[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 734 Reported in Senate (RS)]
<DOC>
Calendar No. 215
116th CONGRESS
1st Session
S. 734
[Report No. 116-112]
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 11, 2019
Mr. Warner (for himself, Mr. Gardner, Ms. Hassan, Mr. Daines, Ms.
Cortez Masto, and Mr. Rounds) introduced the following bill; which was
read twice and referred to the Committee on Homeland Security and
Governmental Affairs
September 23, 2019
Reported by Mr. Johnson, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE.</DELETED>
<DELETED> This Act may be cited as the ``Internet of Things
Cybersecurity Improvement Act of 2019'' or the ``IoT Cybersecurity
Improvement Act of 2019''.</DELETED>
<DELETED>SEC. 2. DEFINITIONS.</DELETED>
<DELETED> In this Act:</DELETED>
<DELETED> (1) Agency.--The term ``agency'' has the meaning
given such term in section 3502 of title 44, United States
Code.</DELETED>
<DELETED> (2) Covered device.--</DELETED>
<DELETED> (A) In general.--The term ``covered
device'' means a physical object that--</DELETED>
<DELETED> (i) is capable of connecting to
and is in regular connection with the
Internet;</DELETED>
<DELETED> (ii) has computer processing
capabilities that can collect, send, or receive
data; and</DELETED>
<DELETED> (iii) is not a general-purpose
computing device, including personal computing
systems, smart mobile communications devices,
programmable logic controls, and mainframe
computing systems.</DELETED>
<DELETED> (B) Modification of definition.--The
Director of the Office of Management and Budget shall
establish a process by which--</DELETED>
<DELETED> (i) interested parties may
petition for a device that is not described in
subparagraph (A) to be considered a device that
is not a covered device; and</DELETED>
<DELETED> (ii) the Director acts upon any
petition submitted under clause (i) in a timely
manner.</DELETED>
<DELETED> (3) Security vulnerability.--The term ``security
vulnerability'' means any attribute of hardware, firmware,
software, or combination of 2 or more of these factors that
could enable the compromise of the confidentiality, integrity,
or availability of an information system or its information or
physical devices to which it is connected.</DELETED>
<DELETED>SEC. 3. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
CONSIDERATIONS AND RECOMMENDATIONS REGARDING MANAGING
INTERNET OF THINGS CYBERSECURITY RISKS.</DELETED>
<DELETED> (a) Completion of Ongoing Efforts Relating to
Considerations for Managing Internet of Things Cybersecurity Risks.--
</DELETED>
<DELETED> (1) In general.--The Director of the National
Institute of Standards and Technology shall ensure that the
efforts of the Institute in effect on the date of the enactment
of this Act regarding considerations for managing Internet of
Things cybersecurity risks, especially regarding examples of
possible cybersecurity capabilities of Internet of Things
devices, are completed no later than September 30,
2019.</DELETED>
<DELETED> (2) Matters addressed.--In ensuring efforts are
completed under paragraph (1), the Director shall also ensure
that such efforts address, at a minimum, the following
considerations for covered devices:</DELETED>
<DELETED> (A) Secure Development.</DELETED>
<DELETED> (B) Identity management.</DELETED>
<DELETED> (C) Patching.</DELETED>
<DELETED> (D) Configuration management.</DELETED>
<DELETED> (b) Development of Recommended Standards for Use of
Internet of Things Devices by Federal Government.--</DELETED>
<DELETED> (1) In general.--Not later than March 31, 2020,
the Director of the Institute shall develop recommendations for
the Federal Government on the appropriate use and management by
the Federal Government of Internet of Things devices owned or
controlled by the Federal Government, including minimum
information security requirements for managing cybersecurity
risks associated with such devices.</DELETED>
<DELETED> (2) Consistency with ongoing efforts.--The
Director of the Institute shall ensure that the recommendations
and standards developed under paragraph (1) are consistent with
the efforts referred to in subsection (a), especially with
respect to the examples of possible cybersecurity capabilities
referred to in such subsection.</DELETED>
<DELETED> (c) Institute Report on Cybersecurity Considerations
Stemming From the Convergence of Information Technology, Internet of
Things, and Operational Technology Devices, Networks and Systems.--Not
later than 180 days following the enactment of this Act, the Director
of the Institute shall publish a draft report related to the increasing
convergence of traditional Information Technology devices, networks,
and systems with Internet of Things devices, networks and systems and
Operational Technology devices, networks and systems, including
considerations for managing cybersecurity risks associated with such
trends.</DELETED>
<DELETED>SEC. 4. POLICIES FOR FEDERAL AGENCIES ON USE AND MANAGEMENT OF
INTERNET OF THINGS DEVICES.</DELETED>
<DELETED> (a) Revisions to the Federal Acquisition Regulation.--Not
later than 180 days after the date on which the Director of the
National Institute of Standards and Technology completes the
development of the recommendations required under section 3(b), the
Director of the Office of Management and Budget shall issue guidelines
for each agency that are consistent with such
recommendations.</DELETED>
<DELETED> (b) Requirement.--In issuing the guidelines required under
subsection (a), the Director of the Office of Management and Budget
shall ensure that the guidelines are consistent with the information
security requirements in subchapter II of chapter 35 of title 44,
United States Code.</DELETED>
<DELETED> (c) Quinquennial Reviews and Revisions.--Not less
frequently than once every 5 years--</DELETED>
<DELETED> (1) the Director of the Office of Management and
Budget and the Director of the National Institute of Standards
and Technology shall review the policies issued under
subsection (a); and</DELETED>
<DELETED> (2) the Director of the Office of Management and
Budget shall, in consultation with the Director of the National
Institute of Standards and Technology, revise such
policies.</DELETED>
<DELETED>SEC. 5. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
GUIDANCE ON COORDINATED DISCLOSURE OF SECURITY
VULNERABILITIES RELATING TO INTERNET OF THINGS
DEVICES.</DELETED>
<DELETED> (a) In General.--Not later than 180 days after the date of
the enactment of this Act, the Director of the National Institute of
Standards and Technology shall, in consultation with such cybersecurity
researchers and private-sector industry experts as the Director
considers appropriate, publish guidance on policies and procedures for
the reporting, coordinating, publishing, and receiving of information
about--</DELETED>
<DELETED> (1) a security vulnerability relating to a covered
device used by the Federal Government; and</DELETED>
<DELETED> (2) the resolution of such security
vulnerability.</DELETED>
<DELETED> (b) Elements.--The guidance published under subsection (a)
shall include the following:</DELETED>
<DELETED> (1) Policies and procedures described in
subsection (a) that, to the maximum extent practicable, are
aligned with Standards 29147 and 30111 of the International
Standards Organization, or any successor standards. Such
policies and procedures shall include policies and procedures
for a contractor or vendor providing a covered device to the
Federal Government on--</DELETED>
<DELETED> (A) receiving information about a
potential security vulnerability relating to the
covered device; and</DELETED>
<DELETED> (B) disseminating information about the
resolution of a security vulnerability relating to the
covered device.</DELETED>
<DELETED> (2) Guidance, including example content, on the
information items that should be produced through the
implementation of the security vulnerability disclosure process
of the contractor.</DELETED>
<DELETED>SEC. 6. GUIDELINES FOR FEDERAL AGENCIES ON COORDINATED
DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO
INTERNET OF THINGS DEVICES.</DELETED>
<DELETED> (a) Agency Guidelines Required.--Not later than 180 days
after the date on which the guidance required under section 4 is
published, the Director of the Office of Management and Budget shall,
in consultation with the Administrator of the General Services
Administration, issue guidelines for each agency on reporting,
coordinating, publishing, and receiving information about--</DELETED>
<DELETED> (1) a security vulnerability relating to a covered
device used by the agency; and</DELETED>
<DELETED> (2) the resolution of such security
vulnerability.</DELETED>
<DELETED> (b) Contractor and Vendor Compliance With National
Institute of Standards and Technology Guidance.--The guidelines
required by subsection (a) shall include a limitation that prohibits an
agency from acquiring or using any covered device from a contractor or
vendor if the contractor or vendor fails to comply with the guidance
published under section 5(a).</DELETED>
<DELETED> (c) Consistency With Guidance From National Institute of
Standards and Technology.--The Director shall ensure that the
guidelines issued under subsection (a) are consistent with the guidance
published under section 5(a).</DELETED>
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Internet of Things Cybersecurity
Improvement Act of 2019'' or the ``IoT Cybersecurity Improvement Act of
2019''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Agency.--The term ``agency'' has the meaning given such
term in section 3502 of title 44, United States Code.
(2) Director.--The term ``Director'' means the Director of
the National Institute of Standards and Technology.
(3) Information system.--The term ``information system''
has the meaning given the term in section 3502 of title 44,
United States Code.
(4) Secretary.--The term ``Secretary'' means the Secretary
of Homeland Security.
(5) Security vulnerability.--The term ``security
vulnerability'' has the meaning given the term in section 102
of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C.
1501).
SEC. 3. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY CONSIDERATIONS
AND RECOMMENDATIONS REGARDING MANAGING INTERNET OF THINGS
CYBERSECURITY RISKS.
(a) Development of Recommended Guidelines for Use of Internet of
Things Devices by Federal Government.--
(1) In general.--Not later than March 31, 2020, the
Director shall develop standards and guidelines for the Federal
Government on the appropriate use and management by the Federal
Government of Internet of Things devices owned or controlled by
the Federal Government, including minimum information security
requirements for managing cybersecurity risks associated with
such devices.
(2) Consistency with ongoing efforts.--The Director shall
ensure that the standards and guidelines developed under
paragraph (1) are consistent with the efforts of the National
Institute of Standards and Technology in effect on the date of
enactment of this Act regarding considerations for managing
Internet of Things cybersecurity risks, especially regarding
examples of possible cybersecurity capabilities of Internet of
Things devices, and in particular with respect to the following
considerations for Internet of Things devices:
(A) Secure development.
(B) Identity management.
(C) Patching.
(D) Configuration management.
(b) Institute Report on Cybersecurity Considerations Stemming From
the Convergence of Information Technology, Internet of Things, and
Operational Technology Devices, Networks, and Systems.--Not later than
180 days after the date of enactment of this Act, the Director shall
brief the appropriate committees of Congress on the increasing
convergence of traditional information technology devices, networks,
and systems with Internet of Things devices, networks, and systems and
operational technology devices, networks, and systems, including
considerations for managing cybersecurity risks and security
vulnerabilities associated with such trends.
SEC. 4. POLICIES AND PRINCIPLES FOR FEDERAL AGENCIES ON USE AND
MANAGEMENT OF INTERNET OF THINGS DEVICES.
(a) In General.--Not later than 180 days after the date on which
the Director completes the development of the standards and guidelines
required under section 3(a), the Director of the Office of Management
and Budget, in consultation with the Secretary, shall issue policies
and principles for each agency that are consistent with such standards
and guidelines.
(b) Requirement.--In issuing the policies, principles, standards,
or guidelines required under subsection (a), the Director of the Office
of Management and Budget, in consultation with the Secretary, shall
ensure that the policies and principles are consistent with the
information security requirements in subchapter II of chapter 35 of
title 44, United States Code.
(c) Reviews and Revisions.--The Director of the Office of
Management and Budget, in consultation with the Secretary, shall--
(1) review any policies, principles, standards, or
guidelines issued under subsection (a); and
(2) revise such policies, principles, standards, and
guidelines.
SEC. 5. GUIDELINES ON COORDINATED DISCLOSURE OF SECURITY
VULNERABILITIES RELATING TO INFORMATION SYSTEMS,
INCLUDING INTERNET OF THINGS DEVICES.
(a) In General.--Not later than 1 year after the date of enactment
of this Act, the Director, in consultation with such cybersecurity
researchers and private-sector industry experts as the Director
considers appropriate, and in consultation with the Secretary, shall
publish guidelines for the reporting, coordinating, publishing, and
receiving of information about--
(1) a security vulnerability relating to agency information
systems, including Internet of Things devices; and
(2) the resolution of such security vulnerability.
(b) Elements.--The guidelines published under subsection (a)
shall--
(1) to the maximum extent practicable, be aligned with
industry best practices and Standards 29147 and 30111 of the
International Standards Organization, or any successor
standards; and
(2) incorporate guidelines on--
(A) receiving information about a potential
security or personal information vulnerability relating
to agency information systems, and when relevant,
Internet of Things devices; and
(B) disseminating information about the resolution
of a security or personal information vulnerability
relating to agency information systems, and when
relevant, Internet of Things devices.
(c) Information Items.--The guidelines published under subsection
(a) shall include guidelines, including example content, on the
information items that should be produced through the implementation of
the security vulnerability disclosure process of a contractor or vendor
providing Internet of Things devices to the Federal Government.
(d) Oversight.--The Director of the Office of Management and Budget
shall oversee the implementation of the guidelines published under
subsection (a).
(e) Operational and Technical Assistance.--The Secretary shall
provide operational and technical assistance in implementing the
guidelines published under subsection (a).
SEC. 6. IMPLEMENTATION OF COORDINATED DISCLOSURE OF SECURITY
VULNERABILITIES RELATING TO AGENCY INFORMATION SYSTEMS,
INCLUDING INTERNET OF THINGS DEVICES.
(a) Agency Guidelines Required.--Not later than 180 days after the
date on which the Director publishes guidelines under section 5(a), the
Director of the Office of Management and Budget shall issue policies
and principles on security vulnerabilities of information systems,
including Internet of Things devices.
(b) Procedures.--The Secretary, in consultation with the Director
of the Office of Management and Budget, shall develop and issue
procedures for each agency on reporting, coordinating, publishing, and
receiving information about security vulnerabilities of information
systems, including Internet of Things devices.
(c) Contractor and Vendor Compliance With Policies and
Procedures.--The procedures required under subsection (b) shall include
a limitation that prohibits an agency from acquiring or using any
Internet of Things device from a contractor or vendor if the contractor
or vendor fails to comply with the guidelines published under section
5(a).
(d) Consistency With Guidelines From National Institute of
Standards and Technology.--The Secretary shall ensure that the
procedures required under subsection (b) are consistent with applicable
standards and publications established by the National Institute of
Standards and Technology.
SEC. 7. WAIVER.
The head of an agency may use an Internet of Things device without
regard to any policies, principles, standards, or guidelines issued
under this Act if the use of the Internet of Things device is--
(1) necessary for national security or for research
purposes;
(2) appropriate to the function of the covered device;
(3) secured using alternative and effective methods; or
(4) of substantially higher quality or affordability than a
product that meets such policies, principles, standards, or
guidelines.
Calendar No. 215
116th CONGRESS
1st Session
S. 734
[Report No. 116-112]
_______________________________________________________________________
A BILL
To leverage Federal Government procurement power to encourage increased
cybersecurity for Internet of Things devices, and for other purposes.
_______________________________________________________________________
September 23, 2019
Reported with an amendment
IoT Cybersecurity Improvement Act of 2019
#734 | S Congress #116
Policy Area: Government Operations and Politics
Subjects: Administrative law and regulatory proceduresComputer security and identity theftComputers and information technologyGovernment information and archivesGovernment studies and investigationsInternet and video servicesInternet, web applications, social mediaOffice of Management and Budget (OMB)Public contracts and procurement
Last Action: Placed on Senate Legislative Calendar under General Orders. Calendar No. 215. (9/23/2019)
Bill Text Source: Congress.gov
Summary and Impacts
Original Text