[Congressional Record Volume 167, Number 192 (Tuesday, November 2, 2021)]
[Senate]
[Page S7621]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 4156. Mr. WYDEN submitted an amendment intended to be proposed to 
amendment SA 3867 submitted by Mr. Reed and intended to be proposed to 
the bill H.R. 4350, to authorize appropriations for fiscal year 2022 
for military activities of the Department of Defense, for military 
construction, and for defense activities of the Department of Energy, 
to prescribe military personnel strengths for such fiscal year, and for 
other purposes; which was ordered to lie on the table; as follows:

        At the appropriate place, insert the following:

     SEC. ___. FEDERAL CYBERSECURITY REQUIREMENTS.

       (a) Exemption From Federal Requirements.--Section 225(b)(2) 
     of the Federal Cybersecurity Enhancement Act of 2015 (6 
     U.S.C. 1523(b)(2)) is amended to read as follows:
       ``(2) Exception.--
       ``(A) In general.--A particular requirement under paragraph 
     (1) shall not apply to an agency information system of an 
     agency if--
       ``(i) with respect to the agency information system, the 
     head of the agency submits to the Director an application for 
     an exemption from the particular requirement, in which the 
     head of the agency personally certifies to the Director with 
     particularity that--

       ``(I) operational requirements articulated in the 
     certification and related to the agency information system 
     would make it excessively burdensome to implement the 
     particular requirement;
       ``(II) the particular requirement is not necessary to 
     secure the agency information system or agency information 
     stored on or transiting the agency information system; and
       ``(III) the agency has taken all necessary steps to secure 
     the agency information system and agency information stored 
     on or transiting the agency information system;

       ``(ii) the head of the agency or the designee of the head 
     of the agency has submitted the certification described in 
     clause (i) to the appropriate congressional committees and 
     any other congressional committee with jurisdiction over the 
     agency; and
       ``(iii) the Director grants the exemption from the 
     particular requirement.
       ``(B) Duration of exemption.--
       ``(i) In general.--An exemption granted under subparagraph 
     (A) shall expire on the date that is 1 year after the date on 
     which the Director grants the exemption.
       ``(ii) Renewal.--Upon the expiration of an exemption 
     granted to an agency under subparagraph (A), the head of the 
     agency may apply for an additional exemption.''.
       (b) Report on Exemptions.--Section 3554(c)(1)(A) of title 
     44, United States Code, is amended--
       (1) in clause (iii), by striking ``and'' at the end;
       (2) by redesignating clause (iv) as clause (v); and
       (3) by inserting after clause (iii) the following:
       ``(iv) with respect to any exemptions the agency is granted 
     by the Director of the Office of Management and Budget under 
     section 225(b)(2) of the Federal Cybersecurity Enhancement 
     Act of 2015 (6 U.S.C. 1523(b)(2)) that is effective on the 
     date of submission of the report--

       ``(I) an identification of the particular requirements from 
     which any agency information system (as defined in section 
     2210 of the Homeland Security Act of 2002 (6 U.S.C. 660)) is 
     exempted; and
       ``(II) for each requirement identified under subclause 
     (I)--

       ``(aa) an identification of the agency information system 
     described in subclause (I) exempted from the requirement; and
       ``(bb) an estimate of the date on which the agency will to 
     be able to comply with the requirement; and''.
       (c) Effective Date.--This section and the amendments made 
     by this section shall take effect on the date that is 1 year 
     after the date of enactment of this Act.
                                 ______