Cybersecurity and Financial System Resilience Act of 2019

IIB 116TH CONGRESS 2D SESSION H. R. 4458 IN THE SENATE OF THE UNITED STATES JANUARY 14, 2020 Received; read twice and referred to the Committee on Banking, Housing, and Urban Affairs AN ACT To require the Board of Governors of the Federal Reserve System to issue reports on cybersecurity with respect to the functions of the Federal Reserve System, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS 2 HR 4458 RFS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Cybersecurity and Fi- 2 nancial System Resilience Act of 2019’’. 3 SEC. 2. CYBERSECURITY AND FINANCIAL SYSTEM RESIL- 4 IENCE REPORT. 5 (a) IN GENERAL.—Not later than the end of the 180- 6 day period beginning on the date of enactment of this Act, 7 and annually thereafter, each banking regulator shall sub- 8 mit a report to the Committee on Financial Services of 9 the House of Representatives and the Committee on 10 Banking, Housing, and Urban Affairs of the Senate that 11 provides a detailed explanation of measures undertaken to 12 strengthen cybersecurity with respect to the functions of 13 the regulator, including the supervision and regulation of 14 financial institutions and, where applicable, third-party 15 service providers. Each such report shall specifically in- 16 clude a detailed analysis of— 17 (1) policies and procedures (including those de- 18 scribed under section 3554(b) of title 44, United 19 States Code) that guard against— 20 (A) efforts to deny access to or degrade, 21 disrupt, or destroy any information and com- 22 munications technology system or network, or 23 exfiltrate information from such a system or 24 network without authorization; 25 (B) destructive malware attacks; 26 VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS 3 HR 4458 RFS (C) denial of service activities; and 1 (D) any other efforts that may threaten 2 the functions of the banking regulator or enti- 3 ties overseen by the regulator by undermining 4 cybersecurity and the resilience of the financial 5 system; 6 (2) activities to ensure the effective implemen- 7 tation of policies and procedures described under 8 paragraph (1), including— 9 (A) the appointment of qualified staff, the 10 provision of staff training, the use of account- 11 ability measures to support staff performance, 12 and the designation, if any, of senior appointed 13 leadership to strengthen accountability for over- 14 sight of cybersecurity measures; 15 (B) deployment of adequate resources and 16 technologies; 17 (C) efforts to respond to cybersecurity-re- 18 lated findings and recommendations of the In- 19 spector General of the banking regulator or the 20 independent evaluation described under section 21 3555 of title 42, United States Code; and 22 (D) as appropriate, efforts to strengthen 23 cybersecurity in coordination with other Federal 24 departments and agencies, domestic and foreign 25 VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS 4 HR 4458 RFS financial institutions, and other partners, in- 1 cluding the development and dissemination of 2 best practices regarding cybersecurity and the 3 sharing of threat information; and 4 (3) any current or emerging threats that are 5 likely to pose a risk to the resilience of the financial 6 system. 7 (b) FORM OF REPORT.—The report required under 8 subsection (a) shall be submitted in unclassified form, but 9 may include a classified annex, if appropriate. 10 (c) CONGRESSIONAL BRIEFING.—Upon request, the 11 head of each banking regulator shall provide a detailed 12 briefing to the appropriate Members of Congress on each 13 report submitted pursuant to subsection (a), except— 14 (1) the Chairman of the Board of Governors of 15 the Federal Reserve System may designate another 16 member of the Board of Governors of the Federal 17 Reserve System to provide such briefing; 18 (2) the Chairperson of the Federal Deposit In- 19 surance Corporation may designate another member 20 of the Board of Directors of the Corporation to pro- 21 vide such briefing; and 22 (3) the Chairman of the National Credit Union 23 Administration may designate another member of 24 VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS 5 HR 4458 RFS the National Credit Union Administration Board to 1 provide such briefing. 2 (d) DEFINITIONS.—For the purposes of this Act: 3 (1) APPROPRIATE MEMBERS OF CONGRESS.— 4 The term ‘‘appropriate Members of Congress’’ 5 means the following: 6 (A) The Chairman and Ranking Member 7 of the Committee on Financial Services of the 8 House of Representatives. 9 (B) The Chairman and Ranking Member 10 of the Committee on Banking, Housing, and 11 Urban Affairs of the Senate. 12 (2) BANKING REGULATOR.—The term ‘‘banking 13 regulator’’ means the Board of Governors of the 14 Federal Reserve System, the Comptroller of the Cur- 15 rency, the Federal Deposit Insurance Corporation, 16 and the National Credit Union Administration. 17 (3) SENIOR APPOINTED LEADERSHIP.—With 18 respect to a banking regulator, the term ‘‘senior ap- 19 pointed leadership’’ means a position that requires 20 Senate confirmation. 21 (e) SUNSET.—The provisions of this Act shall have 22 no force or effect on or after the date that is 7 years after 23 the date of enactment of this Act. 24 VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS 6 HR 4458 RFS SEC. 3. DETERMINATION OF BUDGETARY EFFECTS. 1 The budgetary effects of this Act, for the purpose of 2 complying with the Statutory Pay-As-You-Go Act of 2010, 3 shall be determined by reference to the latest statement 4 titled ‘‘Budgetary Effects of PAYGO Legislation’’ for this 5 Act, submitted for printing in the Congressional Record 6 by the Chairman of the House Budget Committee, pro- 7 vided that such statement has been submitted prior to the 8 vote on passage. 9 Passed the House of Representatives January 13, 2020. Attest: CHERYL L. JOHNSON, Clerk. VerDate Sep 11 2014 23:07 Jan 14, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H4458.RFS H4458 pamtmann on DSKBC07HB2PROD with BILLS