[Congressional Record Volume 162, Number 52 (Wednesday, April 6, 2016)]
[Senate]
[Page S1757]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 3469. Mr. MARKEY submitted an amendment intended to be proposed by 
him to the bill H.R. 636, to amend the Internal Revenue Code of 1986 to 
permanently extend increased expensing limitations, and for other 
purposes; which was ordered to lie on the table; as follows:

       On page 353, between lines 15 and 16, insert the following:
       (d) Incorporation of Cybersecurity Into Requirements for 
     Air Carrier Operating Certificates and Production 
     Certificates.--
       (1) Regulations.--Not later than 270 days after the date of 
     the enactment of this Act, the Secretary of Transportation, 
     in consultation with the Secretary of Defense, the Secretary 
     of Homeland Security, the Attorney General, the Federal 
     Communications Commission, and the Director of National 
     Intelligence, shall prescribe regulations to incorporate 
     requirements relating to cybersecurity into the requirements 
     for obtaining an air carrier operating certificate or a 
     production certificate under chapter 447 of title 49, United 
     States Code.
       (2) Requirements.--In prescribing the regulations required 
     by paragraph (1), the Secretary shall--
       (A) require all entry points to the electronic systems of 
     each aircraft operating in United States airspace and 
     maintenance or ground support systems for such aircraft to be 
     equipped with reasonable measures to protect against 
     cyberattacks, including the use of isolation measures to 
     separate critical software systems from noncritical software 
     systems;
       (B) require the periodic evaluation of the measures 
     described in subparagraph (A) for security vulnerabilities 
     using best security practices, including the appropriate 
     application of techniques such as penetration testing, in 
     consultation with the Secretary of Defense, the Secretary of 
     Homeland Security, the Attorney General, the Federal 
     Communications Commission, and the Director of National 
     Intelligence; and
       (C) require the measures described in subparagraph (A) to 
     be periodically updated based on the results of the 
     evaluations conducted under subparagraph (B).
       (3) Definitions.--In this subsection:
       (A) Cyberattack.--The term ``cyberattack'' means the 
     unauthorized access to aircraft electronic control or 
     communications systems or maintenance or ground support 
     systems for aircraft, either wirelessly or through a wired 
     connection.
       (B) Critical software systems.--The term ``critical 
     software systems'' means software systems that can affect 
     control over the operation of an aircraft.
       (C) Entry point.--The term ``entry point'' means the means 
     by which signals to control a system on board an aircraft or 
     a maintenance or ground support system for aircraft may be 
     sent or received.
                                 ______