Risk-Informed Spending for Cybersecurity Act

II 116TH CONGRESS 2D SESSION S. 4785 To require the Director of the Office of Management and Budget to develop a model for risk-based budgeting, and for other purposes. IN THE SENATE OF THE UNITED STATES OCTOBER 1, 2020 Mr. PORTMAN (for himself and Mr. PETERS) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs A BILL To require the Director of the Office of Management and Budget to develop a model for risk-based budgeting, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Risk-Informed Spend- 4 ing for Cybersecurity Act’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 2 •S 4785 IS (1) APPROPRIATE CONGRESSIONAL COMMIT- 1 TEES.—The term ‘‘appropriate congressional com- 2 mittees’’ means— 3 (A) the Committee on Homeland Security 4 and Governmental Affairs and the Committee 5 on Appropriations of the Senate; and 6 (B) the Committee on Homeland Security 7 and the Committee on Appropriations of the 8 House of Representatives. 9 (2) COVERED AGENCY.—The term ‘‘covered 10 agency’’ has the meaning given the term ‘‘executive 11 agency’’ in section 133 of title 41, United States 12 Code. 13 (3) DIRECTOR.—The term ‘‘Director’’ means 14 the Director of the Office of Management and Budg- 15 et. 16 (4) INFORMATION TECHNOLOGY.—The term 17 ‘‘information technology’’— 18 (A) has the meaning given the term in sec- 19 tion 11101 of title 40, United States Code; and 20 (B) includes the hardware and software 21 systems of a Federal agency that monitor and 22 control physical equipment and processes of the 23 Federal agency. 24 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 3 •S 4785 IS (5) RISK-BASED BUDGET.—The term ‘‘risk- 1 based budget’’ means a budget— 2 (A) developed by identifying and 3 prioritizing cybersecurity risks and 4 vulnerabilities, including impact on agency oper- 5 ations in the case of a cyber attack, through 6 analysis of threat intelligence, incident data, 7 and tactics, techniques, procedures, and capa- 8 bilities of cyber threats; and 9 (B) that allocates resources based on the 10 risks identified and prioritized under subpara- 11 graph (A). 12 SEC. 3. ESTABLISHMENT OF RISK-BASED BUDGET MODEL. 13 (a) IN GENERAL.— 14 (1) MODEL.—Not later than 1 year after the 15 first publication of the budget submitted by the 16 President under section 1105 of title 31, United 17 States Code, following the date of enactment of this 18 Act, the Director, in coordination with the Director 19 of the Cybersecurity and Infrastructure Security 20 Agency and in consultation with the Director of the 21 National Institute of Standards and Technology, 22 shall develop a standard model for creating a risk- 23 based budget for cybersecurity spending. 24 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 4 •S 4785 IS (2) RESPONSIBILITY OF DIRECTOR.—Section 1 3553(a) of title 44, United States Code, is amend- 2 ed— 3 (A) in paragraph (5), by striking ‘‘and’’ at 4 the end; 5 (B) in paragraph (6), by striking the pe- 6 riod at the end and inserting ‘‘; and’’; and 7 (C) by adding at the end the following: 8 ‘‘(7) developing a standard risk-based budget 9 model to inform Federal agency cybersecurity budget 10 development.’’. 11 (3) CONTENTS OF MODEL.—The model re- 12 quired to be developed under paragraph (1) shall— 13 (A) consider Federal and non-Federal 14 cyber threat intelligence products, where avail- 15 able, to identify threats, vulnerabilities, and 16 risks; 17 (B) consider the impact of agency oper- 18 ations of compromise of systems, including the 19 interconnectivity to other agency systems and 20 the operations of other agencies; 21 (C) indicate where resources should be al- 22 located to have the greatest impact on miti- 23 gating current and future threats and current 24 and future cybersecurity capabilities; 25 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 5 •S 4785 IS (D) be used to inform acquisition and 1 sustainment of— 2 (i) information technology and cyber- 3 security tools; 4 (ii) information technology and cyber- 5 security architectures; 6 (iii) information technology and cyber- 7 security personnel; and 8 (iv) cybersecurity and information 9 technology concepts of operations; and 10 (E) be used to evaluate and inform govern- 11 ment-wide cybersecurity programs of the De- 12 partment of Homeland Security. 13 (4) REQUIRED UPDATES.—Not less frequently 14 than once every 3 years, the Director shall review, 15 and update as necessary, the model required to be 16 developed under this subsection. 17 (5) PUBLICATION.—The Director shall publish 18 the model required to be developed under this sub- 19 section, and any updates necessary under paragraph 20 (4), on the public website of the Office of Manage- 21 ment and Budget. 22 (6) REPORTS.—Not later than 1 year after the 23 date of enactment of this Act, and annually there- 24 after for each of the 2 following fiscal years or until 25 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 6 •S 4785 IS the date on which the model required to be devel- 1 oped under this subsection is completed, whichever is 2 sooner, the Director shall submit a report to Con- 3 gress on the development of the model. 4 (b) REQUIRED USE OF RISK-BASED BUDGET 5 MODEL.— 6 (1) IN GENERAL.—Not later than 2 years after 7 the date on which the model developed under sub- 8 section (a) is published, the head of each covered 9 agency shall use the model to develop the annual cy- 10 bersecurity and information technology budget re- 11 quests of the agency. 12 (2) AGENCY PERFORMANCE PLANS.—Section 13 3554(d)(2) of title 44, United States Code, is 14 amended by inserting ‘‘and the risk-based budget 15 model required under section 3553(a)(7)’’ after 16 ‘‘paragraph (1)’’. 17 (c) VERIFICATION.— 18 (1) IN GENERAL.—Section 1105(a)(35)(A)(i) of 19 title 31, United States Code, is amended— 20 (A) in the matter preceding subclause (I), 21 by striking ‘‘by agency, and by initiative area 22 (as determined by the administration)’’ and in- 23 serting ‘‘and by agency’’; 24 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 7 •S 4785 IS (B) in subclause (III), by striking ‘‘and’’ 1 at the end; 2 (C) in subclause (IV), by adding ‘‘and’’ at 3 the end; and 4 (D) by adding at the end the following: 5 ‘‘(V) a validation that the budg- 6 ets submitted were developed using a 7 risk-based methodology;’’. 8 (2) EFFECTIVE DATE.—The amendments made 9 by paragraph (1) shall take effect on the date that 10 is 2 years after the date on which the model devel- 11 oped under subsection (a) is published. 12 (d) ANNUAL REPORTS.— 13 (1) ANNUAL INDEPENDENT EVALUATION.—Sec- 14 tion 3555(a)(2) of title 44, United States Code, is 15 amended— 16 (A) in subparagraph (B), by striking 17 ‘‘and’’ at the end; 18 (B) in subparagraph (C), by striking the 19 period at the end and inserting ‘‘; and’’; and 20 (C) by adding at the end the following: 21 ‘‘(D) an assessment of how the agency im- 22 plemented the risk-based budget model required 23 under section 3553(a)(7) and an evaluation of 24 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 8 •S 4785 IS whether the model mitigates agency cyber 1 vulnerabilities.’’. 2 (2) ASSESSMENT.—Section 3553(c) of title 44, 3 United States Code, is amended— 4 (A) in paragraph (4), by striking ‘‘and’’ at 5 the end; 6 (B) in paragraph (5), by striking the pe- 7 riod at the end and inserting ‘‘; and’’; and 8 (C) by adding at the end the following: 9 ‘‘(6) an assessment of— 10 ‘‘(A) Federal agency implementation of the 11 model required under subsection (a)(7); 12 ‘‘(B) how cyber vulnerabilities of Federal 13 agencies changed from the previous year; and 14 ‘‘(C) whether the model mitigates the 15 cyber vulnerabilities of the Federal Govern- 16 ment.’’. 17 (e) GAO REPORT.—Not later than 3 years after the 18 date on which the first budget of the President is sub- 19 mitted to Congress containing the validation required 20 under section 1105(a)(35)(A)(i)(V) of title 31, United 21 States Code, as amended by subsection (c), the Comp- 22 troller General of the United States shall submit to the 23 appropriate congressional committees a report that in- 24 cludes— 25 VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS 9 •S 4785 IS (1) an evaluation of the success of covered 1 agencies in developing risk-based budgets; 2 (2) an evaluation of the success of covered 3 agencies in implementing risk-based budgets; 4 (3) an evaluation of whether the risk-based 5 budgets developed by covered agencies mitigate 6 cyber vulnerability, including the extent to which the 7 risk-based budgets inform Federal Government-wide 8 cybersecurity programs; and 9 (4) any other information relating to risk-based 10 budgets the Comptroller General determines appro- 11 priate. 12 Æ VerDate Sep 11 2014 04:20 Oct 17, 2020 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6301 E:\BILLS\S4785.IS S4785 kjohnson on DSK79L0C42PROD with BILLS