S.Amdt. 4156

SA 4156. Mr. WYDEN submitted an amendment intended to be proposed to
amendment SA 3867 submitted by Mr. Reed and intended to be proposed to
the bill H.R. 4350, to authorize appropriations for fiscal year 2022
for military activities of the Department of Defense, for military
construction, and for defense activities of the Department of Energy,
to prescribe military personnel strengths for such fiscal year, and for
other purposes; which was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. FEDERAL CYBERSECURITY REQUIREMENTS.

(a) Exemption From Federal Requirements.--Section 225(b)(2)
of the Federal Cybersecurity Enhancement Act of 2015 (6
U.S.C. 1523(b)(2)) is amended to read as follows:
``(2) Exception.--
``(A) In general.--A particular requirement under paragraph
(1) shall not apply to an agency information system of an
agency if--
``(i) with respect to the agency information system, the
head of the agency submits to the Director an application for
an exemption from the particular requirement, in which the
head of the agency personally certifies to the Director with
particularity that--

``(I) operational requirements articulated in the
certification and related to the agency information system
would make it excessively burdensome to implement the
particular requirement;
``(II) the particular requirement is not necessary to
secure the agency information system or agency information
stored on or transiting the agency information system; and
``(III) the agency has taken all necessary steps to secure
the agency information system and agency information stored
on or transiting the agency information system;

``(ii) the head of the agency or the designee of the head
of the agency has submitted the certification described in
clause (i) to the appropriate congressional committees and
any other congressional committee with jurisdiction over the
agency; and
``(iii) the Director grants the exemption from the
particular requirement.
``(B) Duration of exemption.--
``(i) In general.--An exemption granted under subparagraph
(A) shall expire on the date that is 1 year after the date on
which the Director grants the exemption.
``(ii) Renewal.--Upon the expiration of an exemption
granted to an agency under subparagraph (A), the head of the
agency may apply for an additional exemption.''.
(b) Report on Exemptions.--Section 3554(c)(1)(A) of title
44, United States Code, is amended--
(1) in clause (iii), by striking ``and'' at the end;
(2) by redesignating clause (iv) as clause (v); and
(3) by inserting after clause (iii) the following:
``(iv) with respect to any exemptions the agency is granted
by the Director of the Office of Management and Budget under
section 225(b)(2) of the Federal Cybersecurity Enhancement
Act of 2015 (6 U.S.C. 1523(b)(2)) that is effective on the
date of submission of the report--

``(I) an identification of the particular requirements from
which any agency information system (as defined in section
2210 of the Homeland Security Act of 2002 (6 U.S.C. 660)) is
exempted; and
``(II) for each requirement identified under subclause
(I)--

``(aa) an identification of the agency information system
described in subclause (I) exempted from the requirement; and
``(bb) an estimate of the date on which the agency will to
be able to comply with the requirement; and''.
(c) Effective Date.--This section and the amendments made
by this section shall take effect on the date that is 1 year
after the date of enactment of this Act.
______