section 3502 of title 44, United States Code.
(2) Covered device.--The term ``covered device'' means a
physical object that--
(A) is capable of being in regular connection
with--
(i) the Internet; or
(ii) a network that is connected to the
Internet on a recurring basis;
(B) has computer processing capabilities of
collecting, sending, or receiving data; and
(C) is not a--
(i) general-purpose computing device;
(ii) personal computing system;
(iii) smart mobile communications device;
(iv) programmable logic controller with an
industrial control system specifically not
designed for connection to the internet;
(v) mainframe computing system; or
(vi) subcomponent of a device.
(3) Director of omb.--The term ``Director of OMB'' means
the Director of the Office of Management and Budget.
(4) Director of the institute.--The term ``Director of the
Institute'' means the Director of the National Institute of
Standards and Technology.
(5) Security vulnerability.--The term ``security
vulnerability'' has the meaning given that term under section
102(17) of the Cybersecurity Information Sharing Act of 2015 (6
U.S.C. 1501(17)).
SEC. 3. COMPLETION OF ONGOING EFFORTS RELATING TO CONSIDERATIONS FOR
MANAGING INTERNET OF THINGS CYBERSECURITY RISKS.
Not later than December 31, 2019, the Director of the National
Institute of Standards and Technology shall complete the efforts of the
Institute in effect on the date of the enactment of this Act regarding
considerations for managing the security vulnerabilities of Internet of
Things devices and examples of possible cybersecurity capabilities of
such devices by publishing a report that includes, at a minimum, the
following considerations for covered devices:
(1) Secure development.
(2) Identity management.
(3) Patching.
(4) Configuration management.
SEC. 4. SECURITY STANDARDS FOR USE OF COVERED DEVICES BY THE FEDERAL
GOVERNMENT.
(a) Guidelines Required.--
(1) Guidelines.--Not later than 6 months after the date on
which the report under section 3 is completed, the Director of
the Institute shall develop under section 20 of the National
Institute of Standards and Technology Act (15 U.S.C. 278g-3),
and submit to the Director of OMB, guidelines on--
(A) the appropriate use and management by the
agencies of covered devices owned or controlled by the
agencies; and
(B) minimum information security requirements for
managing security vulnerabilities associated with such
devices.
(2) Development of guidelines.--In developing the
guidelines submitted under paragraph (1), the Director of the
Institute shall--
(A) consider relevant standards and best practices
developed by the private sector, agencies, and public-
private partnerships; and
(B) ensure that such guidelines are consistent with
the considerations published in the report described
under section 3.
(b) Promulgation of Standards.--
(1) Standards.--Not later than 180 days after the date on
which the Director of the Institute completes the development
of the guidelines required under subsection (a), the Director
of OMB, in consultation with the Director of the Cybersecurity
and Infrastructure Security Agency of the Department of
Homeland Security, shall--
(A) promulgate standards on the basis of the
guidelines submitted under subsection (a) pertaining to
covered devices owned or controlled by agencies, except
those considered national security systems as defined
by section 3552(b)(6) of title 44, United States Code;
and
(B) ensure such standards are consistent with the
information security requirements under subchapter II
of chapter 35 of title 44, United States Code.
(2) Quinquennial review and revision.--Not later than 5
years after the date on which the Director of OMB promulgates
the standards under paragraph (1), and not less frequently than
once every 5 years thereafter, the Director of OMB, in
consultation with and the Director of the Institute and the
Director of the Cybersecurity and Infrastructure Security
Agency of the Department of Homeland Security, shall--
(A) review such standards; and
(B) revise such standards as appropriate.
(c) Revision of Federal Acquisition Regulation.--The Federal
Acquisition Regulation shall be revised to implement any standard
promulgated under subsection (b).
SEC. 5. PETITION TO EXCLUDE CERTAIN DEVICES.
(a) Petition.--The Director of OMB shall establish a process by
which an interested party may petition the Director of OMB for a device
described in section 2(2) to not be considered a covered device for the
purpose of standards promulgated under section 4(b).
(b) Grants of Petition.--The Director of OMB shall grant a petition
under subsection (a)--
(1) on a limited basis;
(2) in a timely manner; and
(3) only if the interested party demonstrates that--
(A) the procurement of such a covered device with
limited data processing and software functionality
would be unfeasible; or
(B) the procurement of a covered device that does
not meet the standards promulgated by the Director of
OMB under this Act is necessary for national security
or for research purposes.
(c) Report.--
(1) In general.--Not later than one year after the date of
the enactment of this Act, and annually thereafter for each of
the following four years, the Director of OMB shall submit to
the appropriate congressional committees a report on the
process established by the Director of OMB for granting or
denying waivers under this section.
(2) Assessment of implementation.--The reports required
under paragraph (1) shall include, at a minimum, the following:
(A) An assessment of the waiver evaluation process.
(B) A description of the methods established to
carry out such assessment.
(C) A classified appendix listing the types and
number of devices for each agency granted a waiver and
the reasons for such waiver.
(3) Appropriate congressional committees defined.--In this
subsection, the term ``appropriate congressional committees''
means the Committees on Oversight and Reform and Homeland
Security of the House of Representatives and the Committee on
Homeland Security and Governmental Affairs of the Senate.
SEC. 6. COORDINATED DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO
COVERED DEVICES.
(a) In General.--Not later than 180 days after the date of the
enactment of this Act, the Director of the Institute, in consultation
with the Director of Cybersecurity and Infrastructure Security Agency
of the Department of Homeland Security, shall develop under section 20
of the National Institute of Standards and Technology Act (15 U.S.C.
278g-3) and submit to the Director of OMB, guidelines--
(1) for the reporting, coordinating, publishing, and
receiving of information about--
(A) a security vulnerability relating to a covered
device owned or controlled by an agency; and
(B) the resolution of such security vulnerability;
(2) for contractors providing a covered device to the
Federal Government, and any subcontractor thereof at any tier
providing such device to such contractors on--
(A) receiving information about a potential
security vulnerability relating to the covered device;
and
(B) disseminating information about the resolution
of a security vulnerability relating to the covered
device; and
(3) on the type of information about security
vulnerabilities that should be reported to the Federal
Government, including examples thereof.
(b) Development of Guidelines.--In developing the guidelines under
subsection (a), the Director of the Institute shall--
(1) consult with such cybersecurity researchers and private
sector industry experts as the Director considers appropriate;
(2) to the maximum extent practicable, align such
guidelines with Standards 29147 and 30111 of the International
Standards Organization, or any successor standards thereof; and
(3) ensure such guidelines are consistent with the policies
and procedures developed under section 2209(m) of the Homeland
Security Act of 2002 (6 U.S.C. 659(m)).
(c) Promulgation of Standards.--
(1) In general.--Not later than 180 days after the date on
which the guidelines under subsection (a) are submitted, the
Director of OMB, in consultation with the Administrator of
General Services and the Secretary of Homeland Security, shall
promulgate standards on the basis of such guidelines.
(2) Contract requirement for subcontracts.--The standards
promulgated under paragraph (1) shall include a requirement for
any contract related to a covered device to include a clause
that requires each contractor that provides a covered device
under the contract to an agency to ensure that any covered
device obtained through a subcontract, at any tier, complies
with the standards and regulations promulgated under this
section with respect to such covered device.
(3) Consistency with the strengthening and enhancing cyber-
capabilities by utilizing risk exposure technology act.--The
Director of OMB shall ensure that the standards promulgated
under paragraph (1) are consistent with section 101 of the
Strengthening and Enhancing Cyber-capabilities by Utilizing
Risk Exposure Technology Act (6 U.S.C. 663 note; Public Law
115-390).
(d) Revision of Federal Acquisition Regulation.--The Federal
Acquisition Regulation shall be revised to implement the standards
promulgated under subsection (c).
SEC. 7. CONTRACTOR COMPLIANCE WITH STANDARDS AND REGULATIONS.
(a) In General.--
(1) Determination.--
(A) Compliance required.--Before awarding a
contract to an offeror for the procurement of a covered
device, or renewing a contract to procure or obtain a
covered device from a contractor, the agency Chief
Information Officer shall determine if such offeror or
contractor has complied with each standard promulgated
under section 6(c) with respect to such covered device.
(B) Simplified acquisition threshold.--
Notwithstanding section 1905 of title 41, United States
Code, the requirements under subparagraph (A) shall
apply to a contract or subcontract in amounts not
greater than the simplified acquisition threshold.
(2) Prohibition on use or procurement.--The head of an
agency may not procure or obtain, or renew a contract to
procure or obtain, a covered device if the agency Chief
Information Officer determines under paragraph (1)(A) that such
offeror or contractor has not complied with a standard
promulgated under section 6(c) with respect to such covered
device.
(b) Waiver.--The head of an agency may waive the prohibition under
subsection (a)(2) if the procurement of such covered device is
necessary for national security or for research purposes.
(c) Effective Date.--The prohibition under subsection (a) shall
take effect one year after the date of the enactment of this Act.
SEC. 8. INSTITUTE REPORT ON CYBERSECURITY CONSIDERATIONS STEMMING FROM
THE CONVERGENCE OF INFORMATION TECHNOLOGY, INTERNET OF
THINGS, AND OPERATIONAL TECHNOLOGY DEVICES, NETWORKS AND
SYSTEMS.
Not later than 1 year after the date of the enactment of this Act,
the Director of the Institute shall publish a report on the increasing
convergence, including considerations for managing potential security
vulnerabilities associated with such convergence, of traditional
information technology devices, networks, and systems with--
(1) covered devices, networks and systems; and
(2) operational technology devices, networks and systems.
Union Calendar No. 402
116th CONGRESS
2d Session
H. R. 1668
[Report No. 116-501, Part I]
_______________________________________________________________________
A BILL
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
_______________________________________________________________________
September 14, 2020
Reported from the Committee on Oversight and Reform with an amendment
September 14, 2020
Committee on Science, Space, and Technology discharged; committed to
the Committee of the Whole House on the State of the Union and ordered
to be printed