(a) Subchapter I amendments.—Subchapter I of chapter 35 of title 44, United States Code, is amended—

(1) in section 3504—

(A) in subsection (a)(1)(B)(v), by striking “confidentiality, security, disclosure, and sharing of information” and inserting “disclosure, sharing of information, and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, confidentiality and security”;

(B) in subsection (b)(2)(B), by inserting “in coordination with the Director of the Cybersecurity and Infrastructure Security Agency” after “standards for security”;

(C) in subsection (g), by striking paragraph (1) and inserting the following:

“(1) with respect to information collected or maintained by or for agencies—

“(A) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, disclosure, and sharing of the information; and

“(B) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, develop and oversee policies, principles, standards, and guidelines on confidentiality and security of the information; and”; and

(D) in subsection (h)(1)—

(i) in the matter preceding subparagraph (A)—

(I) by inserting “the Director of the Cybersecurity and Infrastructure Security Agency,” before “the Director”; and

(II) by inserting a comma before “and the Administrator”; and

(ii) in subparagraph (A), by inserting “security and” after “information technology”;

(2) in section 3505—

(A) in paragraph (3) of the first subsection designated as subsection (c)—

(i) in subparagraph (B)—

(I) by inserting “and the Director of the Cybersecurity and Infrastructure Security Agency” after “Comptroller General”; and

(II) by striking “and” at the end;

(ii) in subparagraph (C)(v), by striking the period at the end and inserting “; and”; and

(iii) by adding at the end the following:

“(D) maintained on a continual basis through the use of automation, machine-readable data, and scanning.”; and

(B) by striking the second subsection designated as subsection (c);

(3) in section 3506—

(A) in subsection (b)—

(i) in paragraph (1)(C), by inserting “, availability” after “integrity”; and

(ii) in paragraph (4), by inserting “the Director of the Cybersecurity and Infrastructure Security Agency,” after “General Services,”; and

(B) in subsection (h)(3), by inserting “security,” after “efficiency,”;

(4) in section 3513—

(A) in subsection (a), by inserting “the Director of the Cybersecurity and Infrastructure Security Agency,” before “the Administrator of General Services”;

(B) by redesignating subsection (c) as subsection (d); and

(C) by inserting after subsection (b) the following:

“(c) Each agency providing a written plan under subsection (b) shall provide any portion of the written plan addressing information security or cybersecurity to the Director of the Cybersecurity and Infrastructure Security Agency.”; and

(5) in section 3520A(b)—

(A) in paragraph (1), by striking “, protection”;

(B) by redesignating paragraphs (2), (3), (4), and (5) as paragraphs (3), (4), (5), and (6), respectively; and

(C) by inserting after paragraph (1) the following:

“(2) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, establish Governmentwide best practices for the protection of data;”.

(b) Suchapter II definitions.—

(1) IN GENERAL.—Section 3552(b) of title 44, United States Code, is amended—

(A) by redesignating paragraphs (1), (2), (3), (4), (5), (6), and (7) as paragraphs (2), (3), (4), (5), (6), (9), and (11), respectively;

(B) by inserting before paragraph (2), as so redesignated, the following:

“(1) The term ‘additional cybersecurity procedure’ means a process, procedure, or other activity that is established in excess of the information security standards promulgated under section 11331(b) of title 40 to increase the security and reduce the cybersecurity risk of agency systems, such as continuous threat hunting, increased network segmentation, endpoint detection and response, or persistent penetration testing.”;

(C) by inserting after paragraph (6), as so redesignated, the following:

“(7) The term ‘high value asset’ means information or an information system that the head of an agency determines so critical to the agency that the loss or corruption of the information or the loss of access to the information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business.

“(8) The term ‘major incident’ has the meaning given the term in guidance issued by the Director under section 3598(a).”;

(D) by inserting after paragraph (9), as so redesignated, the following:

“(10) The term ‘penetration test’ means a specialized type of assessment that—

“(A) is conducted on an information system or a component of an information system; and

“(B) emulates an attack or other exploitation capability of a potential adversary, typically under specific constraints, in order to identify any vulnerabilities of an information system or a component of an information system that could be exploited.”; and

(E) by inserting after paragraph (11), as so redesignated, the following:

“(12) The term ‘shared service’ means a business or mission function that is provided for use by multiple organizations within or between agencies.

“(13) The term ‘verification specification’ means a specification developed under section 11331(f) of title 40.”.

(2) CONFORMING AMENDMENTS.—

(A) HOMELAND SECURITY ACT OF 2002.—Section 1001(c)(1)(A) of the Homeland Security Act of 2002 (6 U.S.C. 511(1)(A)) is amended by striking “section 3552(b)(5)” and inserting “section 3552(b)”.

(B) TITLE 10.—

(i) SECTION 2222.—Section 2222(i)(8) of title 10, United States Code, is amended by striking “section 3552(b)(6)(A)” and inserting “section 3552(b)(9)(A)”.

(ii) SECTION 2223.—Section 2223(c)(3) of title 10, United States Code, is amended by striking “section 3552(b)(6)” and inserting “section 3552(b)”.

(iii) SECTION 2315.—Section 2315 of title 10, United States Code, is amended by striking “section 3552(b)(6)” and inserting “section 3552(b)”.

(iv) SECTION 2339A.—Section 2339a(e)(5) of title 10, United States Code, is amended by striking “section 3552(b)(6)” and inserting “section 3552(b)”.

(C) HIGH-PERFORMANCE COMPUTING ACT OF 1991.—Section 207(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5527(a)) is amended by striking “section 3552(b)(6)(A)(i)” and inserting “section 3552(b)(9)(A)(i)”.

(D) INTERNET OF THINGS CYBERSECURITY IMPROVEMENT ACT OF 2020.—Section 3(5) of the Internet of Things Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a) is amended by striking “section 3552(b)(6)” and inserting “section 3552(b)”.

(E) NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2013.—Section 933(e)(1)(B) of the National Defense Authorization Act for Fiscal Year 2013 (10 U.S.C. 2224 note) is amended by striking “section 3542(b)(2)” and inserting “section 3552(b)”.

(F) IKE SKELTON NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2011.—The Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111–383) is amended—

(i) in section 806(e)(5) (10 U.S.C. 2304 note), by striking “section 3542(b)” and inserting “section 3552(b)”;

(ii) in section 931(b)(3) (10 U.S.C. 2223 note), by striking “section 3542(b)(2)” and inserting “section 3552(b)”; and

(iii) in section 932(b)(2) (10 U.S.C. 2224 note), by striking “section 3542(b)(2)” and inserting “section 3552(b)”.

(G) E-GOVERNMENT ACT OF 2002.—Section 301(c)(1)(A) of the E-Government Act of 2002 (44 U.S.C. 3501 note) is amended by striking “section 3542(b)(2)” and inserting “section 3552(b)”.

(H) NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ACT.—Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3) is amended—

(i) in subsection (a)(2), by striking “section 3552(b)(5)” and inserting “section 3552(b)”; and

(ii) in subsection (f)—

(I) in paragraph (3), by striking “section 3532(1)” and inserting “section 3552(b)”; and

(II) in paragraph (5), by striking “section 3532(b)(2)” and inserting “section 3552(b)”.

(c) Subchapter II amendments.—Subchapter II of chapter 35 of title 44, United States Code, is amended—

(1) in section 3551—

(A) by redesignating paragraphs (3), (4), (5), and (6) as paragraphs (4), (5), (6), and (7), respectively;

(B) by inserting after paragraph (2) the following:

“(3) recognize the role of the Cybersecurity and Infrastructure Security Agency as the lead cybersecurity entity for operational coordination across the Federal Government;”;

(C) in paragraph (5), as so redesignated, by striking “diagnose and improve” and inserting “integrate, deliver, diagnose, and improve”;

(D) in paragraph (6), as so redesignated, by striking “and” at the end; and

(E) by adding at the end the following:

“(8) recognize that each agency has specific mission requirements and, at times, unique cybersecurity requirements to meet the mission of the agency;

“(9) recognize that each agency does not have the same resources to secure agency systems, and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone; and

“(10) recognize that—

“(A) a holistic Federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies; and

“(B) in accounting for the differences described in subparagraph (A) and ensuring overall Federal cybersecurity—

“(i) the Office of Management and Budget is the leader for policy development and oversight of Federal cybersecurity;

“(ii) the Cybersecurity and Infrastructure Security Agency is the leader for implementing operations at agencies; and

“(iii) the National Cyber Director is responsible for developing the overall cybersecurity strategy of the United States and advising the President on matters relating to cybersecurity.”;

(2) in section 3553, as amended by section 1705 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (Public Law 116–283)—

(A) in subsection (a)—

(i) in paragraph (1)—

(I) by striking “developing and” and inserting “in coordination with the Director of the Cybersecurity and Infrastructure Security Agency,”; and

(II) by inserting “and associated verification specifications” before “promulgated”; and

(ii) in paragraph (5), by inserting “, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency,” before “agency compliance”;

(B) in subsection (b)—

(i) by striking the subsection heading and inserting “Cybersecurity and Infrastructure Security Agency”;

(ii) in the matter preceding paragraph (1), by striking “the Secretary” and inserting “the Director of the Cybersecurity and Infrastructure Security Agency”;

(iii) in paragraph (2)—

(I) in subparagraph (A), by inserting “and reporting requirements under subchapter IV of this title” after “section 3556”; and

(II) in subparagraph (D), by striking “the Director or Secretary” and inserting “the Director of the Cybersecurity and Infrastructure Security Agency”;

(iv) in paragraph (5), by striking “coordinating” and inserting “leading the coordination of”;

(v) in paragraph (6)—

(I) in the matter preceding subparagraph (A), by inserting “and verifications specifications” before “promulgated under”;

(II) in subparagraph (C), by striking “and” at the end;

(III) in subparagraph (D), by adding “and” at the end; and

(IV) by adding at the end the following:

“(E) taking any other action that the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director—

“(i) may determine necessary; and

“(ii) is authorized to perform;”;

(vi) in paragraph (8), by striking “the Secretary's discretion” and inserting “the Director of the Cybersecurity and Infrastructure Security Agency's discretion”; and

(vii) in paragraph (9), by striking “as the Director or the Secretary, in consultation with the Director,” and inserting “as the Director of the Cybersecurity and Infrastructure Security Agency”;

(C) in subsection (c)—

(i) in paragraph (4), by striking “and” at the end;

(ii) by redesignating paragraph (5) as paragraph (7); and

(iii) by inserting after paragraph (4) the following:

“(5) an assessment of agency use of automated verification of standards for the standards promulgated under section 11331 of title 40 using verification specifications;

“(6) a summary of each assessment of Federal risk posture performed under subsection (i); and”;

(D) in subsection (f)(2)(B), by striking “conflict with” and inserting “reduce the security posture of agencies established under”;

(E) by redesignating subsections (i), (j), (k), and (l) as subsections (j), (k), (l), and (m) respectively;

(F) by inserting after subsection (h) the following:

“(i) Federal risk assessments.—The Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall perform, on an ongoing and continuous basis, assessments of Federal risk posture using any available information on the cybersecurity posture of agencies, including—

“(1) the status of agency cybersecurity remedial actions described in section 3554(b)(7);

“(2) any vulnerability information relating to the systems of an agency that is known by the agency;

“(3) analysis of incident information under section 3597;

“(4) evaluation of penetration testing performed under section 3559A;

“(5) evaluation of vulnerability disclosure program information under section 3559B;

“(6) evaluation of agency threat hunting results;

“(7) evaluation of Federal and non-Federal threat intelligence;

“(8) data on compliance with standards issued under section 11331 of title 40 that, when appropriate, uses verification specifications;

“(9) agency system risk assessments performed under section 3554(a)(1)(A); and

“(10) any other information the Secretary determines relevant.”; and

(G) in subsection (j), as so redesignated—

(i) by striking “regarding the specific” and inserting “that includes a summary of—

“(1) the specific”;

(ii) in paragraph (1), as so designated, by striking the period at the end and inserting “; and” and

(iii) by adding at the end the following:

“(2) the trends identified in the Federal risk assessment performed under subsection (i).”;

(3) in section 3554—

(A) in subsection (a)—

(i) in paragraph (1)—

(I) by redesignating subparagraphs (A), (B), and (C) as subparagraphs (B), (C), and (D), respectively;

(II) by inserting before subparagraph (B), as so redesignated, the following:

“(A) performing, not less frequently than once every 2 years or based on a significant change to system architecture or security posture, an agency system risk assessment that—

“(i) identifies and documents the high value assets of the agency using guidance from the Director;

“(ii) evaluates the data assets inventoried under section 3511 of title 44 for sensitivity to compromises in confidentiality, integrity, and availability;

“(iii) identifies agency systems that have access to or hold the data assets inventoried under section 3511 of title 44;

“(iv) evaluates the threats facing agency systems and data, including high value assets, based on Federal and non-Federal cyber threat intelligence products, where available;

“(v) evaluates the vulnerability of agency systems and data, including high value assets, based on—

“(I) the results of penetration testing performed by the Department of Homeland Security under section 3553(b)(9);

“(II) the results of penetration testing performed under section 3559A;

“(III) information provided to the agency through the vulnerability disclosure program of the agency under section 3559B;

“(IV) incidents; and

“(V) any other vulnerability information relating to agency systems that is known to the agency;

“(vi) assesses the impacts of potential agency incidents to agency systems, data, and operations based on the evaluations described in clauses (ii) and (iv) and the agency systems identified under clause (iii); and

“(vii) assesses the consequences of potential incidents occurring on agency systems that would impact systems at other agencies, including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system;”;

(III) in subparagraph (B), as so redesignated—

(aa) in the matter preceding clause (i), by striking “providing information” and inserting “using information from the assessment conducted under subparagraph (A), providing, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, information”;

(bb) in clause (i), by striking “and” at the end;

(cc) in clause (ii), by adding “and” at the end; and

(dd) by adding at the end the following:

“(iii) in consultation with the Director and the Director of the Cybersecurity and Infrastructure Security Agency, information or information systems used by agencies through shared services, memoranda of understanding, or other agreements;”;

(IV) in subparagraph (C), as so redesignated—

(aa) in clause (ii) by inserting “binding” before “operational”; and

(bb) in clause (vi), by striking “and” at the end; and

(V) by adding at the end the following:

“(E) not later than 30 days after the date on which an agency system risk assessment is performed under subparagraph (A), providing the assessment to—

“(i) the Director;

“(ii) the Director of the Cybersecurity and Infrastructure Security Agency; and

“(iii) the National Cyber Director;

“(F) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and not less frequently than annually, performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of, or under the supervision of, the agency, which shall—

“(i) be completed considering the agency system risk assessment performed under subparagraph (A); and

“(ii) include a specific evaluation for high value assets; and

“(G) not later than 30 days after completing the evaluation performed under subparagraph (F), providing the evaluation and an implementation plan for using additional cybersecurity procedures determined to be appropriate to—

“(i) the Director of the Cybersecurity and Infrastructure Security Agency;

“(ii) the Director; and

“(iii) the National Cyber Director.”;

(ii) in paragraph (2)—

(I) in subparagraph (A), by inserting “in accordance with the agency system risk assessment performed under paragraph (1)(A)” after “information systems”;

(II) in subparagraph (B)—

(aa) by striking “in accordance with standards” and inserting “in accordance with—

“(i) standards”; and

(bb) by adding at the end the following:

“(ii) the evaluation performed under paragraph (1)(F); and

“(iii) the implementation plan described in paragraph (1)(G);”; and

(III) in subparagraph (D), by inserting “, through the use of penetration testing, the vulnerability disclosure program established under section 3559B, and other means,” after “periodically”;

(iii) in paragraph (3)—

(I) in subparagraph (B), by inserting “, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency,” after “maintaining”;

(II) in subparagraph (D), by striking “and” at the end;

(III) in subparagraph (E), by adding “and” at the end; and

(IV) by adding at the end the following:

“(F) implementing mechanisms for using verification specifications, or alternate verification specifications validated by the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director of the National Institute of Standards and Technology, to automatically verify the implementation of standards of agency systems promulgated under section 11331 of title 40 or any additional cybersecurity procedures, as applicable;”; and

(iv) in paragraph (5), by inserting “and the Director of the Cybersecurity and Infrastructure Security Agency” before “on the effectiveness”;

(B) in subsection (b)—

(i) by striking paragraph (1) and inserting the following:

“(1) pursuant to subsection (a)(1)(A), performing an agency system risk assessment, which shall include using automated tools consistent with standards, verification specifications, and guidelines promulgated under section 11331 of title 40, as applicable;”;

(ii) in paragraph (2)(D)—

(I) by redesignating clauses (iii) and (iv) as clauses (iv) and (v), respectively;

(II) by inserting after clause (ii) the following:

“(iii) binding operational directives and emergency directives promulgated by the Director of the Cybersecurity and Infrastructure Security Agency under section 3553 of title 44;”; and

(III) in clause (iv), as so redesignated, by striking “as determined by the agency; and” and inserting “as determined by the agency—

“(I) in coordination with the Director of the Cybersecurity and Infrastructure Security Agency; and

“(II) in consideration of—

“(aa) the agency risk assessment performed under subsection (a)(1)(A); and

“(bb) the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section 11331(c)(1) of title 40; and”;

(iii) in paragraph (5)—

(I) in subparagraph (A), by inserting “, including penetration testing, as appropriate,” after “shall include testing”; and

(II) in subparagraph (C), by inserting “, verification specifications,” after “with standards”;

(iv) in paragraph (6), by striking “planning, implementing, evaluating, and documenting” and inserting “planning and implementing and, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, evaluating and documenting”;

(v) by redesignating paragraphs (7) and (8) as paragraphs (9) and (10), respectively;

(vi) by inserting after paragraph (6) the following:

“(7) a process for providing the status of every remedial action and known system vulnerability to the Director and the Director of the Cybersecurity and Infrastructure Security Agency, using automation and machine-readable data to the greatest extent practicable;

“(8) a process for providing the verification of the implementation of standards promulgated under section 11331 of title 40 using verification specifications, automation, and machine-readable data, to the Director and the Director of the Cybersecurity and Infrastructure Security Agency;”; and

(vii) in paragraph (9)(C), as so redesignated—

(I) by striking clause (ii) and inserting the following:

“(ii) notifying and consulting with the Federal information security incident center established under section 3556 pursuant to the requirements of section 3594;”;

(II) by redesignating clause (iii) as clause (iv);

(III) by inserting after clause (ii) the following:

“(iii) performing the notifications and other activities required under subchapter IV of this title; and”; and

(IV) in clause (iv), as so redesignated—

(aa) in subclause (I), by striking “and relevant Offices of Inspector General”;

(bb) in subclause (II), by adding “and” at the end;

(cc) by striking subclause (III); and

(dd) by redesignating subclause (IV) as subclause (III);

(C) in subsection (c)—

(i) in paragraph (1)—

(I) in subparagraph (A)—

(aa) in the matter preceding clause (i), by striking “on the adequacy and effectiveness of information security policies, procedures, and practices, including” and inserting “that includes”; and

(bb) in clause (ii), by inserting “unless the Director issues a waiver to the agency under subparagraph (B)(iii),” before “the total number”; and

(II) by striking subparagraph (B) and inserting the following:

“(B) INCIDENT REPORTING WAIVER.—

“(i) CERTIFICATION OF AGENCY INFORMATION SHARING.—If the Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, determines that an agency shares any information relating to any incident pursuant to section 3594(a), the Director shall certify that the agency is in compliance with that section.

“(ii) CERTIFICATION OF ISSUING REPORT.—If the Director determines that the Director of the Cybersecurity and Infrastructure Security Agency uses the information described in clause (i) with respect to a particular agency to submit to Congress an annex required under section 3597(c)(3) for that agency, the Director shall certify that the Cybersecurity and Infrastructure Security Agency is in compliance with that section with respect to that agency.

“(iii) WAIVER.—The Director may waive the reporting requirement with respect to the information required to be included in the report under subparagraph (A)(ii) for a particular agency if—

“(I) the Director has issued a certification for the agency under clause (i); and

“(II) the Director has issued a certification with respect to the annex of the agency under clause (ii).

“(iv) REVOCATION OF WAIVER OR CERTIFICATIONS.—

“(I) WAIVER.—If, at any time, the Director determines that the Director of the Cybersecurity and Infrastructure Security Agency cannot submit to Congress an annex for a particular agency under section 3597(c)(3)—

“(aa) any waiver previously issued under clause (iii) with respect to that agency shall be considered void; and

“(bb) the Director shall revoke the certification for the annex of that agency under clause (ii).

“(II) CERTIFICATIONS.—If, at any time, the Director determines that an agency has not provided to the Director of the Cybersecurity and Infrastructure Security Agency the totality of incident information required under section 3594(a)—

“(aa) any waiver previously issued under clause (iii) with respect to that agency shall be considered void; and

“(bb) the Director shall revoke the certification for that agency under clause (i).

“(III) REISSUANCE.—If the Director revokes a waiver under this clause, the Director may issue a subsequent waiver if the Director issues new certifications under clauses (i) and (ii).”;

(ii) by redesignating paragraphs (2) through (5) as paragraphs (4) through (7), respectively; and

(iii) by inserting after paragraph (1) the following:

“(2) BIANNUAL REPORT.—Not later than 180 days after the date on which an agency completes an agency system risk assessment under subsection (a)(1)(A) and not less frequently than every 2 years, each agency shall submit to the Director, the Secretary, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Oversight and Reform of the House of Representatives, the Committee on Homeland Security of the House of Representatives, the appropriate authorization and appropriations committees of Congress, the National Cyber Director, and the Comptroller General of the United States a report that—

“(A) summarizes the agency system risk assessment performed under subsection (a)(1)(A);

“(B) evaluates the adequacy and effectiveness of information security policies, procedures, and practices of the agency to address the risks identified in the system risk assessment performed under subsection (a)(1)(A); and

“(C) summarizes the evaluations and implementation plans described in subparagraphs (F) and (G) of subsection (a)(1) and whether those evaluations and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency.

“(3) UNCLASSIFIED REPORTS.—Each report submitted under paragraphs (1) and (2)—

“(A) shall be, to the greatest extent practicable, in an unclassified and otherwise uncontrolled form; and

“(B) may include a classified annex.”; and

(D) in subsection (d)(1), in the matter preceding subparagraph (A), by inserting “and the Director of the Cybersecurity and Infrastructure Security Agency” after “the Director”;

(4) in section 3555—

(A) in subsection (a)(2)(A), by inserting “, including by penetration testing and analyzing the vulnerability disclosure program of the agency” after “information systems”;

(B) by striking subsection (f) and inserting the following:

“(f) Protection of information.— (1) Agencies and evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security.

“(2) The protections required under paragraph (1) shall be commensurate with the risk and comply with all applicable laws and regulations.

“(3) With respect to information that is not related to national security systems, agencies and evaluators shall make a summary of the information unclassified and publicly available, including information that does not identify—

“(A) specific information system incidents; or

“(B) specific information system vulnerabilities.”;

(C) in subsection (g)(2)—

(i) by striking “this subsection shall” and inserting “this subsection—

“(A) shall”;

(ii) in subparagraph (A), as so designated, by striking the period at the end and inserting “; and”; and

(iii) by adding at the end the following:

“(B) identify any entity that performs an independent audit under subsection (b).”; and

(D) in subsection (j), by striking “the Secretary” and inserting “the Director of the Cyber Security and Infrastructure Security Agency”; and

(5) in section 3556(a)—

(A) in the matter preceding paragraph (1), by inserting “within the Cybersecurity and Infrastructure Security Agency” after “incident center”; and

(B) in paragraph (4), by striking “3554(b)” and inserting “3554(a)(1)(A)”.

(d) Federal system incident response.—

(1) IN GENERAL.—Chapter 35 of title 44, United States Code, is amended by adding at the end the following:

(2) CLERICAL AMENDMENT.—The table of sections for chapter 35 of title 44, United States Code, is amended by adding at the end the following:

(a) Information Technology Modernization Centers of Excellence Program Act.—Section 2(c)(4)(A)(ii) of the Information Technology Modernization Centers of Excellence Program Act (40 U.S.C. 11301 note) is amended by striking the period at the end and inserting “, which shall be provided in coordination with the Director of the Cybersecurity and Infrastructure Security Agency.”.

(b) Modernizing Government Technology.—Subtitle G of title X of Division A of the National Defense Authorization Act for Fiscal Year 2018 (40 U.S.C. 11301 note) is amended—

(1) in section 1077(b)—

(A) in paragraph (5)(A), by inserting “improving the cybersecurity of systems and” before “cost savings activities”; and

(B) in paragraph (7)—

(i) in the paragraph heading, by striking “cio” and inserting “CIO”;

(ii) by striking “In evaluating projects” and inserting the following:

“(A) CONSIDERATION OF GUIDANCE.—In evaluating projects”;

(iii) in subparagraph (A), as so designated, by striking “under section 1094(b)(1)” and inserting “guidance issued by the Director”; and

(iv) by adding at the end the following:

“(B) CONSULTATION.—In using funds under paragraph (3)(A), the Chief Information Officer of the covered agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency.”; and

(2) in section 1078—

(A) by striking subsection (a) and inserting the following:

“(a) Definitions.—In this section:

“(1) AGENCY.—The term ‘agency’ has the meaning given the term in section 551 of title 5, United States Code.

“(2) HIGH VALUE ASSET.—The term ‘high value asset’ has the meaning given the term in section 3552 of title 44, United States Code.”;

(B) in subsection (b), by adding at the end the following:

“(8) PROPOSAL EVALUATION.—The Director shall—

“(A) give consideration for the use of amounts in the Fund to improve the security of high value assets; and

“(B) require that any proposal for the use of amounts in the Fund includes a cybersecurity plan, including a chain risk management plan, to be reviewed by the member of the Technology Modernization Board described in subsection (c)(5)(C).”; and

(C) in subsection (c)—

(i) in paragraph (2)(A)(i), by inserting “, including a consideration of the impact on high value assets” after “operational risks”;

(ii) in paragraph (5)—

(I) in subparagraph (A), by striking “and” at the end;

(II) in subparagraph (B), by striking the period at the end and inserting “and”; and

(III) by adding at the end the following:

“(C) a senior official from the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, appointed by the Director.”; and

(iii) in paragraph (6)(A), by striking “shall be—” and all that follows through “4 employees” and inserting “shall be 4 employees”.

(c) Subchapter I.—Subchapter I of subtitle III of title 40, United States Code, is amended—

(1) in section 11302—

(A) in subsection (b), by striking “use, security, and disposal of” and inserting “use, and disposal, and, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, promote and improve the security, of”;

(B) in subsection (c)—

(i) in paragraph (2), by inserting “in consultation with the Director of the Cybersecurity and Infrastructure Security Agency” before “, and results of”;

(ii) in paragraph (3)—

(I) in subparagraph (A), by striking “, and performance” and inserting “security, and performance”; and

(II) in subparagraph (C)—

(aa) by striking “For each major” and inserting the following:

“(i) IN GENERAL.—For each major”; and

(bb) by adding at the end the following:

“(ii) CYBERSECURITY.—In categorizing an investment according to risk under clause (i), the Chief Information Officer of the covered agency shall consult with the Director of the Cybersecurity and Infrastructure Security Agency on the cybersecurity or supply chain risk.

“(iii) SECURITY RISK GUIDANCE.—The Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance for the categorization of an investment under clause (i) according to the cybersecurity or supply chain risk.”; and

(iii) in paragraph (4)—

(I) in subparagraph (A)—

(aa) in clause (ii), by striking “and” at the end;

(bb) in clause (iii), by striking the period at the end and inserting “; and”; and

(cc) by adding at the end the following:

“(iv) in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the cybersecurity risks of the investment.”; and

(II) in subparagraph (B), in the matter preceding clause (i), by inserting “not later than 30 days after the date on which the review under subparagraph (A) is completed, ” before “the Administrator”;

(C) in subsection (f)—

(i) by striking “heads of executive agencies to develop” and inserting “heads of executive agencies to—

“(1) develop”;

(ii) in paragraph (1), as so designated, by striking the period at the end and inserting “; and”; and

(iii) by adding at the end the following:

“(2) consult with the Director of the Cybersecurity and Infrastructure Security Agency for the development and use of supply chain security best practices.”; and

(D) in subsection (h), by inserting “, including cybersecurity performances, ” after “the performances”; and

(2) in section 11303(b)(2)(B)—

(A) in clause (i), by striking “or” at the end;

(B) in clause (ii), by adding “or” at the end; and

(C) by adding at the end the following:

“(iii) whether the function should be performed by a shared service offered by another executive agency;”.

(d) Subchapter II.—Subchapter II of subtitle III of title 40, United States Code, is amended—

(1) in section 11312(a), by inserting “, including security risks” after “managing the risks”;

(2) in section 11313(1), by striking “efficiency and effectiveness” and inserting “efficiency, security, and effectiveness”;

(3) in section 11317, by inserting “security, ” before “or schedule”; and

(4) in section 11319(b)(1), in the paragraph heading, by striking “cios” and inserting “Chief Information Officers”.

(e) Subchapter III.—Section 11331 of title 40, United States Code, is amended—

(1) in subsection (a), by striking “section 3532(b)(1)” and inserting “section 3552(b)”;

(2) in subsection (b)(1)(A)—

(A) by striking “in consultation” and inserting “in coordination”;

(B) by striking “the Secretary of Homeland Security” and inserting “the Director of the Cybersecurity and Infrastructure Security Agency”; and

(C) by inserting “and associated verification specifications developed under subsection (g)” before “pertaining to Federal”;

(3) by striking subsection (c) and inserting the following:

“(c) Application of more stringent standards.—

“(1) IN GENERAL.—The head of an agency shall—

“(A) evaluate the need to employ standards for cost-effective, risk-based information security for all systems, operations, and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the Director under this section, if such standards contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Director; and

“(B) to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph (A) are necessary, employ those standards.

“(2) EVALUATION OF MORE STRINGENT STANDARDS.—In evaluating the need to employ more stringent standards under paragraph (1), the head of an agency shall consider available risk information, including—

“(A) the status of cybersecurity remedial actions of the agency;

“(B) any vulnerability information relating to agency systems that is known to the agency;

“(C) incident information of the agency;

“(D) information from—

“(i) penetration testing performed under section 3559A of title 44; and

“(ii) information from the verification disclosure program established under section 3559B of title 44;

“(E) agency threat hunting results under section 207 of the Federal Information Security Modernization Act of 2021;

“(F) Federal and non-Federal threat intelligence;

“(G) data on compliance with standards issued under this section, using the verification specifications developed under subsection (f) when appropriate;

“(H) agency system risk assessments of the agency performed under section 3554(a)(1)(A) of title 44; and

“(I) any other information determined relevant by the head of the agency.”;

(4) in subsection (d)(2)—

(A) by striking the paragraph heading and inserting “Consultation, notice, and comment”;

(B) by inserting “promulgate, ” before “significantly modify”; and

(C) by striking “shall be made after the public is given an opportunity to comment on the Director's proposed decision.” and inserting “shall be made—

“(A) for a decision to significantly modify or not promulgate such a proposed standard, after the public is given an opportunity to comment on the Director's proposed decision;

“(B) in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency;

“(C) considering the Federal risk assessments performed under section 3553(i) of title 44; and

“(D) considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard.”; and

(5) by adding at the end the following:

“(e) Review of promulgated standards.—

“(1) IN GENERAL.—Not less frequently than once every 2 years, the Director of the Office of Management and Budget, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency shall review the efficacy of the standards in effect promulgated under this section in reducing cybersecurity risks and determine whether any changes to those standards are appropriate based on—

“(A) the Federal risk assessment developed under section 3553(i) of title 44;

“(B) public comment; and

“(C) an assessment of the extent to which the proposed standards reduce risk relative to the cost of implementation of the standards.

“(2) UPDATED GUIDANCE.—Not later than 90 days after the date of the completion of the review under paragraph (1), the Director of the Office of Management and Budget shall issue guidance to agencies to make any necessary updates to the standards in effect promulgated under this section based on the results of the review.

“(3) CONGRESSIONAL REPORT.—Not later than 30 days after the date on which a review is completed under paragraph (1), the Director shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report that includes—

“(A) the review of the standards in effect promulgated under this section conducted under paragraph (1);

“(B) the risk mitigation offered by each standard described in subparagraph (A); and

“(C) a summary of—

“(i) the standards to which changes were determined appropriate during the review; and

“(ii) anticipated changes to the standards under this section in guidance issued under paragraph (2).

“(f) Verification specifications.—Not later than 1 year after the date on which the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3(a)), the Director of the Cybersecurity and Infrastructure Security Agency, in consultation with the Director of the National Institute of Standards and Technology, as practicable, shall develop technical specifications to enable the automated verification of the implementation of the controls within the standard.”.

(a) Responsibilities of the Cybersecurity and Infrastructure Security Agency.—

(1) RECOMMENDATIONS.—Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Chair of the Federal Trade Commission, the Chair of the Securities and Exchange Commission, the Secretary of the Treasury, the Director of the Federal Bureau of Investigation, the Director of the National Institute of Standards and Technology, and the head of any other appropriate Federal or non-Federal entity, shall consolidate, maintain, and make publicly available recommendations for individuals whose personal information, as defined in section 3591 of title 44, United States Code, as added by this Act, is inappropriately exposed as a result of a high risk incident described in section 3598(c)(2) of title 44, United States Code.

(2) PLAN FOR ANALYSIS OF, AND REPORT ON, FEDERAL INCIDENTS.—

(A) IN GENERAL.—Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall—

(i) develop a plan for the development of the analysis required under section 3597(b) of title 44, United States Code, as added by this Act, and the report required under subsection (c) of that section that includes—

(I) a description of any challenges the Director anticipates encountering; and

(II) the use of automation and machine-readable formats for collecting, compiling, monitoring, and analyzing data; and

(ii) provide to the appropriate congressional committees a briefing on the plan developed under clause (i).

(B) BRIEFING.—Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall provide to the appropriate congressional committees a briefing on—

(i) the execution of the plan required under subparagraph (A); and

(ii) the development of the report required under section 3597(c) of title 44, United States Code, as added by this Act.

(b) Responsibilities of the Director of the Office of Management and Budget.—

(1) FISMA.—Section 2 of the Federal Information Security Modernization Act of 2014 (44 U.S.C. 3554 note) is amended—

(A) by striking subsection (b); and

(B) by redesignating subsections (c) through (f) as subsections (b) through (e), respectively.

(2) INCIDENT DATA SHARING.—

(A) IN GENERAL.—The Director shall develop guidance, to be updated not less frequently than once every 2 years, on the content, timeliness, and format of the information provided by agencies under section 3594(a) of title 44, United States Code, as added by this Act.

(B) REQUIREMENTS.—The guidance developed under subparagraph (A) shall—

(i) prioritize the availability of data necessary to understand and analyze—

(I) the causes of incidents;

(II) the scope and scale of incidents within the agency networks and systems;

(III) cross Federal Government root causes of incidents;

(IV) agency response, recovery, and remediation actions; and

(V) the effectiveness of incidents;

(ii) enable the efficient development of—

(I) lessons learned and recommendations in responding to, recovering from, remediating, and mitigating future incidents; and

(II) the report on Federal compromises required under section 3597(c) of title 44, United States Code, as added by this Act;

(iii) include requirements for the timeliness of data production; and

(iv) include requirements for using automation and machine-readable data for data sharing and availability.

(3) GUIDANCE ON RESPONDING TO INFORMATION REQUESTS.—Not later than 1 year after the date of enactment of this Act, the Director shall develop guidance for agencies to implement the requirement under section 3594(c) of title 44, United States Code, as added by this Act, to provide information to other agencies experiencing incidents.

(4) STANDARD GUIDANCE AND TEMPLATES.—Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall develop guidance and templates, to be reviewed and, if necessary, updated not less frequently than once every 2 years, for use by Federal agencies in the activities required under sections 3592, 3593, and 3596 of title 44, United States Code, as added by this Act.

(5) CONTRACTOR AND GRANTEE GUIDANCE.—

(A) IN GENERAL.—Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Secretary of Homeland Security, the Secretary of Defense, the Administrator of General Services, and the heads of other agencies determined appropriate by the Director, shall issue guidance to Federal agencies on how to deconflict existing regulations, policies, and procedures relating to the responsibilities of contractors and grant recipients established under section 3595 of title 44, United States Code, as added by this Act.

(B) EXISTING PROCESSES.—To the greatest extent practicable, the guidance issued under subparagraph (A) shall allow contractors and grantees to use existing processes for notifying Federal agencies of incidents involving information of the Federal Government.

(6) UPDATED BRIEFINGS.—Not less frequently than once every 2 years, the Director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs (2) through (4).

(c) Update to the Privacy Act of 1974.—Section 552a(b) of title 5, United States Code (commonly known as the “Privacy Act of 1974”) is amended—

(1) in paragraph (11), by striking “or” at the end;

(2) in paragraph (12), by striking the period at the end and inserting “; and”; and

(3) by adding at the end the following:

“(13) to another agency in furtherance of a response to an incident (as defined in section 3552 of title 44) and pursuant to the information sharing requirements in section 3594 of title 44 if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought.”.

Not later than 1 year after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance for agencies on—

(1) completing the agency system risk assessment required under section 3554(a)(1)(A) of title 44, United States Code, as amended by this Act;

(2) implementing additional cybersecurity procedures, which shall include resources for shared services;

(3) establishing a process for providing the status of each remedial action under section 3554(b)(7) of title 44, United States Code, as amended by this Act, to the Director and the Cybersecurity and Infrastructure Security Agency using automation and machine-readable data, as practicable, which shall include—

(A) specific standards for the automation and machine-readable data; and

(B) templates for providing the status of the remedial action;

(4) interpreting the definition of “high value asset” in section 3552 of title 44, United States Code, as amended by this Act;

(5) implementing standards in agency authorization processes to encourage the tailoring of processes to agency and system risk that are proportionate to the sensitivity of systems, which shall include—

(A) a clarification of—

(i) the acceptable use and development of customization of standards promulgated under section 11331 of title 40, United States Code; and

(ii) the acceptable use of risk-based authorization procedures authorized on the date of enactment of this Act; and

(B) a requirement to coordinate with Inspectors Generals of agencies to ensure consistent understanding and application of agency policies for the purpose of Inspector General audits; and

(6) requiring, as practicable and pursuant to section 203, an evaluation of agency cybersecurity using metrics that are—

(A) based on outcomes; and

(B) based on time.

Not later than 180 days after the date of enactment of this Act, the Director shall issue guidance that requires agencies to notify entities that are compelled to share sensitive information with the agency of an incident that impacts—

(1) sensitive information shared with the agency by the entity; or

(2) the systems used to the transmit sensitive information described in paragraph (1) to the agency.

(a) In general.—As a component of the evaluation and report required under section 3555(h) of title 44, United States Code, and not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall perform a study that—

(1) assesses the standards promulgated under section 11331(b) of title 40, United States Code to determine the degree to which agencies use the authority under section 11331(c)(1) of title 40, United States Code to customize the standards relative to the risks facing each agency and agency system;

(2) assesses the effectiveness of the standards described in paragraph (1), including any standards customized by agencies under section 11331(c)(1) of title 40, United States Code, at improving agency cybersecurity;

(3) examines the quantification of cybersecurity risk in the private sector for any applicability for use by the Federal Government;

(4) examines cybersecurity metrics existing as of the date of enactment of this Act used by the Director, the Director of the Cybersecurity and Infrastructure Security Agency, and the heads of other agencies to evaluate the effectiveness of information security policies and practices; and

(5) with respect to the standards described in paragraph (1), provides recommendations for—

(A) the addition or removal of standards; or

(B) the customization of—

(i) the standards by agencies under section 11331(c)(1) of title 40, United States Code; or

Section 1328 of title 41, United States Code, is amended by striking “the date” and all that follows and inserting “December 31, 2026.”.