[Congressional Record Volume 161, Number 125 (Tuesday, August 4, 2015)]
[Senate]
[Page S6312]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 2588. Mrs. BOXER submitted an amendment intended to be proposed by 
her to the bill S. 754, to improve cybersecurity in the United States 
through enhanced sharing of information about cybersecurity threats, 
and for other purposes; which was ordered to lie on the table; as 
follows:

       At the end of section 7, insert the following:
       (c) Annual Data Security Certification.--
       (1) In general.--Not later than 1 year after the date of 
     the enactment of this Act and not less frequently than 
     annually thereafter, the Director of the Office of Management 
     and Budget shall certify the adequacy of the security 
     controls utilized by Federal entities to protect information 
     shared or received under this Act.
       (2) Contents.--Each certificate issued by the Director 
     under paragraph (1) shall include a description of the 
     adequacy of the security controls of each Federal entity 
     based on--
       (A) a review of the annual reports and evaluations 
     submitted under sections 3554(c) and 3555 of title 44, United 
     States Code; and
       (B) any additional certification requirements determined 
     necessary by the Director.
       (3) Actions if inadequate security controls are detected.--
       (A) In general.--If the Director determines the security 
     controls of a Federal entity are not adequate to protect the 
     information shared or received under this Act, the Director 
     shall submit to such Federal entity, in writing, a notice of 
     the actions the Federal entity shall take in order to ensure 
     that the information is adequately protected.
       (B) Schedule and explanation.--Not later than 30 days after 
     the date the Director submits a notice under subparagraph 
     (A), the Federal entity shall--
       (i) take the actions required by the notice; or
       (ii) submit to the Director and the appropriate committees 
     of Congress, in writing, an explanation of why such actions 
     have not been taken and an estimate of the number of days 
     until such actions shall be taken.
       (C) Appropriate committees of congress.--In this paragraph, 
     the term ``appropriate committees of Congress'' means the 
     following:
       (i) The Committee on Commerce, Science, and Transportation, 
     the Committee on Homeland Security and Governmental Affairs, 
     and the Select Committee on Intelligence of the Senate.
       (ii) The Committee on Homeland Security, the Permanent 
     Select Committee on Intelligence, the Committee on Oversight 
     and Government Reform, and the Committee on Science, Space, 
     and Technology of the House of Representatives.
       (4) Form.--Each certification, notice, and explanation 
     required under this subsection shall be submitted in 
     unclassified form, but may include a classified annex.
                                 ______