Federal Cybersecurity Oversight Act of 2020

II 116TH CONGRESS 2D SESSION S. 4912 To amend the Federal Cybersecurity Enhancement Act of 2015 to require Federal agencies to obtain exemptions from certain cybersecurity require- ments in order to avoid compliance with those requirements, and for other purposes. IN THE SENATE OF THE UNITED STATES NOVEMBER 18, 2020 Mr. WYDEN introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To amend the Federal Cybersecurity Enhancement Act of 2015 to require Federal agencies to obtain exemptions from certain cybersecurity requirements in order to avoid compliance with those requirements, and for other pur- poses. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Federal Cybersecurity 4 Oversight Act of 2020’’. 5 VerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4912.IS S4912 pbinns on DSKJLVW7X2PROD with BILLS 2 •S 4912 IS SEC. 2. FEDERAL CYBERSECURITY REQUIREMENTS. 1 (a) EXEMPTION FROM FEDERAL REQUIREMENTS.— 2 Section 225(b)(2) of the Federal Cybersecurity Enhance- 3 ment Act of 2015 (6 U.S.C. 1523(b)(2)) is amended to 4 read as follows: 5 ‘‘(2) EXCEPTION.— 6 ‘‘(A) IN GENERAL.—A particular require- 7 ment under paragraph (1) shall not apply to an 8 agency information system of an agency if— 9 ‘‘(i) with respect to the agency infor- 10 mation system, the head of the agency sub- 11 mits to the Director an application for an 12 exemption from the particular requirement, 13 in which the head of the agency personally 14 certifies to the Director with particularity 15 that— 16 ‘‘(I) operational requirements ar- 17 ticulated in the certification and re- 18 lated to the agency information sys- 19 tem would make it excessively burden- 20 some to implement the particular re- 21 quirement; 22 ‘‘(II) the particular requirement 23 is not necessary to secure the agency 24 information system or agency infor- 25 VerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4912.IS S4912 pbinns on DSKJLVW7X2PROD with BILLS 3 •S 4912 IS mation stored on or transiting the 1 agency information system; and 2 ‘‘(III) the agency has taken all 3 necessary steps to secure the agency 4 information system and agency infor- 5 mation stored on or transiting the 6 agency information system; 7 ‘‘(ii) the head of the agency or the 8 designee of the head of the agency has 9 submitted the certification described in 10 clause (i) to the appropriate congressional 11 committees and any other congressional 12 committee with jurisdiction over the agen- 13 cy; and 14 ‘‘(iii) the Director grants the exemp- 15 tion from the particular requirement. 16 ‘‘(B) DURATION OF EXEMPTION.— 17 ‘‘(i) IN GENERAL.—An exemption 18 granted under subparagraph (A) shall ex- 19 pire on the date that is 1 year after the 20 date on which the Director grants the ex- 21 emption. 22 ‘‘(ii) RENEWAL.—Upon the expiration 23 of an exemption granted to an agency 24 under subparagraph (A), the head of the 25 VerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4912.IS S4912 pbinns on DSKJLVW7X2PROD with BILLS 4 •S 4912 IS agency may apply for an additional exemp- 1 tion.’’. 2 (b) REPORT ON EXEMPTIONS.—Section 3 3554(c)(1)(A) of title 44, United States Code, is amend- 4 ed— 5 (1) in clause (iii), by striking ‘‘and’’ at the end; 6 (2) by redesignating clause (iv) as clause (v); 7 and 8 (3) by inserting after clause (iii) the following: 9 ‘‘(iv) with respect to any exemptions 10 the agency is granted by the Director of 11 the Office of Management and Budget 12 under section 225(b)(2) of the Federal Cy- 13 bersecurity Enhancement Act of 2015 (6 14 U.S.C. 1523(b)(2)) that is effective on the 15 date of submission of the report— 16 ‘‘(I) an identification of the par- 17 ticular requirements from which any 18 agency information system (as defined 19 in section 2210 of the Homeland Se- 20 curity Act of 2002 (6 U.S.C. 660)) is 21 exempted; and 22 ‘‘(II) for each requirement identi- 23 fied under subclause (I)— 24 VerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4912.IS S4912 pbinns on DSKJLVW7X2PROD with BILLS 5 •S 4912 IS ‘‘(aa) an identification of the 1 agency information system de- 2 scribed in subclause (I) exempted 3 from the requirement; and 4 ‘‘(bb) an estimate of the 5 date on which the agency will to 6 be able to comply with the re- 7 quirement; and’’. 8 (c) EFFECTIVE DATE.—This Act and the amend- 9 ments made by this Act shall take effect on the date that 10 is 1 year after the date of enactment of this Act. 11 Æ VerDate Sep 11 2014 04:39 Nov 24, 2020 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\S4912.IS S4912 pbinns on DSKJLVW7X2PROD with BILLS