TH D CONGRESS SESSION S. ll

1 DUN22124 8WH 117 THCONGRESS 2 DSESSION S. ll To improve the cybersecurity of the Federal Government, and for other purposes. IN THE SENATE OF THE UNITED STATES llllllllll Mr. PETERS(for himself and Mr. PORTMAN) introduced the following bill; which was read twice and referred to the Committee on llllllllll A BILL To improve the cybersecurity of the Federal Government, and for other purposes. Be it enacted by the Senate and House of Representa-1tives of the United States of America in CONGRESS assembled, 2 SECTION 1.

2 SHORT TITLE. 3 This Act may be cited as the Strengthening Amer-4ican Cybersecurity Act of 2022 . 5 SEC. 2. TABLE OF CONTENTS. 6 The table of contents for this Act is as follows: 7 Sec. 1. Short title. Sec. 2. Table of contents. TITLE I FEDERAL INFORMATION SECURITY MODERNIZATION ACT OF 2022 2 DUN22124 8WH Sec. 101. Short title. Sec. 102. Definitions. Sec. 103. Title 44 amendments. Sec. 104. Amendments to subtitle III of title 40. Sec. 105. Actions to enhance Federal incident transparency.

3 Sec. 106. Additional guidance to agencies on FISMA updates. Sec. 107. Agency requirements to notify private sector entities impacted by in-cidents. Sec. 108. Mobile security standards. Sec. 109. Data and logging retention for incident response. Sec. 110. CISA agency advisors. Sec. 111. Federal penetration testing policy. Sec. 112. Ongoing threat hunting program. Sec. 113. Codifying vulnerability disclosure programs. Sec. 114. Implementing zero trust architecture. Sec. 115. Automation reports.

4 Sec. 116. Extension of Federal acquisition security council and software inven-tory. Sec. 117. Council of the Inspectors General on Integrity and Efficiency dash-board. Sec. 118. Quantitative cybersecurity metrics. Sec. 119. Establishment of risk-based budget model. Sec. 120. Active cyber defensive study. Sec. 121. Security operations center as a service pilot. Sec. 122. Extension of Chief Data Officer Council. TITLE II CYBER INCIDENT REPORTING FOR CRITICAL INFRASTRUCTURE ACT OF 2022 Sec.

5 201. Short title. Sec. 202. Definitions. Sec. 203. Cyber incident reporting. Sec. 204. Federal sharing of incident reports. Sec. 205. Ransomware vulnerability warning pilot program. Sec. 206. Ransomware threat mitigation activities. Sec. 207. Congressional reporting. TITLE III FEDERAL SECURE CLOUD IMPROVEMENT AND JOBS ACT OF 2022 Sec. 301. Short title. Sec. 302. Findings. Sec. 303. Title 44 amendments. TITLE I FEDERAL INFORMA-1 TION SECURITY MODERNIZA-2 TION ACT OF 2022 3 SEC. 101. SHORT TITLE.

6 4 This title may be cited as the Federal Information 5 Security Modernization Act of 2022 . 63 DUN22124 8WH SEC. 102. DEFINITIONS. 1In this title, unless otherwise specified: 2(1) ADDITIONALCYBERSECURITYPROCE-3 DURE. The term additional cybersecurity proce-4dure has the meaning given the term in section 53552(b) of title 44, United States Code, as amended 6by this title. 7(2) AGENCY. The term agency has the 8meaning given the term in section 3502 of title 44, 9 United States Code.

7 10(3) APPROPRIATECONGRESSIONALCOMMIT-11 TEES. The term appropriate congressional com-12mittees means 13(A) the Committee on Homeland Security 14and Governmental Affairs of the Senate; 15(B) the Committee on Oversight and Re-16form of the House of Representatives; and 17(C) the Committee on Homeland Security 18of the House of Representatives. 19(4) DIRECTOR. The term Director means 20the Director of the Office of Management and Budg-21et. 22(5) INCIDENT. The term incident has the 23meaning given the term in section 3552(b) of title 2444, United States Code.

8 254 DUN22124 8WH (6) NATIONAL SECURITY SYSTEM. The term 1 national security system has the meaning given 2the term in section 3552(b) of title 44, United 3 States Code. 4(7) PENETRATION TEST. The term penetra-5tion test has the meaning given the term in section 63552(b) of title 44, United States Code, as amended 7by this title. 8(8) THREATHUNTING. The term threat 9hunting means proactively and iteratively searching 10systems for threats that evade detection by auto-11mated threat detection systems.

9 12 SEC. 103. TITLE 44 AMENDMENTS. 13(a) SUBCHAPTERI AMENDMENTS. Subchapter I of 14chapter 35 of title 44, United States Code, is amended 15(1) in section 3504 16(A) in subsection (a)(1)(B) 17(i) by striking clause (v) and inserting 18the following: 19 (v) confidentiality, privacy, disclosure, 20and sharing of information; ; 21(ii) by redesignating clause (vi) as 22clause (vii); and 23(iii) by inserting after clause (v) the 24following: 255 DUN22124 8WH (vi) in consultation with the National 1 Cyber Director, security of information; and.

10 2and 3(B) in subsection (g), by striking para-4graph (1) and inserting the following: 5 (1) develop and oversee the implementation of 6policies, principles, standards, and guidelines on pri-7vacy, confidentiality, disclosure, and sharing, and in 8consultation with the National Cyber Director, over-9see the implementation of policies, principles, stand-10ards, and guidelines on security, of information col-11lected or maintained by or for agencies; and ; 12(2) in section 3505 13(A) by striking the first subsection des-14ignated as subsection (c); 15(B) in paragraph (2) of the second sub-16section designated as subsection (c), by insert-17ing an identification of internet accessible in-18formation systems and after an inventory 19under this subsection shall include.