S.Amdt. 2712

1. Adds SEC. __. FEDERAL COMPUTER SECURITY wherever appropriate

   Adds a section

   Inserted: SEC. __. FEDERAL COMPUTER SECURITY.

   Inserted: (a) Definitions.--In this section:

   Inserted: (1) Covered agency.--The term "covered agency" means an agency that operates a Federal computer system that provides access to classified information or personally identifiable information.

   Inserted: (2) Logical access control.--The term "logical access control" means a process of granting or denying specific requests to obtain and use information and related information processing services.

   Inserted: (3) Multi-factor logical access controls.--The term "multi-factor logical access controls" means a set of not less than 2 of the following logical access controls:

   Inserted: (A) Information that is known to the user, such as a password or personal identification number.

   Inserted: (B) An access device that is provided to the user, such as a cryptographic identification device or token.

   Inserted: (C) A unique biometric characteristic of the user.

   Inserted: (4) Privileged user.--The term "privileged user" means a user who, by virtue of function or seniority, has been allocated powers within a Federal computer system, which are significantly greater than those available to the majority of users.

   Inserted: (b) Inspector General Report on Federal Computer Systems.--

   Inserted: (1) In general.--Not later than 240 days after the date of enactment of this Act, the Inspector General of each covered agency shall each submit to the Comptroller General of the United States and the appropriate committees of jurisdiction in the Senate and the House of Representatives a report, which shall include information collected from the covered agency for the contents described in paragraph (2) regarding the Federal computer systems of the covered agency.

   Inserted: (2) Contents.--The report submitted by each Inspector General of a covered agency under paragraph (1) shall include, with respect to the covered agency, the following:

   Show 19 more inserted paragraphsShow less

   Inserted: (A) A description of the logical access standards used by the covered agency to access a Federal computer system that provides access to classified or personally identifiable information, including--

   Inserted: (i) in aggregate, a list and description of logical access controls used to access such a Federal computer system; and

   Inserted: (ii) whether the covered agency is using multi-factor logical access controls to access such a Federal computer system.

   Inserted: (B) A description of the logical access controls used by the covered agency to govern access to Federal computer systems by privileged users.

   Inserted: (C) If the covered agency does not use logical access controls or multi-factor logical access controls to access a Federal computer system that provides access to classified or personally identifiable information, a description of the reasons for not using such logical access controls or multi-factor logical access controls.

   Inserted: (D) A description of the following data security management practices used by the covered agency:

   Inserted: (i) The policies and procedures followed to conduct inventories of the software present on the Federal computer systems of the covered agency and the licenses associated with such software.

   Inserted: (ii) Whether the covered agency has entered into a licensing agreement for the use of software security controls to monitor and detect exfiltration and other threats, including--

   Inserted: (I) data loss prevention software; or

   Inserted: (II) digital rights management software.

   Inserted: (iii) A description of how the covered agency is using software described in clause (ii).

   Inserted: (iv) If the covered agency has not entered into a licensing agreement for the use of, or is otherwise not using, software described in clause (ii), a description of the reasons for not entering into such a licensing agreement or using such software.

   Inserted: (E) A description of the policies and procedures of the covered agency with respect to ensuring that entities, including contractors, that provide services to the covered agency are implementing the data security management practices described in subparagraph (D).

   Inserted: (3) Existing review.--The report required under this subsection may be based in whole or in part on an audit, evaluation, or report relating to programs or practices of the covered agency, and may be submitted as part of another report, including the report required under section 3555 of title 44, United States Code.

   Inserted: (4) Classified information.--A report submitted under this subsection shall be in unclassified form, but may include a classified annex.

   Inserted: (5) Availability to members of congress.--A report submitted under this subsection shall be made available upon request by any Member of Congress.

   Inserted: (c) GAO Economic Analysis and Report on Federal Computer Systems.--

   Inserted: (1) Report.--Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report examining, including an economic analysis of, any impediments to agency use of effective security software and security devices.

   Inserted: (2) Classified information.--A report submitted under this subsection shall be in unclassified form, but may include a classified annex.

   The amendment doesn't say where this goes; the clerk decides.

   Original wording

   At the appropriate place, insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed