Building Cyber Resilience After SolarWinds Act of 2023

I 118TH CONGRESS 1ST SESSION H. R. 3166 To require the Cybersecurity and Infrastructure Security Agency of the De- partment of Homeland Security to submit a report on the impact of the SolarWinds cyber incident on information systems owned and oper- ated by Federal departments and agencies and other critical infrastruc- ture, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MAY 9, 2023 Mr. TORRES of New York introduced the following bill; which was referred to the Committee on Homeland Security, and in addition to the Com- mittee on Oversight and Accountability, for a period to be subsequently determined by the Speaker, in each case for consideration of such provi- sions as fall within the jurisdiction of the committee concerned A BILL To require the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to sub- mit a report on the impact of the SolarWinds cyber incident on information systems owned and operated by Federal departments and agencies and other critical in- frastructure, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 02:17 May 20, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3166.IH H3166 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3166 IH SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Building Cyber Resil- 2 ience After SolarWinds Act of 2023’’. 3 SEC. 2. BUILDING CYBER RESILIENCE AFTER SOLARWINDS. 4 (a) DEFINITIONS.—In this section: 5 (1) CRITICAL INFRASTRUCTURE.—The term 6 ‘‘critical infrastructure’’ has the meaning given such 7 term in section 1016(e) of Public Law 107–56 (42 8 U.S.C. 5195c(e)). 9 (2) DIRECTOR.—The term ‘‘Director’’ means 10 the Director of the Cybersecurity and Infrastructure 11 Security Agency. 12 (3) INFORMATION SYSTEM.—The term ‘‘infor- 13 mation system’’ has the meaning given such term in 14 section 2200 of the Homeland Security Act of 2002 15 (6 U.S.C. 650). 16 (4) SIGNIFICANT CYBER INCIDENT.—The term 17 ‘‘significant cyber incident’’ has the meaning given 18 such term in section 2240 of the Homeland Security 19 Act of 2002 (6 U.S.C. 681). 20 (5) SOLARWINDS INCIDENT.—The term 21 ‘‘SolarWinds incident’’ refers to the significant cyber 22 incident that prompted the establishment of a Uni- 23 fied Cyber Coordination Group, as provided by sec- 24 tion V(B)(2) of Presidential Policy Directive 41, in 25 December 2020. 26 VerDate Sep 11 2014 02:17 May 20, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3166.IH H3166 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3166 IH (b) SOLARWINDS INVESTIGATION AND REPORT.— 1 (1) INVESTIGATION.—The Director, in con- 2 sultation with the National Cyber Director and the 3 heads of other relevant Federal departments and 4 agencies, shall carry out an investigation to evaluate 5 the impact of the SolarWinds incident on informa- 6 tion systems owned and operated by Federal depart- 7 ments and agencies, and, to the extent practicable, 8 other critical infrastructure. 9 (2) ELEMENTS.—In carrying out subsection 10 (b), the Director shall review the following: 11 (A) The extent to which Federal informa- 12 tion systems were accessed, compromised, or 13 otherwise impacted by the SolarWinds incident, 14 and any potential ongoing security concerns or 15 consequences arising from such incident. 16 (B) The extent to which information sys- 17 tems that support other critical infrastructure 18 were accessed, compromised, or otherwise im- 19 pacted by the SolarWinds incident, where such 20 information is available to the Director. 21 (C) Any ongoing security concerns or con- 22 sequences arising from the SolarWinds incident, 23 including any sensitive information that may 24 VerDate Sep 11 2014 02:17 May 20, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3166.IH H3166 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3166 IH have been accessed or exploited in a manner 1 that poses a threat to national security. 2 (D) Implementation of Executive Order 3 14028 (Improving the Nation’s Cybersecurity 4 (May 12, 2021)). 5 (E) Efforts taken by the Director, the 6 heads of Federal departments and agencies, 7 and critical infrastructure owners and operators 8 to address cybersecurity vulnerabilities and 9 mitigate risks associated with the SolarWinds 10 incident. 11 (c) REPORT.—Not later than 120 days after the date 12 of the enactment of this Act, the Director shall submit 13 to the Committee on Homeland Security of the House of 14 Representatives and Committee on Homeland Security 15 and Governmental Affairs of the Senate a report that in- 16 cludes the following: 17 (1) Findings for each of the elements specified 18 in subsection (b). 19 (2) Recommendations to address security gaps, 20 improve incident response efforts, and prevent simi- 21 lar cyber incidents. 22 (3) Any areas with respect to which the Direc- 23 tor lacked the information necessary to fully review 24 and assessment such elements, the reason the infor- 25 VerDate Sep 11 2014 02:17 May 20, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3166.IH H3166 kjohnson on DSK79L0C42PROD with BILLS 5 •HR 3166 IH mation necessary was unavailable, and recommenda- 1 tions to close such informational gaps. 2 (d) GAO REPORT ON CYBER SAFETY REVIEW 3 BOARD.—Not later than one year after the date of the 4 enactment of this Act, the Comptroller General of the 5 United States shall evaluate the activities of the Cyber 6 Safety Review Board established pursuant to Executive 7 Order 14028 (Improving the Nation’s Cybersecurity (May 8 12, 2021)), with a focus on the Board’s inaugural review 9 announced in February 2022, and assess whether the 10 Board has the authorities, resources, and expertise nec- 11 essary to carry out its mission of reviewing and assessing 12 significant cyber incidents. 13 Æ VerDate Sep 11 2014 02:17 May 20, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H3166.IH H3166 kjohnson on DSK79L0C42PROD with BILLS