To improve the bill.

1. 1

   Change 1: Rewrites page 18, line 10

   ReplacesPrinted page

   Removes page 18, line 10 of the printed bill. See that page

   Inserted: agency.

   Inserted: "(o) Review of Office of Management and Budget Guidance and Policy.--

   Inserted: "(1) Review.--

   Inserted: "(A) In general.--Not less frequently than once every 3 years, the Director, in consultation with the Chief Information Officers Council, the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Comptroller General of the United States, and the Council of the Inspectors General on Integrity and Efficiency, shall--

   Inserted: "(i) review the efficacy of the guidance and policy developed by the Director under subsection (a)(1) in reducing cybersecurity risks, including an assessment of the requirements for agencies to report information to the Director; and

   Inserted: "(ii) determine whether any changes to the guidance or policy developed under subsection (a)(1) is appropriate.

   Inserted: "(B) Considerations.--In conducting the review required under subparagraph (A), the Director shall consider--

   Inserted: "(i) the Federal risk assessments performed under subsection (i);

   Inserted: "(ii) the cumulative reporting and compliance burden to agencies; and

   Inserted: "(iii) the clarity of the requirements and deadlines contained in guidance and policy documents.

   Inserted: "(2) Updated guidance.--Not later than 90 days after the date on which a review is completed under paragraph (1), the Director shall issue updated guidance or policy to agencies determined appropriate by the Director, based on the results of the review.

   Inserted: "(3) Public report.--Not later than 30 days after the date on which the Director completes a review under paragraph (1), the Director shall make publicly available a report that includes--

   Show 6 more inserted paragraphsShow less

   Inserted: "(A) an overview of the guidance and policy developed under subsection (a)(1) that is in effect;

   Inserted: "(B) the cybersecurity risk mitigation, or other cybersecurity benefit, offered by each guidance or policy described in subparagraph (A);

   Inserted: "(C) a summary of the guidance or policy developed under subsection (a)(1) to which changes were determined appropriate during the review; and

   Inserted: "(D) the changes that are anticipated to be included in the updated guidance or policy issued under paragraph (2).

   Inserted: "(4) Congressional briefing.--Not later than 60 days after the date on which a review is completed under paragraph (1), the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a briefing on the review.

   Inserted: "(p) Automated Standard Implementation Verification.--When the Director of the National Institute of Standards and Technology issues a proposed standard pursuant to paragraphs (2) or (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(a)), the Director of the National Institute of Standards and Technology shall consider developing and, if appropriate and practical, develop, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, specifications to enable the automated verification of the implementation of the controls within the standard.";

   Original wording

   On page 18, strike line 10 and insert the following: “agency.

2. 2

   Change 2: Replaces “considering--” through “and” with “considering the agency risk assessment performed under subsection (a)(1)(A); and”

   ReplacesPage 26, lines 15–23Printed page

   In S. 3600 · Placed on Calendar Senate

   "(iii) binding operational directives and emergency directives promulgated by the Director of the Cybersecurity and Infrastructure Security Agency under section 3553;"; and

   (cc) in clause (iv), as so redesignated, by striking "as determined by the agency; and" and inserting "as determined by the agency, considering[struck: --][inserted: the agency risk assessment performed under subsection (a)(1)(A); and]

   Struck: "(I) the agency risk assessment performed under subsection (a)(1)(A); and

   "(II) the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section 11331(c)(1) of title 40; and";

   Original wording

   On page 26, line 15, strike “considering--” and all that follows through “and” on line 23 and insert “considering the agency risk assessment performed under subsection (a)(1)(A); and”.

3. 3

   Change 3: Strikes page 74, line 10 through page 80, line 19

   StrikesPrinted page

   Removes page 74, line 10 through page 80, line 19 of the printed bill. See that page

   Original wording

   On page 74, strike line 10 and all that follows through page 80, line 19.

4. 4

   Change 4: Replaces “the use of--” through “additional” with “the use of additional”

   ReplacesPage 99, lines 17–21Printed page

   In S. 3600 · Placed on Calendar Senate

   (D) allocate available human and financial resources to implement the plan; and

   (E) provide input to the heads of agencies on the use of[struck: --][inserted: additional cybersecurity procedures under section 3554 of title 44, United States Code.]

   Struck: (i) more stringent standards under section 11331(c)(1) of title 40, United States Code; and

   Struck: (ii) additional cybersecurity procedures under section 3554 of title 44, United States Code.

   (b) Reports.--The Director of the Cybersecurity and Infrastructure Security Agency shall submit to the appropriate congressional committees--

   Original wording

   On page 99, line 17, strike “the use of--” and all that follows through “additional” on line 21 and insert “the use of additional”.

Read automatically from the Congressional Record. Check the original before relying on it.

As printed