Federal System Incident Response Act of 2020

II 116TH CONGRESS 2D SESSION S. 5008 To require notification of incidents at agencies involving sensitive personal information, and for other purposes. IN THE SENATE OF THE UNITED STATES DECEMBER 10, 2020 Mr. PETERS (for himself and Mr. PORTMAN) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs A BILL To require notification of incidents at agencies involving sensitive personal information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Federal System Inci- 4 dent Response Act of 2020’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) APPROPRIATE CONGRESSIONAL COMMIT- 8 TEES.—The term ‘‘appropriate congressional com- 9 mittees’’ means— 10 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 5008 IS (A) the Committee on Homeland Security 1 and Governmental Affairs of the Senate; 2 (B) the Committee on Oversight and Re- 3 form of the House of Representatives; and 4 (C) the Committee on Homeland Security 5 of the House of Representatives. 6 (2) DIRECTOR.—The term ‘‘Director’’ means 7 the Director of the Office of Management and Budg- 8 et. 9 SEC. 3. FEDERAL INFORMATION SYSTEM INCIDENT RE- 10 SPONSE. 11 (a) IN GENERAL.—Chapter 35 of title 44, United 12 States Code, is amended by adding at the end the fol- 13 lowing: 14 ‘‘Subchapter IV—Federal Information System 15 Incident Response 16 ‘‘§ 3591. Definitions 17 ‘‘(a) IN GENERAL.—Except as provided under sub- 18 section (b), the definitions under section 3502 shall apply 19 to this subchapter. 20 ‘‘(b) ADDITIONAL DEFINITIONS.—As used in this 21 subchapter: 22 ‘‘(1) APPROPRIATE NOTIFICATION ENTITIES.— 23 The term ‘appropriate notification entities’ means— 24 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 5008 IS ‘‘(A) the Committee on Homeland Security 1 and Governmental Affairs of the Senate; 2 ‘‘(B) the Committee on Commerce, 3 Science, and Transportation of the Senate; 4 ‘‘(C) the Committee on Oversight and Re- 5 form of the House of Representatives; 6 ‘‘(D) the Committee on Homeland Security 7 of the House of Representatives; 8 ‘‘(E) the Committee on Science, Space, 9 and Technology of the House of Representa- 10 tives; 11 ‘‘(F) the appropriate authorization and ap- 12 propriations committees of Congress; 13 ‘‘(G) the Director; 14 ‘‘(H) the Secretary of Homeland Security; 15 and 16 ‘‘(I) the Comptroller General of the United 17 States. 18 ‘‘(2) INCIDENT.—The term ‘incident’ has the 19 meaning given the term in section 3552 of this title. 20 ‘‘(3) CONTRACTOR.—The term ‘contractor’— 21 ‘‘(A) means any person or business that 22 collects or maintains information that includes 23 personally identifiable information or sensitive 24 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 5008 IS personal information on behalf of an agency; 1 and 2 ‘‘(B) includes any subcontractor of a per- 3 son or business described in subparagraph (A). 4 ‘‘(4) COVERED INCIDENT.—The term ‘covered 5 incident’ means, with respect to any information col- 6 lected or maintained by or on behalf of an agency 7 or information system used or operated by an agen- 8 cy or by a contractor of an agency or other organiza- 9 tion on behalf of an agency— 10 ‘‘(A) a major incident, as defined by the 11 Director pursuant to section 2(b) of the Federal 12 Information Security Modernization Act of 13 2014 (44 U.S.C. 3554 note); 14 ‘‘(B) any incident determined likely to 15 have a significant impact on national security, 16 homeland security, or economic security of the 17 United States; 18 ‘‘(C) any incident determined likely to have 19 a significant impact on the operations of the 20 agency or the Federal Government; or 21 ‘‘(D) any incident that is determined to 22 have involved any sensitive personal informa- 23 tion, regardless of the number of impacted indi- 24 viduals. 25 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 5008 IS ‘‘(5) INTELLIGENCE COMMUNITY.—The term 1 ‘intelligence community’ has the meaning given the 2 term in section 3 of the National Security Act of 3 1947 (50 U.S.C. 3003). 4 ‘‘(6) NATIONWIDE CONSUMER REPORTING 5 AGENCY.—The term ‘nationwide consumer reporting 6 agency’ means a consumer reporting agency de- 7 scribed in section 603(p) of the Fair Credit Report- 8 ing Act (15 U.S.C. 1681a(p)). 9 ‘‘(7) SENSITIVE PERSONAL INFORMATION.— 10 The term ‘sensitive personal information’ means, 11 with respect to an individual— 12 ‘‘(A) any combination of data or informa- 13 tion that, if exposed, could result in substantial 14 harm, physical harm, embarrassment, or unfair- 15 ness to the individual, including biometric, ge- 16 netic, or other data; and 17 ‘‘(B) any other information as determined 18 by the Director. 19 ‘‘(8) SUBSTANTIAL HARM.—The term ‘substan- 20 tial harm’, with respect to an individual, means iden- 21 tity theft, financial fraud, or other financial harm to 22 the individual. 23 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 5008 IS ‘‘§ 3592. Notification to impacted individuals involv- 1 ing sensitive personal information 2 ‘‘(a) NOTIFICATION.—As expeditiously as practicable 3 and without unreasonable delay, and in any case not later 4 than 30 days after an agency has a reasonable basis to 5 conclude that a covered incident described in section 6 3591(b)(4)(D) has occurred, the head of the agency shall 7 provide notice of the incident in accordance with sub- 8 section (b) in writing to the last known home mailing ad- 9 dress of each impacted individual. 10 ‘‘(b) CONTENTS OF NOTICE.—Each notice required 11 under subsection (a) shall include— 12 ‘‘(1) a description of the categories of sensitive 13 personal information that were, or are reasonably 14 believed to have been, involved in the covered inci- 15 dent, including a list of all data elements; 16 ‘‘(2) a description of the substantial harm, em- 17 barrassment, inconvenience, or unfairness to the in- 18 dividual that an individual may reasonably expect to 19 experience based on the information or combination 20 of information involved in the covered incident; 21 ‘‘(3) contact information for the Federal Bu- 22 reau of Investigation or other appropriate entity; 23 ‘‘(4) the contact information of each nationwide 24 consumer reporting agency; 25 VerDate Sep 11 2014 22:42 Dec 21, 2020 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 5008 IS ‘‘(5) the contact information for questions to 1 the agency, including a telephone number, e-mail ad- 2 dress, and website; 3 ‘‘(6) information on any remedy being offered 4 by the agency; 5 ‘‘(7) consolidated Federal Government rec- 6 ommendations on what to do in the event of a cov- 7 ered incident; and 8 ‘‘(8) any other appropriate information as de- 9 termined by the head of the agency. 10 ‘‘(c) DELAY OF NOTIFICATION.— 11 ‘‘(1) IN GENERAL.—The Inspector General of 12 the agency that experienced the covered incident, the 13 Attorney General, the Director of National Intel- 14 ligence, or the Secretary of Homeland Security may 15 impose a delay of a notification required under sub- 16 section (a) if the notification would disrupt a law en- 17 forcement investigation, endanger national security, 18 or hamper security remediation actions. 19 ‘‘(2) DOCUMENTATION.— 20 ‘‘(A) IN GENERAL.—Any delay under para- 21 graph (1) shall be reported in writing to the 22 head of the agency, the Director, the Director 23 of the Cybersecurity and Infrastructure Secu- 24 rity Agency, and the Office of Inspector Gen- 25 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 5008 IS eral of the agency that experienced the covered 1 incident. 2 ‘‘(B) CONTENTS.—A statement required 3 under subparagraph (A) shall include a written 4 statement from the entity that delayed the noti- 5 fication explaining the need for the delay. 6 ‘‘(C) FORM.—The statement required 7 under subparagraph (A) shall be unclassified, 8 but may include a classified annex. 9 ‘‘(3) RENEWAL.—A delay under paragraph (1) 10 shall be for a period of 2 months and may be re- 11 newed. 12 ‘‘(d) EXEMPTION FOR NOTIFICATION.— 13 ‘‘(1) IN GENERAL.—The head of an agency, in 14 consultation with the Inspector General of the agen- 15 cy, may request an exemption from the Director 16 from complying with the notification requirements 17 under subsection (a) if— 18 ‘‘(A) the information affected by the cov- 19 ered incident is determined by an independent 20 evaluation to be unreadable, including instances 21 when the information is encrypted or when the 22 encryption key has not been acquired; or 23 ‘‘(B) the covered incident has otherwise 24 been determined by an independent evaluation 25 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 5008 IS to be of de minimis threat to those individuals 1 whose sensitive personal information was in- 2 volved in the incident. 3 ‘‘(2) APPROVAL.—The Director shall make a 4 determination for granting an exemption in con- 5 sultation with— 6 ‘‘(A) the Director of the Cybersecurity and 7 Infrastructure Security Agency; and 8 ‘‘(B) the Attorney General. 9 ‘‘(3) DOCUMENTATION.—Any exemption grant- 10 ed by the Director under subparagraph (A) or (B) 11 of paragraph (1) shall be reported in writing to the 12 head of the agency that experienced the covered inci- 13 dent, the Office of Inspector General of the agency 14 that experienced the covered incident, and the Direc- 15 tor of the Cybersecurity and Infrastructure Security 16 Agency. 17 ‘‘(e) UPDATE NOTIFICATION.—If an agency deter- 18 mines there is a change in the reasonable basis to conclude 19 that a covered incident occurred, or that there is a change 20 in the details of the information provided to impacted indi- 21 viduals as described in subsection (b), the agency shall as 22 expeditiously as practicable and without unreasonable 23 delay, and in any case not later than 30 days after such 24 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 5008 IS a determination, notify all such individuals who received 1 a notification pursuant to subsection (a) of those changes. 2 ‘‘(f) RULE OF CONSTRUCTION.—Nothing in this sec- 3 tion shall be construed to limit— 4 ‘‘(1) the Director from issuing guidance regard- 5 ing notifications or the head of an agency from 6 sending notifications to individuals impacted by inci- 7 dents not determined to be covered incidents, as de- 8 scribed in section 3591(b)(4)(D); or 9 ‘‘(2) the Director from issuing guidance regard- 10 ing notifications for covered incidents meeting the 11 criteria in section 3591(b)(4)(D) or the head of an 12 agency from issuing notifications to individuals im- 13 pacted by covered incidents meeting the criteria in 14 section 3591(b)(4)(D) that contain more information 15 than described in subsection (b). 16 ‘‘§ 3593. Congressional notifications and reports 17 ‘‘(a) INITIAL REPORT.— 18 ‘‘(1) IN GENERAL.—Not later than 7 days after 19 the date on which an agency has a reasonable basis 20 to conclude that a covered incident occurred, the 21 head of the agency shall submit a written notifica- 22 tion and, to the extent practicable, provide a brief- 23 ing, to the appropriate notification entities, taking 24 into account the information known at the time of 25 VerDate Sep 11 2014 22:36 Dec 20, 2020 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 5008 IS the notification, the sensitivity of the details associ- 1 ated with the covered incident, and the classification 2 level of the information contained in the notification. 3 ‘‘(2) CONTENTS.—A notification required under 4 paragraph (1) shall include— 5 ‘‘(A) a summary of the information avail- 6 able about the covered incident, including how 7 the covered incident occurred, based on infor- 8 mation available to agency officials as of the 9 date which the agency submits the report; 10 ‘‘(B) if applicable, an estimate of the num- 11 ber of individuals impacted by the covered inci- 12 dent, including an assessment of the risk of 13 harm to impacted individuals based on informa- 14 tion available to agency officials on the date on 15 which the agency submits the report; 16 ‘‘(C) if applicable, a description and any 17 associated documentation of any circumstances 18 necessitating a delay in or exemption to notifi- 19 cation granted under subsection (c) or (d) of 20 section 3592; and 21 ‘‘(D) if applicable, an assessment of the 22 impacts to the agency, the Federal Government, 23 or the security of the United States as identi- 24 fied in section 3591(b)(4), based on information 25 VerDate Sep 11 2014 16:13 Dec 19, 2020 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S5008.IS S5008 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 5008 IS available to agency officials on the date on 1 which the agency submits the report. 2 ‘‘(b) SUPPLEMENTAL REPORT.—Within a reasonable 3 amount of time, but not later than 45 days after the date 4 on which additional information relating to a covered inci- 5 dent for which an agency submitted a written notification 6 under subsection (a) is discovered by the agency, the head 7 of the agency shall submit to the appropriate congres- 8 sional committees updates to the written notification that 9 include summaries of— 10 ‘‘(1) the threats and threat actors, 11 vulnerabilities, means by which the covered incident 12 occurred, and impacts to the agency relating to the 13 covered incident; 14 ‘‘(2) any risk assessment and subsequent risk- 15 based security implementation of the affected infor- 16 mation system before the date on which the covered 17 incident occurred; 18 ‘‘(3) the status of compliance of the affected in- 19 formation system with applicable security require- 20 ments at the time of the covered incident; 2 [Text truncated for display. Full text available on Congress.gov.]